Question

A financial services company stores customer records across multiple cloud object storage buckets and databases. Auditors found that sensitive PII was being copied into buckets intended for non-sensitive analytics data, and no controls prevented this. The security team wants an automated, scalable way to identify sensitive data as it lands and enforce handling rules that block or quarantine misplaced PII. Which approach best addresses this requirement?

Accepted Answer

Deploy a Data Loss Prevention (DLP) service that automatically discovers and classifies data, then enforces policies to block or quarantine PII in unauthorized locations

Answer

Enable server-side encryption with customer-managed keys on all buckets and databases to protect the sensitive data

Answer

Restrict access to all analytics buckets using IAM policies that grant read-only permissions to the analytics team

Answer

Configure lifecycle rules to move all objects older than 30 days into an archival storage tier for long-term retention