712-50 Question 332
Single answerEncryption Technologies (5 questions)A global financial services company is migrating a customer analytics platform to a public cloud provider. The platform stores regulated personal and transaction data and must support internal investigations, legal hold, and selective data sharing with a third-party fraud analysis partner. The CIO asks the CISO to recommend an encryption approach that reduces the impact of a cloud provider compromise while still allowing the organization to decrypt data when needed for investigations and approved sharing. Which option is the MOST appropriate?
- A
Use server-side encryption with provider-managed keys for all storage buckets because it minimizes administrative effort and keeps data encrypted at rest.
- B
Use client-side encryption before data is sent to the cloud, with encryption keys generated and controlled by the organization in a dedicated key management process.
- C
Rely on TLS for all application and API traffic to the cloud provider, since encryption in transit addresses the primary exposure during migration and operations.
- D
Tokenize all regulated fields and discard the original values after upload, eliminating the need for encryption key management and simplifying investigations.
Show answer and explanation
Correct answer: B
Explanation
The most appropriate recommendation is client-side encryption with organization-controlled keys because the primary requirement is to reduce the impact of a cloud provider compromise while preserving the organization's ability to decrypt data for investigations, legal processes, and selective sharing. In executive security terms, this is a data control and key custody decision, not merely a storage encryption checkbox. Best practices from NIST and cloud security guidance consistently emphasize that key management architecture determines the practical strength of encryption governance. NIST SP 800-57 highlights the importance of key management over cryptographic effectiveness, and NIST SP 800-111 and related guidance reinforce that encryption is most protective when key access is appropriately separated from data hosting. Cloud Security Alliance guidance also distinguishes between provider-managed encryption and customer-controlled encryption, especially for high-sensitivity or regulated workloads. TLS remains essential for data in transit, and server-side encryption is useful as a baseline control, but neither provides the same reduction in provider-side trust as encrypting data before it enters the provider's domain.
- A. Incorrect.
This is not the most appropriate choice for the stated objective. Server-side encryption with provider-managed keys does encrypt data at rest, but the cloud provider retains substantial control over key management and decryption operations. If the concern is reducing the impact of a cloud provider compromise or insider abuse at the provider, provider-managed keys offer less separation of duties and less customer control than customer-controlled encryption performed before upload. This option is plausible because it is common and operationally simple, but it does not best satisfy the requirement for strong organizational control over decryption for investigations and selective sharing.
- B. Correct.
This is the best answer. Client-side encryption means the organization encrypts data before it reaches the cloud provider, and customer-controlled key management preserves control over who can decrypt the data. This approach better limits exposure if the provider environment is compromised because encrypted objects stored by the provider are not readily decryptable without the organization's keys. It also supports lawful internal investigations and approved third-party sharing because the organization can selectively decrypt or re-encrypt data under its own governance. While this model adds operational complexity, it most directly aligns with the business and risk requirements in the scenario.
- C. Incorrect.
This is incorrect because TLS protects data in transit, not data at rest in cloud storage or during provider-side processing after receipt. TLS is necessary, but by itself it does not reduce the impact of a cloud provider compromise involving stored data. Candidates may choose this because migration projects often emphasize transport security, but the scenario explicitly requires protection of stored regulated data and preservation of organizational control over decryption decisions.
- D. Incorrect.
This is incorrect because tokenization is not a complete substitute for encryption in this scenario, and discarding original values would conflict with legal hold, investigations, and approved data sharing requirements. Tokenization can reduce exposure for specific data elements in certain architectures, but it depends on a secure token vault or mapping process and may not preserve the original data in a form needed for analytics or evidentiary use. The statement that it eliminates the need for key management is also misleading; tokenization introduces its own sensitive control points and governance requirements.