Question

A privacy engineer is designing at-rest encryption for a data lake holding sensitive customer records across multiple business units. Compliance requires that a compromise of the storage layer alone must not expose plaintext, and that cryptographic keys never reside in the same trust boundary as the encrypted data. Which design choice BEST satisfies these requirements?

Accepted Answer

Store the data encryption keys in a hardware security module (HSM) managed under a separate key management service outside the storage platform's trust boundary

Answer

Encrypt each dataset with a unique key and store those keys in a protected configuration file on the same storage cluster

Answer

Enable the storage platform's built-in transparent disk encryption using keys the platform generates and retains internally

Answer

Hash the sensitive fields with a salted SHA-256 function before writing them to the data lake