Before transmitting sensitive financial data to the cloud, the best defense against interception threats like packet capture and man-in-the-middle attacks is encryption. Encryption protects data in transit by converting plain text into cipher text, which can only be deciphered with the correct keys.
Hashing provides integrity verification but does not secure confidentiality. Change tracking monitors modifications but does not prevent interception. Metadata labeling adds context but does not protect against on-path attackers.
Using strong encryption protocols (e.g., TLS) ensures that even if traffic is intercepted, the attacker cannot read the data. Encryption also aligns with compliance requirements such as PCI DSS, which mandates encryption for financial data during transmission. By encrypting before upload, the user ensures end-to-end confidentiality across potentially insecure networks.

The Domain Name System (DNS) is the cloud infrastructure component that employs a hierarchical and distributed database containing mappings. Managing Cloud documentation explains that DNS maps human- readable domain names to IP addresses and other resource records.
DNS is structured hierarchically, starting from the root level and branching into top-level domains, second- level domains, and subdomains. This distributed architecture ensures scalability, fault tolerance, and efficient resolution of requests across the internet and cloud environments.
TLS secures communications, clustered hosting refers to compute architecture, and resource sharing describes cloud efficiency. Therefore, DNS is the correct answer.

Risk mitigation reduces the impact of risk within BCDR planning. Managing Cloud principles explain that mitigation involves implementing controls and safeguards to lessen the likelihood or severity of adverse events.
Examples include redundancy, backups, failover mechanisms, and monitoring. These measures do not eliminate risk but significantly reduce operational disruption and data loss when incidents occur.
Insurance transfers financial risk, avoidance eliminates activities, and acceptance acknowledges risk without action. Therefore, mitigation is the correct strategy for reducing impact.

TheZero Trustsecurity model assumes that no user, device, or application should be trusted by default, whether inside or outside the network perimeter. Every access request must be continuously verified using strict identity, authorization, and context-based checks.
Unlike traditional perimeter security, Zero Trust emphasizes the principle of "never trust, always verify." Traffic inspection looks at data packets, intrusion prevention identifies malicious activity, and secret management safeguards sensitive keys and credentials. None of these approaches enforce constant, adaptive identity verification the way Zero Trust does.
By adopting Zero Trust, organizations ensure that access is not granted simply because a user is "inside" the network. Instead, continuous checks evaluate credentials, device posture, location, and other risk factors. This significantly reduces the risk of insider threats, credential theft, and lateral movement within cloud environments.

A compensating control should be implemented to address the loss of physical control when moving data to the cloud. Managing Cloud guidance explains that compensating controls are alternative safeguards used when direct controls are not feasible.
Since customers cannot physically secure cloud data centers, compensating controls such as strong encryption, key management, access controls, and monitoring are used to mitigate the risk. These controls provide equivalent or greater protection despite the lack of physical access.
The other options are not recognized control types in cloud security governance. Therefore, compensating control is the correct answer.