A regulator requires that a bank's cloud-hosted database be encrypted with keys that remain exclusively in the bank's own hardware security module, so the cloud provider can never possess the key material. Which model satisfies this requirement?
Select an answer to reveal the explanation.
Short Explanation
If the rule says the provider can never hold the key, then handing them a copy, even one you made, breaks the rule. KYOK keeps the key in your own HSM and the cloud has to ask you each time it needs it. BYOK is the trap here because it still ends with your key sitting in their vault.
Full Explanation
Keep your own key places the key material in a hardware security module or key store that the customer owns and operates. The cloud service never receives the key; when it needs to encrypt or decrypt, often by wrapping and unwrapping data encryption keys, it calls out to the customer's key system, which performs the operation and can refuse it. That satisfies a requirement that the provider must never possess key material, and it lets the customer cut off access to the data by withholding key operations. Bring your own key lets the bank generate the key, but importing it into the provider's key management service means the provider then holds and uses it, which fails the exclusivity requirement. Provider-managed keys are created and held by the provider, the opposite of what the regulator demands, regardless of the rotation schedule. Transparent data encryption describes what is encrypted, the files at rest, not who controls the key; with keys stored in the provider's region, the provider has access to them. Exam caveat: KYOK adds latency and an availability dependency, because an outage of the customer's HSM can make the database unavailable. Operational check: verify the key service configuration references the external key store and test a controlled denial of key access.