A company generates an encryption key in its own on-premises hardware security module and imports it into its cloud provider's key management service, which then uses it to encrypt the company's managed databases. Which key management model is this?
Select an answer to reveal the explanation.
Short Explanation
BYOK is like cutting your own key and handing a copy to the landlord: you made it, but now it lives in their key cabinet. That's different from KYOK, where the key never leaves your own hands. The trap is thinking that generating the key yourself means you still hold it exclusively.
Full Explanation
Bring your own key describes a model in which the customer generates key material under its own control, often in an on-premises hardware security module, and imports it into the cloud provider's key management service. The provider's service then stores and uses that key to protect the customer's resources. The customer gains control over key generation, can document key provenance and can typically revoke or delete the imported key, but the key material does reside within the provider's infrastructure once imported. Keep your own key differs in that the key material stays in a customer-controlled key store or HSM and is never handed to the provider; the provider must request cryptographic operations from the customer's system. Provider-managed default keys are generated, stored and rotated entirely by the provider with no customer involvement in key creation. Confidential computing protects data while it is being processed in a hardware-based trusted execution environment and is not a key ownership model. Exam caveat: the distinguishing question is where the key lives after setup; imported means BYOK, retained means KYOK. Operational check: confirm the key's origin is recorded as imported in the key service, document the backup of the original key material, and test the rotation and revocation procedure.