Exam CRISC topic 1 question 1626 discussion

In an Infrastructure as a Service (IaaS) model, the customer retains responsibility for securing their data, while the service provider manages the infrastructure. If a service provider's administrator accessed sensitive customer data without approval, the best protection against recurrence is to ensure the data is encrypted, particularly at rest and in transit. Encryption: Prevents unauthorized access, even by privileged insiders like administrators. Ensures that data remains confidential, even if storage or systems are accessed. Can be paired with customer-managed keys, so the provider cannot decrypt the data without permission.

B. Contractual requirements: Establishing clear contractual terms with the service provider is crucial. Contracts should specify access controls, audit rights, and compliance with data protection requirements. This ensures that administrators have only the access they need and that any unauthorized access is prohibited by the agreement.

To best protect against a recurrence of a service provider's administrator accessing sensitive information without approval in an Infrastructure as a Service (IaaS) model, the most effective measure would be: C. Data encryption. Encrypting data is a direct way to protect sensitive information from unauthorized access. Even if a service provider's administrator gains access to the data, encryption ensures that the content remains unreadable and secure without the appropriate decryption keys. This measure protects the data at rest as well as in transit, providing a robust defense against unauthorized access, regardless of the internal controls or policies of the service provider.