A security analyst received the following finding from a cloud security assessment tool: Virtual Machine Data Disk is encrypted with the default encryption key. Because the organization hosts highly s

Question

Options

• ADisk encryption with customer-provided keys
• BDisk encryption with keys from a third party
• CRow-level encryption with a key escrow
• DFile-level encryption with cloud vendor-provided keys
• EFile-level encryption with customer-provided keys
• FDisk-level encryption with a cross-signed certificate

• A
  60% (39)
• B
  3% (2)
• C
  11% (7)
• D
  22% (14)
• F
  5% (3)

Explanation

To meet the regulatory requirement of ensuring that the data is unreadable to the cloud service provider (CSP), the best approach is to use customer-provided keys for encryption. This ensures that only the customer (organization) holds the keys to access the encrypted data, not Disk encryption with customer-provided keys: This ensures the encryption key for the virtual machine’s data disk is managed by the customer, preventing the CSP from having access to the File-level encryption with customer-provided keys: If data needs to be encrypted at the file level, customer-provided keys can be used to ensure that the organization retains control over the encryption and decryption process.

No community discussion yet for this question.