Cloud Data Protection, Encryption, and Key Management
This domain tests whether you can pick the right protection for a given data state and tenancy model, and whether you understand the key hierarchy well enough to explain what rotation does and does not do.
Core rules
- Classify first. Controls, retention, and residency follow from classification and contractual obligation, not from the storage service chosen.
- Three states, three control families. At rest: provider-managed keys, customer-managed keys, or client-side encryption. In transit: TLS 1.2+ minimum with strong cipher suites, and mTLS for service-to-service. In use: confidential computing with trusted execution environments, or tokenization to remove sensitive values from the processing path.
- Envelope encryption: a data key encrypts data, and a key encryption key in KMS or an HSM wraps the data key. Rotating the KMS backing key does not re-encrypt existing ciphertext - you must plan re-wrapping of data keys.
- Key custody tiers: provider-managed, BYOK (your key material imported into the provider's KMS), HYOK (external key manager, key never enters the provider), and per-tenant keys to enable crypto-shredding and tenant isolation.
- Secrets are not encryption keys. Use a secrets manager with dynamic, short-TTL credentials, audit every retrieval, and never bake secrets into images or committed env files.
Worked example
A regulated tenant demands sole control over the keys protecting its data in a SaaS platform. Reasoning: provider-managed keys fail immediately. BYOK establishes that the material originated with the tenant, but the provider still stores and uses the key, and revocation depends on a support workflow. HYOK with an external key store gives immediate revocation and genuine control - but decryption now depends on the tenant's key service, adding latency, availability coupling, and operational burden; if their service is unavailable, your application cannot read data. The strong answer states the tradeoff, not just the acronym.
Traps
Using BYOK and HYOK interchangeably; assuming enabling rotation re-encrypts stored data; treating encryption at rest as authorization; and scoping a data-protection review to primary storage while ignoring backups, snapshots, caches, and log stores.