Question 420
At the Quayford payments platform, cloud object storage is encrypted by default but unrestricted tenant members can read confidential payroll exports. Which ongoing control best prevents this issue from recurring?
Explanation
Correct Answer
The needed prevention is to audit storage ACLs and data labels after new uploads. It directly sustains the original change to apply customer-managed data classification and least privilege access control.
Incorrect Answers
That routine supports shared incident notification, but the relevant ongoing risk requires the team to audit storage ACLs and data labels after new uploads. For the Quayford payments platform, the direct corrective action is to apply customer-managed data classification and least privilege access control.
Monitor connector token expiry and ingestion gaps is not the primary recurring safeguard for this problem. The team should audit storage ACLs and data labels after new uploads. For the Quayford payments platform, the direct corrective action is to apply customer-managed data classification and least privilege access control.
Review hybrid routing and allowed flow lists on connection changes. That safeguard would help prevent recurrence of: A private cloud link is connectivity infrastructure not a blanket trust decision. The risk being reviewed here is instead: Provider storage encryption cannot substitute for customer authorization policy. The matching ongoing control is: Audit storage ACLs and data labels after new uploads.