Exam Associate Data Practitioner topic 1 question 55 discussion

The best option is A. Use AEAD functions and delete keys when employees leave the organization. Option A is best because AEAD encryption makes data values unreadable by design when keys are deleted, directly meeting the requirement. Option B (Dynamic masking) is incorrect because masking only hides data, not making it unreadable at the storage level. Option C (CMEK) is less ideal than AEAD for this specific need, as it's broader encryption and potentially more disruptive. Option D (Column-level access control) is incorrect because it restricts access, but data remains readable for authorized users, not inherently unreadable. Therefore, Option A is the most precise solution for rendering data values unreadable upon employee departure.

You don't delete data record keys (row, tags, columns, KMS, etc..) when an employee leaves the company as that will make the data unusable for everyone who remains. That means that A and C are plain wrong. Using policy tags and removing viewer access to data tagged as sensitive is the easiest answer.

With AEAD, we can target specific fields and ensure that only sensitive data is affected when an employee leaves, which is more efficient than locking down the entire dataset using CMEK.

AEAD looks the best option here.