Question 93 of 964
Customer-Managed Encryption Keys in Microservices: Minimizing Blast Radius
A healthcare SaaS provider is deploying a new application that processes protected health information (PHI). The application uses a microservices architecture running on Kubernetes. Each microservice stores its data in a separate database. The compliance team requires that all data at rest be encrypted and that encryption keys be managed by the customer (CMEK). The cloud provider supports KMS with CMEK. However, the development team wants to use a single customer-managed key for all databases to simplify key management. The security architect is concerned about the blast radius if the key is compromised. Which of the following recommendations best balances security and operational efficiency?
Quick Answer
The correct choice is to use a separate customer-managed encryption key for each database, with automated key rotation. This recommendation minimizes the blast radius by ensuring that if a single customer-managed encryption key is compromised, only the data in that specific microservice’s database is exposed, rather than all protected health information across the architecture. This directly aligns with the principle of least privilege and the zero-trust security model required for microservices, where each service should have its own isolated encryption boundary. On the Certified Cloud Security Professional CCSP exam, this scenario tests your understanding of key management strategies within cloud KMS, specifically how customer-managed encryption keys (CMEK) enforce data sovereignty and compliance. A common trap is choosing a single key for simplicity, which violates the core security goal of reducing blast radius. Remember the mnemonic: “One key per DB, not one key to rule them all.”
⚠ Common exam trap
ISC2 often tests the tension between operational simplicity and security blast radius, where candidates may choose a single key with rotation (Option D) thinking it balances both, but fail to recognize that rotation does not shrink the blast radius of a compromised key that has already been used to encrypt data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a separate customer-managed key for each database, with automated key rotation
It minimizes the blast radius by ensuring that compromise of one key does not expose data in other databases, while automated key rotation reduces the window of vulnerability and operational overhead. This aligns with the principle of least privilege and the compliance requirement for customer-managed encryption keys (CMEK). Using separate keys per database is a standard security best practice for microservices architectures, especially when handling PHI.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the cloud provider's default encryption keys for all databases
Why it's wrong here
Default keys do not satisfy CMEK requirement.
- ✓
Use a separate customer-managed key for each database, with automated key rotation
Why this is correct
Separate keys limit blast radius and rotation reduces risk.
- ✗
Disable encryption to improve performance and use network segmentation instead
Why it's wrong here
Encryption is required by compliance.
- ✗
Use one customer-managed key for all databases, but enable automatic key rotation
Why it's wrong here
Single key increases blast radius.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CCSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are a cloud security engineer for a financial services company. The company has developed a cloud-native application that processes credit card transactions and stores sensitive financial data. The application is deployed on a Kubernetes cluster in a public cloud provider. The compliance team requires that all data at rest be encrypted using a customer-managed key (CMK) with automatic rotation. The application uses a managed database service (e.g., Amazon RDS) and object storage (e.g., Amazon S3) for storing transaction logs. The current configuration uses cloud-provider-managed keys for both services. The development team is concerned that enabling CMK with automatic rotation might cause application downtime due to key rotation latency. Additionally, the security team wants to ensure that access to the keys is auditable. Which course of action BEST addresses the compliance requirement while minimizing risk?
medium- ✓ A.Create a CMK with automatic rotation enabled, grant the database and storage service access via IAM roles, and validate the rotation process in a staging environment before production deployment.
- B.Continue using cloud-provider-managed keys and implement additional logging to meet audit requirements.
- C.Use a CMK with manual rotation to have full control over the rotation schedule and avoid any potential downtime.
- D.Implement client-side encryption with a key stored in a secure vault and disable server-side encryption.
Why A: It directly satisfies the compliance requirement for customer-managed keys (CMK) with automatic rotation, while mitigating the risk of downtime by validating the rotation process in a staging environment. Using IAM roles to grant the database and storage service access to the CMK ensures that key access is auditable via CloudTrail, meeting the security team's audit requirement. This approach allows the development team to test and confirm that key rotation latency does not cause application downtime before production deployment.
Last reviewed: Jun 30, 2026
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.