easyMultiple ChoiceObjective-mapped
CCSP Practice Question: Wants to encrypt data at rest in a cloud object…
An organization wants to encrypt data at rest in a cloud object storage service. Which control is appropriate?
⚠ Common exam trap
ISC2 often tests the distinction between encryption in transit (TLS, VPN) and encryption at rest (SSE), leading candidates to mistakenly select TLS or VPN when the question explicitly asks about data at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable server-side encryption with a customer-managed key.
Server-side encryption with a customer-managed key (SSE-C) allows the cloud provider to encrypt data at rest in object storage using a key that the customer controls and manages. This ensures that the encryption process is handled by the service itself, but the customer retains control over key rotation, access, and revocation, which is appropriate for meeting compliance and security requirements for data at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a web application firewall.
Why it's wrong here
WAF protects against web attacks, not data at rest.
- ✓
Enable server-side encryption with a customer-managed key.
Why this is correct
Server-side encryption encrypts data at rest.
- ✗
Use a VPN for all access.
Why it's wrong here
VPN encrypts network traffic, not stored data.
- ✗
Enable TLS for all API requests.
Why it's wrong here
TLS encrypts data in transit, not at rest.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.