ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Encrypting data on the client side with keys that remain under the customer's exclusive control ensures that ciphertext, not plaintext, is delivered to the cloud service. Because the keys are generated and held in an on-premises Hardware Security Module (HSM) that integrates with a cloud key-management service through secure APIs, the cloud provider never gains access to either the plaintext data or the encryption keys, fulfilling the requirement to prevent provider personnel from reading the PII. Server-side or volume-level encryption with provider-managed keys still exposes the keys to the provider's control, and relying solely on TLS secures data in transit but leaves it unprotected at rest. Therefore, client-side encryption with customer-managed keys is the most appropriate choice with minimal additional operational burden beyond key management that the organization already performs on-premises.