nerdexam
EC-Council

312-50V12 · Question #223

As a cybersecurity consultant, you are working with a client who wants to migrate their data to a Software as a Service (SaaS) cloud environment. They are particularly concerned about maintaining…

The correct answer is C. Encrypt the data client-side before uploading to the SaaS environment and manage encryption. When migrating sensitive data to a SaaS environment, client-side encryption with self-managed keys ensures the cloud provider cannot access plaintext data. This is the only approach that addresses the specific concern of privacy even from the provider itself.

Submitted by fatima_kr· Mar 4, 2026Cloud Computing

Question

As a cybersecurity consultant, you are working with a client who wants to migrate their data to a Software as a Service (SaaS) cloud environment. They are particularly concerned about maintaining the privacy of their sensitive data, even from the cloud service provider. Which of the following strategies would best ensure the privacy of their data in the SaaS environment?

Options

  • AImplement a Virtual Private Network (VPN) for accessing the SaaS applications.
  • BRely on the cloud service provider's built-in security features.
  • CEncrypt the data client-side before uploading to the SaaS environment and manage encryption
  • DUse multi-factor authentication for all user accounts accessing the SaaS applications

How the community answered

(42 responses)
  • A
    10% (4)
  • B
    5% (2)
  • C
    83% (35)
  • D
    2% (1)

Why each option

When migrating sensitive data to a SaaS environment, client-side encryption with self-managed keys ensures the cloud provider cannot access plaintext data. This is the only approach that addresses the specific concern of privacy even from the provider itself.

AImplement a Virtual Private Network (VPN) for accessing the SaaS applications.

A VPN encrypts data in transit between the user and the SaaS application but does not protect data once it is stored on the provider's servers, meaning the provider can still access plaintext data at rest.

BRely on the cloud service provider's built-in security features.

Relying solely on the provider's built-in security features means the provider controls the encryption keys, giving them potential access to the client's data and defeating the goal of privacy from the provider.

CEncrypt the data client-side before uploading to the SaaS environment and manage encryptionCorrect

Client-side encryption means data is encrypted before it ever leaves the client's environment, so the SaaS provider only ever receives ciphertext. By retaining control of the encryption keys (key management), the client ensures that even if the provider is compromised, subpoenaed, or acts maliciously, the data remains unreadable. This is sometimes called 'bring your own key' (BYOK) or 'hold your own key' (HYOK) depending on architecture.

DUse multi-factor authentication for all user accounts accessing the SaaS applications

Multi-factor authentication strengthens access control and identity verification but does not encrypt or protect the underlying stored data from being accessed by the cloud service provider's administrators or systems.

Concept tested: Client-side encryption and key management in SaaS

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview

Topics

#SaaS security#Data privacy#Client-side encryption#Cloud security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice