Which of the following is the BEST way to protect sensitive data from administrators within a public cloud?

Using an encrypted tunnel protects data in transit to the cloud but does not protect the data once it is stored in the cloud from administrators with potential access to the cloud environment.

Encrypting data in the cloud database (server-side encryption) protects it at rest, but the cloud provider or its administrators typically manage or have access to the encryption keys, potentially allowing them access to the data.

Encrypting physical hard drives within the cloud protects against physical theft of drives, but does not prevent cloud administrators with appropriate system access from reading data on those drives once the system is running.

Encrypting data before it leaves the organization (client-side encryption) ensures that the organization maintains control of the encryption keys. This prevents cloud administrators, who might have access to the encrypted data in the cloud, from decrypting and accessing the sensitive information.