ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Server-side encryption with customer-provided keys (often called SSE-C or a hold-your-own-key model) lets clients send a fresh symmetric key with each storage request. The cloud service uses that key to encrypt or decrypt the object in-flight and retains only a non-reversible hash for verification, discarding the key itself after the operation. Because the key is never written to or managed by the provider, the compliance requirement that no key material be stored in the cloud environment is met. At the same time, encryption and decryption still occur on the server side, so application workflows need no change. By contrast, provider-managed default keys and customer master keys generated in a provider-hosted HSM are stored in the cloud and violate the requirement, while client-side encryption off-loads all cryptographic processing to the application and does not use server-side encryption.