A healthcare analytics firm runs database workloads on shared cloud hardware. Its data is already encrypted at rest and in transit, but the firm must also protect data while it is being processed in memory from the host operator. Which technology addresses this requirement?
Select an answer to reveal the explanation.
Short Explanation
You've locked the data on disk and on the wire, but the moment it's being worked on, it's sitting in memory in plaintext. Confidential computing gives that work a locked room on the processor that even the host can't look into. TDE and TLS are the traps; they cover the other two states of data, not data in use.
Full Explanation
Data exists in three states: at rest, in transit and in use. Encryption at rest and TLS cover the first two, but to compute on data the processor normally needs it in plaintext in memory, where a privileged host operator or compromised hypervisor could read it. Confidential computing addresses data in use by running workloads inside a hardware-based trusted execution environment, an isolated, encrypted memory region whose contents are inaccessible to the host operating system, hypervisor and cloud operator, with attestation that lets the customer verify the environment before releasing secrets to it. Transparent data encryption protects files on storage; pages are decrypted into memory when queried, which is exactly the exposure being asked about. Mutual TLS strengthens authentication and protects the network path but ends at the server, where data is decrypted for processing. Dynamic data masking changes what query results show to some users and does nothing to protect memory from the infrastructure operator. Exam caveat: confidential computing complements rather than replaces encryption at rest and in transit, and support depends on specific hardware and service offerings. Operational check: confirm the workload runs on an attested trusted execution environment and that keys are released only after successful attestation.