The correct answer isB. Customers retain control over their encryption keys.
Usingcustomer-managed encryption keys (CMEK)with a cloudKey Management Service (KMS)allows
the customer toretain full control over the encryption keysused to encrypt their data. This is crucial in
maintaining data sovereignty, privacy, and compliance with regulatory requirements.
Key Benefits of Customer-Managed Encryption Keys:
Key Ownership and Control:Unlike cloud provider-managed keys, CMEK ensures that the customer
has full authority over the key's lifecycle, including creation, rotation, and deletion.
Enhanced Security:Customers can enforce strict access controls and audit who accesses the keys.
Compliance:Many regulations (like GDPR or HIPAA) mandate that data owners maintain control over
encryption keys.
Data Privacy:Even though the data is stored on the cloud, the provider cannot access unencrypted
data without the customer's permission.
Flexibility:Customers can choose when to revoke or rotate keys, which directly impacts data
availability and access.
Why Other Options Are Incorrect:
A . Bypass the need for encryption:CMEK does not eliminate the need for encryption; it strengthens
it by giving customers direct control.
C . Share encryption keys more easily:Sharing encryption keys can increase security risks, and CMEK
is designed to restrict, not ease, key sharing.
D . Reduces computational load on the cloud service provider:CMEK does not impact the
computational load. It focuses on key management and control rather than reducing processing
overhead.
Real-World Example:
InAWS KMS, using CMEK allows customers to bring their own keys (BYOK) and manage them directly
through AWS Key Management Service. Similar practices exist inGoogle Cloud KMSandAzure Key
Vault, where customers can generate and control their own encryption keys.
Practical Use Case:
A healthcare provider using a cloud service to store patient records may use CMEK to ensure that
sensitive data is encrypted under keys they control, ensuring compliance with regulations likeHIPAA.
Reference:
CSA Security Guidance v4.0, Domain 11: Data Security and Encryption
Cloud Computing Security Risk Assessment (ENISA) - Key Management and Encryption
Cloud Controls Matrix (CCM) v3.0.1 - Data Protection and Encryption Domain
