A cloud storage bucket holds customer records. An audit warns that a future misconfiguration could make the bucket reachable, and the company wants the records to stay unreadable and governed even if that happens. Which combination of controls addresses data security most directly?

Data security in cloud environments protects the information itself rather than only the paths to it. Encrypting objects at rest with customer-managed keys means that reading the data requires permission to use the key as well as access to the bucket, so a storage misconfiguration alone does not expose plaintext. Least-privilege policies on both the key and the bucket limit who can decrypt, and data classification with DLP identifies which objects contain sensitive records so the strongest controls and monitoring apply to them. Together these keep the records protected even if the bucket becomes reachable. A web application firewall, DDoS protection and HTTP logging defend the application layer and availability; they do not stop someone who reaches the storage service directly. East-west firewall rules and flow logs control and observe network traffic between subnets, but object storage is usually accessed through the provider's API endpoint, not through those subnet paths. Region changes, versioning and replication improve resilience and recovery, not confidentiality, and replication actually creates another copy to protect. Exam caveat: provider-default server-side encryption protects against physical media loss but may not stop an authorized-looking API request; key control is what changes the outcome. Operational check: confirm the key policy grants decrypt only to named roles and test that an unauthorized principal cannot read an object.