Question

A financial services company stores sensitive customer records in a cloud object storage bucket. A new compliance mandate requires that the organization retain full control over the encryption keys, be able to revoke access to all encrypted data instantly, and enforce automatic annual key rotation. The security team wants to minimize operational overhead while meeting these requirements. Which approach BEST satisfies the mandate?

Accepted Answer

Use customer-managed keys (CMK) in the cloud key management service with rotation enabled and envelope encryption

Answer

Enable server-side encryption using provider-managed keys (SSE with the cloud provider's default key)

Answer

Encrypt files client-side with a static symmetric key stored in the application configuration file

Answer

Rely on TLS encryption in transit and enable bucket versioning for data protection