A developer is writing an application that will retrieve sensitive data from a third-party system. The application will format the data into a PDF file. The PDF file could be more than 1 MB. The…

The `GenerateDataKey` API returns both a plaintext key and an encrypted key (ciphertext blob). The correct pattern is to use the plaintext key immediately in memory to encrypt the PDF, then discard the plaintext key, and write only the encrypted key to disk with the ciphertext. To decrypt later, the encrypted key is passed to `Decrypt`, which returns the plaintext key to decrypt the file.

Writing the plaintext key to disk is a critical security violation; if the disk is compromised, the key is exposed and the encryption provides no protection. The plaintext key must only exist in memory and be discarded after use.

This option describes the same correct action as A but with an incorrect step (writing the encrypted key and using the plaintext key) -- however, the distinction between A and C likely involves whether the plaintext key is discarded after use; C may imply keeping the plaintext key, making it insecure.

This option involves writing the plaintext key to disk, which is insecure for the same reason as option B; persisting the plaintext data key defeats the purpose of envelope encryption.