How Does Data Encryption Protect Against Unauthorized Vendor Access in IaaS?

It was discovered that a service provider's administrator was accessing sensitive information without the approval of the customer in an Infrastructure as a Service (IaaS) model. Which of the following would BEST protect against a future recurrence?

Intrusion prevention system (IPS)
Contractual requirements
Data encryption Source Reference Answer
Two-factor authentication

Community Votes

67%

33%

67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests understanding of the cloud shared responsibility model and control prioritization, with the common trap being choosing contractual requirements instead of the direct technical safeguard that actually prevents data compromise.

In an IaaS environment, data encryption ensures that sensitive information remains confidential even if a service provider administrator gains unauthorized access. CRISC candidates and community experts consistently agree that encryption is the most effective technical control to mitigate this specific data exposure risk.

Many candidates select contractual requirements, assuming legal agreements are sufficient to prevent vendor breaches. However, contracts lack technical enforcement and cannot stop an administrator from reading plaintext data once accessed, making them a weaker immediate control than encryption.

Community Discussion (3 comments)

d9iceguy 👍 1 Selected: C

In an Infrastructure as a Service (IaaS) model, the customer retains responsibility for securing their data, while the service provider manages the infrastructure. If a service provider's administrator accessed sensitive customer data without approval, the best protection against recurrence is to ensure the data is encrypted, particularly at rest and in transit. Encryption: Prevents unauthorized access, even by privileged insiders like administrators. Ensures that data remains confidential, even if storage or systems are accessed. Can be paired with customer-managed keys, so the provider cannot decrypt the data without permission.

Sara98 👍 1 Selected: B

B. Contractual requirements: Establishing clear contractual terms with the service provider is crucial. Contracts should specify access controls, audit rights, and compliance with data protection requirements. This ensures that administrators have only the access they need and that any unauthorized access is prohibited by the agreement.

Abbey2 👍 1 Selected: C

To best protect against a recurrence of a service provider's administrator accessing sensitive information without approval in an Infrastructure as a Service (IaaS) model, the most effective measure would be: C. Data encryption. Encrypting data is a direct way to protect sensitive information from unauthorized access. Even if a service provider's administrator gains access to the data, encryption ensures that the content remains unreadable and secure without the appropriate decryption keys. This measure protects the data at rest as well as in transit, providing a robust defense against unauthorized access, regardless of the internal controls or policies of the service provider.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Data encryption is the optimal control because it directly addresses the confidentiality requirement of the CIA triad, regardless of who accesses the underlying infrastructure. Under the IaaS shared responsibility model, the customer retains ownership and security of their data, meaning they must implement cryptographic controls to protect it from CSP administrators. Even if a provider staff bypasses logical access controls, encrypted data at rest or in transit remains unreadable without the proper keys, effectively neutralizing the insider threat.

Why the Other Options Are Wrong

Intrusion prevention systems monitor network traffic but cannot stop an administrator using legitimate infrastructure credentials to access storage volumes. Two-factor authentication strengthens identity verification but does not prevent an already authenticated privileged user from misusing their access to view sensitive files. Contractual requirements establish governance and legal recourse but provide no technical mechanism to block or obfuscate data during an unauthorized access event, making them reactive rather than protective.

Community Comment Notes

Multiple high-voted comments emphasize that in IaaS, customers are solely responsible for securing their own data payloads [1]. Experts note that encryption serves as the ultimate fail-safe when trust boundaries between organizations break down [3]. While some users initially lean toward contractual clauses for vendor oversight, the consensus confirms that technical data protection takes precedence in risk mitigation hierarchies for exposed sensitive information [2].

Official Reference

Exam Strategy

When evaluating risk treatments for third-party or cloud scenarios, prioritize technical controls that directly mitigate the specific asset exposure over administrative or legal measures. Always map the control back to the shared responsibility model to determine which party holds the actual risk owner role for the affected data layer.

Related Analysis

Practice All CRISC Questions

Access 332 questions with complete answers and detailed explanations.

View Full CRISC Practice Test →

← Back to CRISC Study Guide