A regulator requires that encryption keys protecting customer records in cloud object storage stay under the company's control, including the ability to disable a key and render the data unreadable. Which capability should be selected?
Select an answer to reveal the explanation.
Short Explanation
If you need to be the one holding the master key, you need customer-managed keys. You set the policy, you can rotate them, and you can switch one off to lock the data instantly. Provider-default keys are convenient, but someone else is holding the keyring.
Full Explanation
Cloud key management services let customers create and control keys used to encrypt data in storage services. With customer-managed keys, the company defines who can use and administer each key, controls rotation, can audit every use, and can disable or schedule deletion of a key, which makes data encrypted under it inaccessible. That satisfies a requirement for customer control and the ability to render data unreadable. Some organizations go further with keys generated in their own hardware security modules, but customer-managed keys in the provider service already meet the stated requirement. Provider-managed default keys do encrypt data at rest, but the provider controls their lifecycle and policies, so the company cannot independently revoke them. TLS protects data in transit between client and service; once records are stored, TLS plays no part, so it does not address keys protecting stored records. Hashing is a one-way function used for integrity verification, not encryption; hashed records cannot be decrypted by anyone, and a hash is not a key that controls access, so it would destroy usability without meeting the requirement. Exam caveat: disabling a key affects every object encrypted with it, so key scope and separation must be planned carefully. Operational check: configure the bucket to use the customer key, upload a test object, confirm logs show key usage, then disable the key in a test and verify the object cannot be read.