Several teams share block volumes and snapshots containing sensitive customer data in an IaaS account. Any engineer in the account can attach a volume to an instance or copy a snapshot to another account. Which control combination best protects this storage?
Select an answer to reveal the explanation.
Short Explanation
Storage protection is a two-lock door: encryption so the data's unreadable without the key, and access policies so only the right people can attach, copy or share it. Lock down who can use the key too, and you've made a copied snapshot useless to whoever grabbed it. Tags and compression feel tidy, but they won't stop anyone.
Full Explanation
Storage protection in IaaS combines cryptographic and access controls. Encrypting volumes and snapshots with keys held in a key management service means the data is unreadable without authorized key use, and snapshots copied or shared retain that protection. Access policies then enforce least privilege on the storage operations themselves, limiting who may attach volumes, create or copy snapshots, or share them outside the account, and separately limiting which identities may use the encryption keys, so a stolen snapshot cannot be decrypted by an account that lacks key permissions. Compression changes data representation for efficiency; it is reversible by anyone and provides no confidentiality. Tagging volumes with owners supports governance, cost allocation and attribute-based policies, but a tag on its own does not prevent any engineer from attaching or copying the data. Daily snapshots provide recoverability, which addresses availability and integrity after changes, yet creating more copies of sensitive data under the same permissive access actually multiplies exposure. Exam caveat: separating permission to use keys from permission to manage storage applies separation of duties to data protection. Operational check: attempt to share a snapshot to an external account with a standard engineer identity and confirm the request is denied.