ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Cryptographic erasure (crypto-shredding) renders cloud-resident data unreadable by irrevocably destroying the encryption keys while leaving the encrypted blocks in place. Because the customer controls the keys, key destruction can be performed immediately and independently of the provider's physical media handling processes, meeting the 24-hour deadline and providing auditable proof of destruction.

Overwriting media with DoD 5220.22-M patterns or issuing TRIM commands depends on the provider's willingness and ability to locate every replica, which may span multiple systems and may not complete within 24 hours. Requesting drive degaussing likewise relies on provider action, is infeasible with shared or solid-state drives, and cannot be executed selectively for specific tenants. Therefore, key destruction via cryptographic erasure is the most reliable choice in a cloud environment.