easyMultiple ChoiceObjective-mapped
CISSP Key separation Practice Question
A financial services company is migrating its customer relationship management (CRM) system to a public cloud provider. The CRM contains personally identifiable information (PII) and financial transaction records. The security architect must design a solution that ensures data confidentiality and integrity both at rest and in transit, while complying with PCI DSS requirements. The cloud provider offers a key management service (KMS) that can generate and store encryption keys, a hardware security module (HSM) in the cloud, and a certificate authority for TLS certificates. The architect needs to select the appropriate encryption methods and access controls. The company's security policy requires encryption keys to be rotated every 90 days and stored separately from the data. The cloud provider's KMS supports automatic key rotation, but the HSM requires manual intervention. The CRM application uses a database that supports transparent data encryption (TDE) with keys stored in the KMS, and the application also requires TLS for all network connections. Which course of action best meets all requirements?
⚠ Common exam trap
Candidates may think automatic key rotation is not required because manual rotation can meet the 90-day policy, but automatic rotation reduces operational overhead and errors. Also, storing keys in a different region is often overlooked but critical for separation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the cloud provider's KMS to generate and store the database encryption key with automatic rotation, and use a certificate from a third-party CA for TLS. Store the KMS key in a separate account and region from the database.
It uses the KMS with automatic key rotation (meeting the 90-day rotation requirement without manual intervention), stores the key in a separate account and region from the database (satisfying the separation requirement), and uses a certificate from a third-party CA for TLS (providing strong trust and compliance with PCI DSS). Option A uses self-signed certificates (not trusted for external connections) and manual rotation (error-prone). Option C uses manual rotation and does not leverage automatic rotation. Option D stores all keys in the same region as the database, violating the separation requirement, and uses a KMS-managed key for TLS which may not be necessary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the cloud provider's KMS to generate and store the database encryption key, disable automatic rotation, and manually rotate it every 90 days. Use a self-signed certificate for TLS to save costs.
Why it's wrong here
This option is fundamentally flawed due to two major security weaknesses. First, disabling automatic key rotation for the database encryption key and relying on manual rotation every 90 days introduces significant operational burden and a high probability of non-compliance or human error. More critically, using a self-signed certificate for TLS for external connections is unacceptable for a financial services company, as it lacks the chain of trust provided by a public Certificate Authority. This approach would immediately fail compliance requirements, such as PCI DSS, by not establishing verifiable trust with external clients.
- ✓
Use the cloud provider's KMS to generate and store the database encryption key with automatic rotation, and use a certificate from a third-party CA for TLS. Store the KMS key in a separate account and region from the database.
Why this is correct
This option correctly leverages the cloud provider's Key Management Service (KMS) for robust encryption key management, including automatic rotation which satisfies the 90-day policy requirement without manual intervention. Storing the KMS key in a separate account and region from the database enhances security through strong separation of duties and blast radius containment. Furthermore, using a certificate from a trusted third-party Certificate Authority (CA) for TLS ensures strong authentication and encryption for external connections, meeting compliance standards like PCI DSS.
- ✗
Use the cloud HSM to generate and store the database encryption key, manually rotate it every 90 days, and use a certificate from the cloud provider's CA for TLS. Store the HSM key in a different region from the database.
Why it's wrong here
While using a cloud Hardware Security Module (HSM) for key generation and storage offers high assurance, the requirement for manual key rotation every 90 days introduces significant operational overhead and a high risk of human error or oversight. This approach is inefficient and prone to compliance failures compared to automated solutions. Although using a certificate from the cloud provider's CA for TLS might be acceptable in some contexts, the manual key rotation for the database encryption key is a critical weakness that does not align with best practices for secure and scalable key management.
- ✗
Use the cloud provider's KMS to generate and store the database encryption key, enable automatic key rotation, and use a separate KMS-managed key for TLS certificates. Store all keys in the same KMS region as the database.
Why it's wrong here
This option critically fails by storing all encryption keys in the same KMS region as the database, which violates the principle of separation of concerns and increases the blast radius in case of a regional compromise. Best practices dictate storing encryption keys in a separate security domain, such as a different account or region, from the protected data. Additionally, using a separate KMS-managed key specifically for TLS certificates is an unconventional and generally unnecessary approach, as TLS certificates are typically issued by Certificate Authorities and managed as distinct cryptographic artifacts, not directly as KMS keys.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Certificate authority
A trusted entity that issues digital certificates to verify the identity of websites, devices, and users in secure online communications.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.