SY0-701 Question 225
Single answerData sovereigntyA U.S.-based software company is migrating its customer records platform to a public cloud provider. The company serves customers in Germany, Canada, and Japan, and several contracts require that customer personal data remain subject to the laws of the country where the data was collected. During planning, the security team discovers the provider's default backup service replicates snapshots to a different region for resilience. Which action would BEST help the company meet its data sovereignty requirements while still using the cloud platform?
- A
Configure storage, databases, and backups to use in-country or approved regional locations only, and disable or replace cross-border replication features that move regulated data outside those jurisdictions
- B
Encrypt all customer data with AES-256 before storing it in the cloud, because encryption removes data sovereignty concerns even if the provider replicates it internationally
- C
Rely on the provider's standard terms of service, because cloud vendors automatically align all backup locations with each customer's local privacy laws
- D
Classify the data as internal use only, because data classification determines the legal jurisdiction where the provider may store and process the data
Show answer and explanation
Correct answer: A
Explanation
The best answer is to explicitly architect the environment so regulated data remains in approved jurisdictions, including backups and disaster recovery copies. Data sovereignty is not just about primary storage; it also includes processing, replication, and administrative access in ways that may subject data to another country's laws. This aligns with common cloud security best practices under the shared responsibility model: the provider offers region and replication controls, but the customer must configure them correctly for legal and contractual compliance. Relevant guidance can be found in cloud provider documentation on data residency/region selection and backup replication settings, as well as in regulatory and industry guidance emphasizing that encryption and classification do not by themselves satisfy jurisdictional storage requirements.
- A. Correct.
Correct. Data sovereignty focuses on ensuring data is stored and processed in compliance with the laws of the relevant jurisdiction. In this scenario, the company must control where regulated customer data and its backups reside. Selecting specific geographic regions or sovereign/local zones and preventing cross-border replication is the most direct way to meet contractual and legal residency requirements while continuing to use cloud services.
- B. Incorrect.
Incorrect. Encryption is an important security control for confidentiality, but it does not eliminate data sovereignty or data residency obligations. Even encrypted data may still be subject to the laws of the country where it is stored, processed, or accessed. A common misconception is that strong encryption alone resolves jurisdictional issues; it does not.
- C. Incorrect.
Incorrect. Standard cloud terms of service do not guarantee compliance with every customer's country-specific sovereignty requirements. Customers typically share responsibility for configuring regions, backup locations, replication behavior, and retention settings appropriately. Assuming the provider handles all sovereignty obligations is a common operational mistake.
- D. Incorrect.
Incorrect. Data classification helps determine how data should be protected, handled, and monitored, but it does not override legal or contractual requirements about where data may be stored. Labeling data as internal does not change which national laws apply to it.