Quick Answer
The answer is encryption in transit and at rest, as it is the most important cloud storage security control for preventing unauthorized access to data. This control renders data unreadable through protocols like TLS 1.3 for data moving across networks and algorithms like AES-256 for stored data, ensuring confidentiality even if the cloud provider’s infrastructure is breached. On the CISSP exam, this concept tests your understanding of defense in depth, where encryption acts as a preventive layer that other reactive controls—such as logging or access reviews—cannot replace. A common trap is choosing access control lists or identity management, but encryption is the only control that protects data directly when physical or logical perimeters fail. Remember the mnemonic “E.T. Phone Home” for Encryption in Transit and “E.T. Stay Home” for Encryption at Rest.
This CISSP practice question tests your understanding of asset security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses a cloud storage service. Which asset security control is most important to prevent unauthorized access to data?
Logging and monitoring
Why wrong: Monitoring detects incidents but does not prevent them.
Encryption in transit and at rest
Encryption renders data unreadable without keys, preventing unauthorized access.
Periodic access reviews
Why wrong: Reviews ensure proper permissions but do not prevent initial unauthorized access.
Regular vulnerability scanning
Why wrong: Scanning identifies weaknesses but does not prevent access directly.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Encryption in transit and at rest
Encryption in transit (e.g., TLS 1.3) and at rest (e.g., AES-256) is the most important asset security control because it renders data unreadable even if the cloud storage service is compromised or an attacker gains access to the underlying infrastructure. Without encryption, all other controls (logging, reviews, scanning) are reactive and cannot prevent a direct breach of the stored data. This aligns with the CISSP principle of defense in depth, where encryption provides a strong preventive layer for data confidentiality.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Logging and monitoring
Why it's wrong here
Monitoring detects incidents but does not prevent them.
Encryption in transit and at rest
Why this is correct
Encryption renders data unreadable without keys, preventing unauthorized access.
Related concept
Read the scenario before looking for a memorised answer.
Periodic access reviews
Why it's wrong here
Reviews ensure proper permissions but do not prevent initial unauthorized access.
Regular vulnerability scanning
Why it's wrong here
Scanning identifies weaknesses but does not prevent access directly.
Common exam traps
ISC2 often tests the misconception that logging or access reviews are sufficient to prevent unauthorized access, but the trap here is that only encryption provides a strong preventive control that protects data confidentiality regardless of other failures.
Detailed technical explanation
Encryption at rest in cloud storage typically uses envelope encryption, where a data encryption key (DEK) encrypts the data and a key encryption key (KEK) protects the DEK, often managed by a hardware security module (HSM) or a cloud KMS like AWS KMS. For transit, TLS 1.3 with perfect forward secrecy (PFS) ensures that even if the server's private key is compromised, past sessions remain secure. A real-world scenario is the 2019 Capital One breach, where a misconfigured web application firewall (WAF) allowed data exfiltration; encryption at rest would have rendered the stolen data useless.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Asset Security — study guide chapter
Learn the concepts, then practise the questions
Asset Security practice questions
Targeted practice on this topic area only
All CISSP questions
529 questions across all exam domains
Certified Information Systems Security Professional CISSP study guide
Full concept coverage aligned to exam objectives
CISSP practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise CISSP questions linked to Software Development Security.
Practise CISSP questions linked to Security Assessment and Testing.
Practise CISSP questions linked to Identity and Access Management.
Practise CISSP questions linked to Security and Risk Management.
Practise CISSP questions linked to Security Architecture and Engineering.
Practise CISSP questions linked to Communication and Network Security.
Practise CISSP questions linked to Asset Security.
Practise CISSP questions linked to Security Operations.
Practise CISSP questions linked to CISSP fundamentals.
Practise CISSP questions linked to CISSP scenario.
Practise CISSP questions linked to CISSP troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Asset Security — This question tests Asset Security — Read the scenario before looking for a memorised answer..
The correct answer is: Encryption in transit and at rest — Encryption in transit (e.g., TLS 1.3) and at rest (e.g., AES-256) is the most important asset security control because it renders data unreadable even if the cloud storage service is compromised or an attacker gains access to the underlying infrastructure. Without encryption, all other controls (logging, reviews, scanning) are reactive and cannot prevent a direct breach of the stored data. This aligns with the CISSP principle of defense in depth, where encryption provides a strong preventive layer for data confidentiality.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.