SY0-701 Question 224
Single answerData sovereigntyA multinational company based in Germany is moving its customer records to a cloud-based SaaS platform. During the risk assessment, the security team learns that the provider replicates all customer data to backup systems in multiple countries, including locations outside the EU. The company's legal team states that customer records for German and other EU residents must remain subject to EU jurisdictional requirements. Which action would BEST address the company's data sovereignty concern before approving the migration?
- A
Require the provider to enable encryption for data at rest and in transit so foreign administrators cannot read the records
- B
Select a service offering that guarantees data residency and backup/replication only within approved EU regions under contractual terms
- C
Implement multifactor authentication for all SaaS administrators and rely on audit logs to detect unauthorized access
- D
Use tokenization for customer IDs in the SaaS platform while allowing the provider to store backups globally
Show answer and explanation
Correct answer: B
Explanation
Data sovereignty refers to data being subject to the laws and governance structures of the country or region where it is collected, stored, or processed. In this scenario, the issue is not simply confidentiality or access control; it is whether EU customer data remains within approved jurisdictions and under applicable EU legal requirements. The best response is to choose a cloud service with explicit data residency controls and contractual commitments that restrict storage and replication to approved EU regions. This aligns with common cloud security and compliance best practices: verify where data is stored, how backups and disaster recovery copies are handled, and what contractual assurances exist in the provider agreement or data processing addendum. Relevant guidance includes the shared responsibility model used by major cloud providers, the need to review regional data location commitments in provider documentation, and EU data protection principles under the GDPR, particularly around transfers of personal data outside the EU/EEA. Encryption, MFA, logging, and tokenization are valuable controls, but they do not by themselves ensure compliance with data sovereignty requirements if the provider still replicates data into foreign jurisdictions.
- A. Incorrect.
This improves confidentiality, but it does not solve the core data sovereignty issue. Data sovereignty is concerned with which country's laws and jurisdiction apply to the data, often based on where it is stored or processed. Encrypting data reduces exposure risk, but the data may still be replicated into regions subject to non-EU legal frameworks.
- B. Correct.
This is correct because data sovereignty concerns are best addressed by ensuring the provider contractually and technically restricts storage, processing, and replication to approved jurisdictions. Choosing an offering with EU-only data residency and EU-limited backup/replication helps keep the data under the required legal and regulatory framework, which is the primary issue in the scenario.
- C. Incorrect.
Strong authentication and logging are important security controls, but they do not determine the legal jurisdiction governing stored or replicated data. This option addresses access control and accountability, not sovereignty. A candidate might choose this because it sounds security-focused, but it does not meet the legal team's requirement.
- D. Incorrect.
Tokenization can reduce the sensitivity of some stored data elements, but it does not by itself resolve where the underlying data or related records are stored, processed, or backed up. If backups are still distributed globally, the sovereignty issue remains. This is a plausible distractor because data minimization is useful, but it is not the best control for jurisdictional restrictions.