mediumMultiple ChoiceObjective-mapped
BYOK vs SSE for HIPAA Compliance: Key Management in Cloud
A healthcare organization stores patient records in a cloud-based object storage service. To comply with HIPAA, they must ensure that data is encrypted at rest and that encryption keys are managed by the organization itself. Which key management approach should they implement?
Quick Answer
The correct answer is BYOK with an HSM in the cloud because HIPAA mandates that the covered entity maintain exclusive control over its encryption keys, and the Bring Your Own Key (BYOK) model allows the organization to generate and manage keys externally while using a hardware security module to enforce that the cloud provider never has access to the key material. This directly satisfies the HIPAA requirement for the organization itself to manage encryption keys, whereas server-side encryption (SSE) would leave key management to the provider and fail the compliance test. On the Certified Cloud Security Professional CCSP exam, this scenario tests your understanding of key management ownership versus encryption implementation—a common trap is confusing SSE with BYOK when the question explicitly states the organization must manage the keys. Remember the mnemonic: “BYOK keeps the key, SSE lets the cloud see.”
⚠ Common exam trap
ISC2 often tests the distinction between server-side encryption (where the provider manages keys) and client-side or BYOK models (where the customer retains key control), and the trap here is that candidates may assume SSE-KMS (Option B) gives the organization full key control, but KMS still allows the provider to manage the key lifecycle, failing the strict HIPAA requirement for the organization to be the sole manager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a Bring Your Own Key (BYOK) model with a hardware security module (HSM) in the cloud.
HIPAA requires the organization to maintain control over encryption keys, and a Bring Your Own Key (BYOK) model with a hardware security module (HSM) in the cloud allows the healthcare organization to generate, store, and manage their own keys externally while using them for cloud-based encryption. This approach ensures that the cloud provider cannot access the keys, meeting the regulatory requirement for key management by the organization itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use server-side encryption with S3-managed keys (SSE-S3).
Why it's wrong here
Incorrect: SSE-S3 uses AWS-managed keys, giving the organization no control over key management.
- ✗
Use server-side encryption with AWS KMS-managed keys (SSE-KMS).
Why it's wrong here
Incorrect: SSE-KMS gives the organization some control, but key management is still partially handled by AWS, which may not satisfy HIPAA requirements.
- ✗
Use client-side encryption with customer-supplied encryption keys (CSEKS).
Why it's wrong here
Incorrect: CSEKS is not a standard term; the correct term is SSE-C, but it requires the client to manage keys manually.
- ✓
Implement a Bring Your Own Key (BYOK) model with a hardware security module (HSM) in the cloud.
Why this is correct
Correct: BYOK allows the organization to control the encryption keys and meet compliance requirements.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CCSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is storing sensitive customer data in an S3 bucket. They need to ensure data is encrypted at rest and that the encryption keys are managed by the cloud provider. Which encryption strategy should they use?
medium- A.SSE-C (Server-Side Encryption with Customer-Provided Keys)
- B.Client-side encryption
- C.SSE-KMS (Server-Side Encryption with AWS KMS)
- ✓ D.SSE-S3 (Server-Side Encryption with S3-Managed Keys)
Why D: SSE-S3 (Server-Side Encryption with S3-Managed Keys) encrypts data at rest using AES-256, with the encryption keys fully managed by AWS. This meets the requirement for the cloud provider to handle key management without any customer involvement in key generation, storage, or rotation.
Variation 2. A financial services company is migrating sensitive customer data to a cloud environment. The compliance team requires that all data at rest be encrypted using a key managed by the organization, not the cloud provider. Which solution should the company implement?
easy- A.Enforce TLS 1.2 for all data transfers
- B.Implement tokenization for all sensitive fields
- ✓ C.Client-side encryption using a customer-managed key
- D.Server-side encryption with AWS S3 managed keys (SSE-S3)
Why C: Client-side encryption ensures that data is encrypted before it leaves the organization's control, and the customer retains sole possession of the encryption key. This satisfies the compliance requirement that the cloud provider never has access to the key, as the provider only stores the encrypted ciphertext. In contrast, server-side encryption options (like SSE-S3) involve the provider managing or having access to the key material.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.