easyMultiple Choice
CISSP Practice Question: Requires that all data stored in a cloud object…
An organization requires that all data stored in a cloud object storage service be encrypted at rest using customer-managed keys. Which encryption option should be implemented?
⚠ Common exam trap
Many candidates confuse 'customer-managed keys' with 'client-side encryption,' but the question specifies encryption at rest within the cloud service, which requires a server-side encryption option where the customer provides the key, not encryption performed before upload.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side encryption with customer-provided keys
Server-Side Encryption with Customer-Provided Keys allows the organization to encrypt objects at rest in cloud object storage using keys that are managed and supplied by the customer, not the cloud provider. This meets the requirement for customer-managed keys because the encryption key is provided in each API request and is never stored by the service, giving the customer full control over key lifecycle and access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Server-side encryption with cloud service provider-managed keys
Why it's wrong here
This option uses keys managed by the cloud provider, not the customer. Therefore, it does not meet the requirement for customer-managed keys.
- ✗
Transport Layer Security (TLS)
Why it's wrong here
Incorrect. TLS is for data in transit, not at rest.
- ✓
Server-side encryption with customer-provided keys
Why this is correct
This option allows the customer to provide and manage their own encryption keys for server-side encryption, fulfilling the requirement for customer-managed keys.
- ✗
Client-side encryption
Why it's wrong here
Incorrect. Client-side encryption encrypts data before sending to cloud.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Encryption key
An encryption key is a string of random characters used by an algorithm to lock (encrypt) and unlock (decrypt) data, ensuring only authorized parties can read it.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.