Exam CISSP topic 1 question 393 discussion

Most secure is to avoid the use and reliance of CSP's key infrastructure and only use internal one.

Usually the CLOUD service providers have the digital key to the encryption so that they can process a user’s data—for example, by indexing the data for future searches. I'm not sure if that means they have a key to ANY encryption used or only if their cloud native processes are used for encryption. I'm still going with answer A. (encryption), but this article could indicate B is the correct answer. https://thesciencebehindit.org/how-secure-is-data-stored-in-the-cloud/#:~:text=Can%20the%20cloud%20computing%20company,the%20data%20for%20future%20searches.

most effective on a cloud provider would be through contract.

Answer A) https://cpl.thalesgroup.com/faq/data-security-in-the-cloud/how-do-i-ensure-the-cloud-provider-does-not-access-my-data

I don't like this question. If you have to think like a manager then you go with B since you're concerned with processes and cost. However, A makes more operational sense. ChatGPT says to go with A but I believe the answer is B...

B is more effective way, because A will generate extra cost on that and I think the exam more focus on high level consideration.

I prefer a technical Computer Says No, thus A. If one could make a case that the CSP can easily access the data (i.e. via self-generated user accounts), I probably would go for B.

A is correct