Question

A financial services company stores customer PII in a managed relational database in the cloud. An auditor requires that even the cloud provider's employees cannot decrypt the stored data, and that the encryption keys are fully under the customer's control and can be revoked instantly to render the data inaccessible. Which approach best satisfies these requirements?

Accepted Answer

Use customer-managed keys (CMK) in the cloud KMS, or bring-your-own-key/external key store, with tightly controlled key policies

Answer

Enable provider-managed default encryption at rest with the provider's own service key

Answer

Enable TLS for all connections to the database and rely on transport encryption

Answer

Store the data in the database and apply full-disk encryption on the underlying host volumes only