You are a cybersecurity specialist at CloudTech Inc., a company providing cloud-based services. You are managing a project for a client who wants to migrate their sensitive data to a public cloud…

Encrypting data client-side before uploading ensures that the encryption and decryption processes occur entirely within the client's control, meaning the cloud service provider never has access to the unencrypted data or the encryption keys. This practice directly meets the requirement of the client maintaining full and exclusive control over their encryption keys, making the data unreadable by the cloud provider.

Using the cloud service provider's encryption services, even with keys stored on-premises, means the cloud provider's service still needs operational access to the keys to perform encryption and decryption, thus giving them a degree of control or access that violates the 'full control' requirement.

Secure Sockets Layer (SSL)/Transport Layer Security (TLS) encryption is used for data in transit to secure communication channels, not for data at rest storage encryption.

Relying on the cloud service provider's default encryption and key management services gives the cloud provider control over the encryption keys, directly contradicting the client's requirement for full personal control.