mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A healthcare organization uses a custom…
A healthcare organization uses a custom application to manage patient records. The application uses a database with encrypted columns for sensitive data. The security team discovers that an insider has been copying encrypted data to an external drive. While the data is encrypted, the encryption key is stored in a configuration file accessible to the application. Which additional control would best mitigate this risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the encryption key in a hardware security module (HSM) with access policies.
Storing the encryption key in an HSM with access policies ensures the key is never in cleartext accessible to the application or user; it also enforces access controls and auditing. Role-based access on the config file is insufficient because the application still needs to read the key. TDE protects data at rest but does not protect the key. Auditing is detective, not preventive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable audit logging on the application.
Why it's wrong here
Enabling audit logging provides a forensic trail of activities, recording who accessed what and when. While crucial for detecting potential unauthorized key copying or access attempts *after* they occur, audit logs are a detective control. They do not actively prevent the key from being accessed, copied, or used by an unauthorized entity in the first place, which is the primary goal of securing the encryption key.
- ✗
Implement role-based access control on the configuration file.
Why it's wrong here
Implementing role-based access control (RBAC) on the configuration file restricts which users or processes can read or modify it. However, the application itself requires read access to retrieve the encryption key for its operations. If the application server or the application process itself is compromised, an attacker can exploit this legitimate read access to extract the key from the configuration file, rendering the RBAC ineffective against a compromised host.
- ✗
Use transparent data encryption (TDE) at the database level.
Why it's wrong here
Transparent Data Encryption (TDE) encrypts database files at rest, protecting data if the underlying storage media is stolen. While it secures the data, TDE typically relies on a master encryption key (MEK) that is often stored within the database server's operating system or a local key store. This means the MEK itself remains vulnerable to compromise if the database server's host system or its memory is breached, as TDE doesn't inherently solve the problem of securely managing the MEK outside the general-purpose server environment.
- ✓
Store the encryption key in a hardware security module (HSM) with access policies.
Why this is correct
Storing the encryption key in a Hardware Security Module (HSM) with access policies provides robust protection. An HSM is a tamper-resistant physical device specifically designed to securely generate, store, and manage cryptographic keys, ensuring keys never leave the module in plaintext. Access policies within the HSM enforce strict authentication and authorization, allowing only approved applications or services to perform cryptographic operations *inside* the HSM, thereby preventing direct key exposure and unauthorized copying or extraction.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.