ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Cryptographic erasure (also called crypto-shredding) renders data unreadable by permanently destroying the only copy of the encryption key that protects the stored information. Because the ciphertext on the drives cannot be decrypted without the key, the data is considered sanitized even if the physical media are later reused. Guest-level file deletion or a single-pass overwrite from within the VM do not affect data remnants that reside outside the virtual machine's view, and disabling TRIM does nothing to remove existing data. Therefore, requiring the provider to perform cryptographic erasure best satisfies the regulatory mandate while imposing minimal operational impact.