A bank wants to run fraud analytics on sensitive customer data using shared public cloud hosts, but it requires that the data stay protected even from the host operator and hypervisor while it is being processed in memory. Which technology addresses this requirement?
Select an answer to reveal the explanation.
Short Explanation
Encryption at rest locks the filing cabinet, TLS locks the courier's bag, but what about the moment you open the file on your desk? Confidential computing puts that desk inside a sealed glass booth even the building owner can't see into. The trap is choosing an encryption control that protects data everywhere except in use.
Full Explanation
Data exists in three states: at rest, in transit and in use. Confidential computing protects data in use by performing computation inside a hardware-based trusted execution environment, an isolated region of the processor whose memory is encrypted and inaccessible to the host operating system, the hypervisor and the operator. Remote attestation lets the customer verify that the expected code is running in a genuine environment before releasing data or keys to it. That directly meets a requirement to protect data from the host operator during processing on shared hosts. Encryption at rest protects stored data, but the data must be decrypted into memory to be analyzed, where a privileged host operator could reach it. TLS protects data moving between tiers and ends at each endpoint, leaving the decrypted data in memory unprotected. Masking nonproduction copies reduces exposure in testing but does nothing for production analytics, which must process real values. Exam caveat: the outline names confidential computing among related technologies; it complements, not replaces, encryption at rest and in transit. Operational check: confirm the workload verifies an attestation report before receiving decryption keys, and that keys are released only to attested environments.