mediumMultiple ChoiceObjective-mapped
CISSP A company uses a cloud storage service Practice Question
A company uses a cloud storage service. Which asset security control is most important to prevent unauthorized access to data?
⚠ Common exam trap
ISC2 often tests the misconception that logging or access reviews are sufficient to prevent unauthorized access, but the trap here is that only encryption provides a strong preventive control that protects data confidentiality regardless of other failures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encryption in transit and at rest
Encryption in transit (e.g., TLS 1.3) and at rest (e.g., AES-256) is the most important asset security control because it renders data unreadable even if the cloud storage service is compromised or an attacker gains access to the underlying infrastructure. Without encryption, all other controls (logging, reviews, scanning) are reactive and cannot prevent a direct breach of the stored data. This aligns with the CISSP principle of defense in depth, where encryption provides a strong preventive layer for data confidentiality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Logging and monitoring
Why it's wrong here
While logging and monitoring are absolutely critical for incident detection, forensic analysis, and maintaining an audit trail, they function primarily as detective controls. These mechanisms provide visibility into security events and potential breaches *after* they have occurred or are attempted, rather than actively preventing unauthorized access to the stored data itself. They identify anomalous activity but do not inherently render the data inaccessible or unreadable to an unauthorized entity.
- ✓
Encryption in transit and at rest
Why this is correct
Encryption, applied both when data is actively moving across networks (in transit) and when it is stored on persistent media (at rest), is a foundational preventative control for data confidentiality. By transforming data into an unintelligible format using cryptographic algorithms, it ensures that even if unauthorized access or a data breach occurs, the information remains unreadable and unusable without the correct decryption keys. This directly prevents the compromise of data security by rendering it meaningless to an attacker.
- ✗
Periodic access reviews
Why it's wrong here
Periodic access reviews are an essential administrative control for maintaining the principle of least privilege and ensuring that user permissions remain appropriate over time. However, these reviews are a governance activity that validates existing access rights and identifies potential privilege creep or stale accounts. They do not actively prevent an external attacker or an insider with no existing legitimate access from initially breaching the system or accessing data they were never authorized to view.
- ✗
Regular vulnerability scanning
Why it's wrong here
Regular vulnerability scanning is a proactive measure designed to identify security weaknesses, misconfigurations, and known vulnerabilities within systems, applications, and network infrastructure. While crucial for improving the overall security posture by highlighting areas for remediation, scanning itself is a diagnostic tool. It does not directly prevent an attacker from exploiting an *existing* vulnerability or gaining unauthorized access; rather, it informs the organization where preventative patches or configurations need to be applied.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Security control
A security control is a safeguard or countermeasure designed to protect the confidentiality, integrity, and availability of information systems and data.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.