A policy states that every cloud storage resource holding confidential data must be encrypted with customer-managed keys. The cloud team wants the policy enforced automatically as resources are created, not discovered months later. Which approach best supports this?
Select an answer to reveal the explanation.
Short Explanation
A tag is only worth something if a machine acts on it. You label the resource 'confidential' and let automated policy check, block or fix it the moment it's created. Naming conventions and quarterly reviews rely on people noticing, and that's the trap.
Full Explanation
Labels and tags attach classification metadata to cloud resources in a form that automation can read. When resources are tagged with their classification at creation, policy-as-code rules in the provisioning pipeline or the cloud management plane can evaluate the tag and the resource's configuration together, preventing creation of a confidential resource without customer-managed key encryption or automatically remediating it. This turns a written policy into an enforced, preventive control and supports consistent auditing. Publishing the policy and reviewing quarterly is a detective, manual control; noncompliant resources would exist for months, which the requirement explicitly rejects. Provider-managed default encryption is valuable baseline protection, but it does not meet the stated requirement for customer-managed keys, and tags are still needed to identify which resources hold confidential data. A naming prefix is informal and unenforced; nothing prevents a confidential resource from being created without it, and a name alone does not trigger any automated control. Exam caveat: tags must themselves be governed, with required keys and allowed values, or automation acts on inconsistent data. Operational check: attempt to create an untagged or unencrypted confidential storage resource in a test account and confirm it is blocked or remediated.