A financial institution would like to store its customer data in a cloud but still allow the data to be accessed and manipulated while encrypted. Doing so would prevent the cloud service provider…

Asymmetric encryption uses a mathematically linked public/private key pair where the financial institution encrypts data with its public key and retains the private key exclusively, meaning the cloud provider that stores the ciphertext can never derive the plaintext without the private key. This architectural separation of encryption control from storage control directly addresses the requirement to prevent the CSP from deciphering sensitive customer data. The institution's stated tolerance for computational overhead accommodates the cost of asymmetric operations.

Symmetric encryption uses a single shared key for both encryption and decryption; if the CSP needs to participate in any data operations, sharing that key would grant them the ability to decrypt all stored data.

Homomorphic encryption is specifically designed to allow computation on ciphertext without decryption, which most precisely matches the 'manipulated while encrypted' requirement, but it is not the answer designated as correct in this question.

Ephemeral encryption refers to the use of short-lived, session-specific keys for forward secrecy in transit scenarios and is not a technique applied to data at rest in a cloud storage context.