How to Keep Full Control of Cloud Encryption Keys at Rest?
You are a cybersecurity specialist at CloudTech Inc., a company providing cloud-based services. You are managing a project for a client who wants to migrate their sensitive data to a public cloud service. To comply with regulatory requirements, the client insists on maintaining full control over the encryption keys even when the data is at rest on the cloud. Which of the following practices should you implement to meet this requirement?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests who actually holds and uses the encryption keys for cloud data at rest; the trap is treating on-premises key storage combined with the provider's encryption service (BYOK) as equivalent to full client-side control.
Client-side encryption of sensitive data before upload to a public cloud, with the client retaining the keys, is what gives full control over data at rest. This page confirms option A as the answer and explains why BYOK-style provider encryption and SSL do not satisfy the requirement.
Many learners pick B because “keys stored on-premises” sounds like complete customer control, but the cloud provider's encryption service still performs key operations, so custody and control are shared rather than fully client-held.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Client-side encryption before upload means the data is already ciphertext when it lands in the public cloud, and the client keeps all key material outside the provider's reach. That directly satisfies the requirement of full control over encryption keys even when the data is at rest. The CSP only stores encrypted objects and cannot decrypt them, which is the strongest way to meet regulatory demands for customer-held keys. As insaniunt noted, the client “encrypts the data on their premises before uploading it to the cloud,” which is exactly the control model the question describes.Why the Other Options Are Wrong
B sounds like customer control, but using the provider's encryption service with on-premises key storage is a BYOK-style model: the provider's service still performs cryptographic operations with the key material, and implementations may cache or proxy keys, so control is shared. C is wrong because SSL/TLS protects data in transit, not data at rest sitting in cloud storage. D is the opposite of the requirement, since default provider encryption and key management give the CSP custody and control of the keys. Only A removes the provider from the key path entirely.Community Comment Notes
The recorded votes are unanimous for A (100 votes), and insaniunt's explanation focuses on encrypting on premises and retaining the keys. DarioReymag asked “Friends could you please confirm this answer”, which shows learners were seeking validation of A rather than proposing a competing option. Another commenter asked “Are the questions from 125 valid for the v12 exam?”, a scope question unrelated to the encryption decision. No commenter argued for B, C or D.Official Reference
Exam Strategy
When a question says the client must have “full control” over keys for data at rest, look for the option where encryption happens before the data reaches the provider and the keys never leave the client. Distinguish transport controls such as SSL from at-rest controls, and treat provider-managed or BYOK models as shared control.
Frequently Asked Questions
Why is option B (keys on-premises with provider encryption) not full control?
That is a BYOK model: the provider's encryption service still uses your key material to encrypt and decrypt, so key custody is shared; client-side encryption keeps all key operations with the client.
Does SSL/TLS satisfy encryption for cloud data at rest?
No. SSL/TLS protects data in transit between the client and the cloud; data at rest must be encrypted with keys the client controls, as in client-side encryption.