712-50 Question 333
Single answerEncryption Technologies (5 questions)A global financial services firm is migrating a customer analytics platform to a public cloud provider. The platform processes payment card data and stores several years of transaction history for fraud analysis. The CISO has been asked to approve an encryption strategy that reduces the risk of cloud administrator access to sensitive data, supports strict separation of duties, and still allows the security team to rotate keys and revoke access quickly if a compromise is suspected. Which approach is the MOST appropriate?
- A
Use the cloud provider's default server-side encryption with provider-managed keys for all storage services, because encryption at rest is sufficient for regulatory compliance and operational simplicity
- B
Encrypt sensitive data at the application layer before it is written to cloud storage, store and manage the encryption keys in a customer-controlled HSM or external key management system, and enforce granular key access policies
- C
Rely primarily on TLS for all data flows between application components and end users, because data in transit protection prevents unauthorized disclosure in the cloud environment
- D
Use full-disk encryption on the cloud virtual machines and allow system administrators to manage the encryption keys locally on each server for faster incident response
Show answer and explanation
Correct answer: B
Explanation
The best answer is application-layer encryption with customer-controlled key management. From a CCISO perspective, this question is about aligning encryption architecture with business risk, governance, and operational control rather than simply enabling encryption features. When the organization wants to reduce dependency on a cloud provider's privileged access model, customer-managed cryptographic keys and strong separation of duties are critical. Application-layer encryption ensures that sensitive data is encrypted before being stored in the cloud, and customer-controlled HSMs or external key management systems support centralized lifecycle management, including rotation, revocation, access logging, and policy enforcement.
This approach is consistent with widely accepted guidance. NIST recommends strong key management practices and separation of duties in cryptographic systems, including protection of keys throughout their lifecycle (see NIST SP 800-57, Key Management). For data protection architectures, NIST also distinguishes between data at rest, in transit, and in use, reinforcing that no single control like TLS is sufficient across all states. PCI DSS similarly emphasizes protection of stored account data and robust management of cryptographic keys, including restricted access and documented key management processes.
In executive decision-making, the CISO should balance security strength with operational feasibility, but for highly regulated payment environments, encryption design must support independent control, auditability, and rapid response during key compromise scenarios. That makes customer-controlled application-layer encryption the most appropriate choice.
- A. Incorrect.
This is incorrect because provider-managed server-side encryption protects data at rest from certain physical and infrastructure-level threats, but it does not best address the stated concern of reducing exposure to cloud administrator access or maximizing customer control over cryptographic keys. In highly sensitive environments, especially those handling payment card data, relying solely on provider-managed keys may not provide the desired separation of duties or rapid independent revocation capability. It is operationally simple, which makes it attractive, but it is not the most appropriate choice for the scenario's risk and governance requirements.
- B. Correct.
This is correct because application-layer encryption with customer-controlled key management provides the strongest alignment to the stated objectives: minimizing trust in the cloud provider, enforcing separation of duties, and enabling the organization to rotate or revoke keys independently. Using a customer-controlled HSM or external key management system allows the enterprise to maintain custody and policy control over keys, while application-layer encryption helps ensure sensitive data is protected before it reaches cloud storage. This is a common strategy when organizations need stronger assurance against insider risk at the provider level and tighter governance over key lifecycle management.
- C. Incorrect.
This is incorrect because TLS protects data in transit, not data at rest in storage or backups. While TLS is necessary and should be used, it does not address the main issue in this scenario: protecting stored payment card data from unauthorized access, including concerns about cloud-side administrative exposure. Choosing TLS as the primary control reflects a common misconception that transport encryption alone provides end-to-end data protection for stored datasets.
- D. Incorrect.
This is incorrect because full-disk encryption on virtual machines can help protect against certain threats, such as loss of physical media in traditional environments, but in cloud environments it does not provide the same level of protection against privileged access within the guest OS or by those who can access the running workload. Storing keys locally on each server weakens separation of duties and makes centralized rotation and revocation harder, not easier. This option may seem practical from an infrastructure perspective, but it is poorly aligned with enterprise key governance and cloud risk management objectives.