CCSP Cloud Application Security Practice Question
Which TWO are effective strategies for securing cloud application data at rest?
⚠ Common exam trap
ISC2 often tests the distinction between access control (RBAC) and encryption, where candidates mistakenly think that restricting access is sufficient to secure data at rest, ignoring that encryption is required to protect against physical theft or unauthorized storage-level access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File-level encryption
File-level encryption (C) encrypts individual files or directories, ensuring that data at rest remains protected even if the underlying storage is compromised. This is a direct data-at-rest security control because it applies cryptographic protection to the data itself, independent of the storage layer. Transparent data encryption (D) encrypts data at the database level, typically at the page or file level, without requiring changes to the application, making it another effective strategy for securing data at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Role-based access control
Why it's wrong here
RBAC restricts access to data but does not encrypt it at rest.
- ✗
Database activity monitoring
Why it's wrong here
Database activity monitoring detects anomalies but does not encrypt data at rest.
- ✓
File-level encryption
Why this is correct
File-level encryption encrypts individual files or directories, protecting data at rest.
- ✓
Transparent data encryption
Why this is correct
Transparent data encryption automatically encrypts data when written to disk and decrypts when read, without application changes.
- ✗
Network segmentation
Why it's wrong here
Network segmentation controls traffic but does not encrypt stored data.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.