Which of the following BEST avoids data reminisce disclosure for cloud hosted resources?

Deleting only the encryption keys leaves the encrypted data still present on the underlying storage media, meaning a sufficiently motivated adversary with access to the raw storage could potentially recover ciphertext and wait for cryptanalytic advances, and the virtual disk or storage volume itself is not deprovisioned.

In cloud environments, data resides on virtual hosts whose underlying physical storage may retain residual data after logical deletion. Combining strong encryption with deletion of the entire virtual host (including its associated virtual disks and storage volumes) ensures that any remnant data is both unreadable and physically deprovisioned, eliminating remanence risk. This approach addresses the cloud-specific challenge where you do not control the physical media, making virtual host destruction the most complete remediation.

Software-based encryption with two-factor authentication addresses access control and data-in-use protection but does not specifically address data remanence, as residual data can still persist on storage media after deletion regardless of the authentication mechanism used.

Hardware-based encryption on dedicated physical servers applies to on-premises or bare-metal deployments and is not applicable to cloud-hosted (virtualized, multi-tenant) resources; it also does not address the remanence problem inherent to shared or virtualized cloud storage environments.