hardMultiple ChoiceObjective-mapped
CCSP Practice Question: Your organization, a healthcare provider subject…
Your organization, a healthcare provider subject to HIPAA, has migrated electronic protected health information (ePHI) to a public cloud IaaS provider. The cloud provider offers default encryption at rest using their managed key service. During a recent audit, it was discovered that the encryption keys are generated and stored by the cloud provider without any customer involvement. The auditor states that this arrangement may violate HIPAA requirements because the covered entity does not have exclusive control over the keys. You need to ensure compliance while maintaining cost efficiency. After discussing with the cloud provider, they suggest the following options: A. Enable client-side encryption using a custom key management system (KMS) on the customer's premises. B. Use the provider's default encryption and rely on their BAA that states they will protect the keys. C. Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer. D. Disable encryption and rely on access controls and auditing only.
Which option best addresses the compliance requirement while considering the operational impact?
⚠ Common exam trap
ISC2 often tests the misconception that a Business Associate Agreement (BAA) alone is sufficient to satisfy HIPAA encryption requirements, when in fact the covered entity must maintain exclusive control over encryption keys to prevent unauthorized access by the cloud provider.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable client-side encryption using a custom key management system (KMS) on the customer's premises.
Client-side encryption with a customer-controlled KMS ensures the covered entity retains exclusive control over the encryption keys, meeting HIPAA's requirement that the covered entity must be able to prevent the cloud provider from accessing ePHI. By encrypting data before it leaves the customer premises, the cloud provider never has access to the plaintext keys, and the customer maintains full lifecycle management, including key rotation and revocation. This approach is cost-efficient as it avoids complex third-party integrations and leverages existing on-premises infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable client-side encryption using a custom key management system (KMS) on the customer's premises.
Why this is correct
Correct. Client-side encryption with customer-controlled keys ensures compliance and maintains security.
- ✗
Disable encryption and rely on access controls and auditing only.
Why it's wrong here
Disabling encryption would violate HIPAA's requirements for protecting ePHI.
- ✗
Use the provider's default encryption and rely on their BAA that states they will protect the keys.
Why it's wrong here
BAA does not provide exclusive customer control over keys, which may not meet HIPAA requirements.
- ✗
Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer.
Why it's wrong here
Storing keys in the cloud still exposes them to the provider's infrastructure, potentially violating the control requirement.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.