Question 1097

Forty Terabytes at Rest

You are encrypting 40 TB of object storage at rest using envelope encryption with a cloud KMS. Which arrangement describes how the ciphertext and the keys are laid out?

A

Each object is encrypted with a key derived from its storage path, and KMS retains the derivation salt for each key prefix

B

Each object is encrypted with its own data key, and that data key wrapped by a KMS master key sits beside the ciphertext

C

Each object is encrypted directly by the KMS master key, so all 40 TB streams through the KMS API on every read and write

D

Each object is encrypted with its own data key stored in plaintext beside the ciphertext, and KMS retains a checksum used to verify integrity