You are a cybersecurity specialist at CloudTech Inc., a company providing cloud-based services. You are managing a project for a client who wants to migrate their sensitive data to a public cloud…

Question

Options

• AUse the cloud service provider's encryption services but store keys on-premises.
• BUse the cloud service provider's default encryption and key management services.
• CRely on Secure Sockets Layer (SSL) encryption for data at rest.
• DEncrypt data client-side before uploading to the cloud and retain control of the encryption keys.

• A
  8% (3)
• B
  3% (1)
• C
  14% (5)
• D
  76% (28)

Explanation

Client-Side Encryption with Key Retention

Encrypting data client-side before uploading ensures the data is already protected before it ever reaches the cloud provider, meaning the provider only stores ciphertext and has zero access to the plaintext or the keys - giving the client complete, unambiguous control over their encryption keys. Option A is partially correct in concept but flawed in practice, as using the cloud provider's encryption services means the provider's infrastructure still handles encryption/decryption logic, creating a potential trust gap and compliance risk. Option B is clearly wrong because default cloud key management (e.g., AWS KMS managed keys) means the provider ultimately controls and manages the keys, not the client. Option C is a critical error in understanding - SSL/TLS is a transport-layer protocol designed to protect data in transit, not data at rest, making it entirely irrelevant to this scenario.

Memory Tip: Think of it as a "sealed envelope" rule - if you want to guarantee no one else reads your mail, you seal it before handing it to the postal service. Client-side encryption = you seal it; the cloud = the postal service that never sees inside.

No community discussion yet for this question.