Crucial Exams

ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Your company stores sensitive health records in a public cloud object storage bucket. Compliance rules require: 1) the firm must generate and retain exclusive control of encryption keys, 2) administrators must be able to revoke data access immediately without re-encrypting the objects, and 3) all key usage must be auditable through API logs. Which data-at-rest protection approach in the cloud best satisfies these requirements?

  • Enable the storage service's default server-side encryption that uses provider-managed keys.

  • Perform client-side AES-256 encryption of every object and store the keys on each end-user workstation.

  • Use the cloud provider's key management service with a customer-managed master key imported via BYOK and let the storage service perform server-side envelope encryption.

  • Hash each health record with SHA-256 before uploading it to the bucket.

ISC2 Certified Cloud Security Professional (CCSP)
Cloud Data Security
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot