mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: Requires that all data at rest in a cloud storage…
An organization requires that all data at rest in a cloud storage service be encrypted using a key that is managed entirely on-premises and never exposed to the cloud provider. The organization wants to use server-side encryption. Which approach should be used?
⚠ Common exam trap
ISC2 often tests the distinction between server-side and client-side encryption, and candidates may mistakenly choose client-side encryption (Option D) because it keeps keys on-premises, but the question specifically requires server-side encryption, making SSE-C the only correct option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use server-side encryption with a customer-provided key (SSE-C).
Server-side encryption with customer-provided keys (SSE-C) allows the organization to encrypt data at rest in the cloud while retaining full control of the encryption keys on-premises. With SSE-C, the customer provides the encryption key with each API request, and the cloud service uses it to encrypt/decrypt the data server-side, but the key is never stored by the provider. This meets the requirement of keeping the key entirely on-premises and never exposed to the cloud provider.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use server-side encryption with a key stored in the cloud provider's key management service (KMS).
Why it's wrong here
KMS keys are stored in the cloud, violating the requirement.
- ✓
Use server-side encryption with a customer-provided key (SSE-C).
Why this is correct
SSE-C encrypts data at rest using a key that you provide; the cloud does not store the key.
- ✗
Use server-side encryption with a cloud-managed key (SSE-S3).
Why it's wrong here
Cloud-managed keys are fully managed by the provider, not by the customer.
- ✗
Use client-side encryption where the application encrypts data before sending it to the cloud.
Why it's wrong here
Client-side encryption is not server-side; it encrypts data before upload.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.