mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A security architect is designing controls for a…
A security architect is designing controls for a cloud-based file storage service that stores personally identifiable information (PII). Which control best ensures that data remains encrypted at rest without involving the cloud provider's key management?
⚠ Common exam trap
Candidates often confuse server-side encryption with customer-managed keys (Option D) as being fully independent of the provider, but in reality, the provider's key management service still handles the encryption/decryption operations, which does not satisfy the 'without involving the cloud provider's key management' requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Client-side encryption
Client-side encryption ensures data is encrypted before it leaves the client device, so the cloud provider never has access to the plaintext or the encryption keys. This guarantees that the data remains encrypted at rest in the cloud storage without relying on the provider's key management infrastructure, meeting the requirement of keeping the provider out of the key management loop.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Tokenization of PII fields
Why it's wrong here
Tokenization replaces sensitive data with a non-sensitive surrogate value, or token, which has no extrinsic meaning or value. While effective for reducing the scope of compliance requirements and minimizing the risk of data exposure in certain contexts, it is fundamentally a data masking technique, not an encryption method. The original sensitive data is still stored in a secure token vault, which could potentially be managed by the cloud provider, meaning the provider might still have access to the original plaintext if not properly segregated.
- ✗
Transport Layer Security (TLS) for data in transit
Why it's wrong here
Transport Layer Security (TLS) is a cryptographic protocol designed to secure communication over a computer network, specifically encrypting data in transit between a client and a server. It establishes a secure channel, ensuring confidentiality and integrity of data as it travels across the network. However, once the data reaches the cloud provider's server, TLS decrypts it for processing or storage, offering no protection for the data at rest within the cloud environment itself.
- ✓
Client-side encryption
Why this is correct
Client-side encryption involves encrypting data on the user's device before it is transmitted to or stored in the cloud. The encryption keys are generated and retained exclusively by the client, ensuring that the cloud provider never receives or has access to the plaintext data or the keys required to decrypt it. This approach provides the strongest assurance of data confidentiality against the cloud provider, as they only ever store encrypted ciphertext.
- ✗
Server-side encryption with customer-managed keys
Why it's wrong here
Server-side encryption with customer-managed keys means the encryption and decryption processes occur within the cloud provider's infrastructure, albeit using cryptographic keys that the customer controls (e.g., via a cloud KMS). While the customer manages key lifecycle, the cloud provider's services still handle the actual encryption/decryption operations, meaning the keys must be accessible to the provider's systems, even if temporarily or within a hardware security module (HSM). This still presents a potential exposure point where the provider's privileged administrators or internal processes could theoretically access the plaintext data or keys.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.