hardMultiple ChoiceObjective-mapped
CCSP Practice Question: During a cloud migration, a company discovers…
During a cloud migration, a company discovers that its existing virtual machine images contain embedded credentials and proprietary software that must not be exposed to the cloud provider's administrators. Which of the following is the BEST strategy to protect this sensitive data while maintaining the ability to create new instances?
⚠ Common exam trap
Many exam-takers confuse integrity controls (hashing) with confidentiality controls (encryption), or assume that network-level protections like VPNs extend to data at rest, leading them to pick Option A or B instead of the correct encryption-based answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt the virtual machine images using a customer-provided key (CMK) integrated with the cloud provider's key management service.
Encrypting the virtual machine images with a customer-provided key (CMK) integrated with the cloud provider's key management service ensures that the cloud provider's administrators cannot access the embedded credentials and proprietary software. The encryption is performed client-side or using envelope encryption where the CMK wraps a data encryption key, and only the customer holds the master key material. This allows the customer to create new instances from the encrypted image while maintaining full control over access to the sensitive data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a VPN to encrypt data in transit between the on-premises environment and the cloud.
Why it's wrong here
This protects data during transfer, but the image at rest in the cloud is still exposed.
- ✗
Use a cryptographic hash of the image to ensure integrity, and store the image in object storage with access controls.
Why it's wrong here
Hashing ensures integrity, not confidentiality; the image remains unencrypted.
- ✓
Encrypt the virtual machine images using a customer-provided key (CMK) integrated with the cloud provider's key management service.
Why this is correct
Encryption with a CMK ensures the provider cannot decrypt the image without the key.
- ✗
Tokenize the embedded credentials and replace them with placeholders in the image.
Why it's wrong here
Tokenization is for sensitive data elements, not entire images, and may break functionality.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.