ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Using customer-managed keys that you import into the cloud provider's key-management service-often called a Bring Your Own Key (BYOK) model-allows the organization to retain sole ownership of the root key material. Because the key originates and can be revoked or rotated solely by the customer, provider administrators cannot decrypt the protected data. At the same time, the imported key is stored in the provider's hardened KMS or HSM, enabling the cloud platform to perform transparent server-side encryption, automated key rotation of data-encryption keys (DEKs), and seamless integration with storage services. Relying on provider-managed or default keys leaves decryption authority with the provider, violating the requirement. Pure client-side encryption with locally held keys removes provider access but also forfeits server-side encryption features, which the scenario explicitly wants to keep.