A financial services organization is adopting a hybrid cloud model. The security architect must ensure that data classified as Restricted never leaves the on-premises data center, while Confidential data may reside in a private cloud zone. Which architecture control BEST enforces these data residency requirements?

Question

Accepted Answer

B. Define data perimeters using classification-aware network security controls and cloud resource policies that enforce geographic and zone-based restrictions. Data perimeters using classification-aware controls — such as cloud resource policies (e.g., AWS SCPs or Azure Policy) combined with network security policies — can enforce zone-based and geographic restrictions aligned to data classification. The CAS-005 V5 objectives list data perimeters and secure zones under security boundaries within Security Architecture.

Related Questions

Discussion