ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Confidential computing uses hardware-based trusted execution environments (TEEs) built into modern CPUs (for example, Intel SGX and AMD SEV). When a workload is started in a TEE, the processor encrypts the code and data in memory and isolates them from the host OS, hypervisor, and cloud administrators. Because this protection is provided at the hardware and firmware layer, most existing applications can run with little or no change once re-compiled for the target enclave or launched on a compatible virtual machine type.

Edge computing (processing closer to end users) improves latency but does not inherently protect data in use within the cloud provider's infrastructure. Blockchain smart contracts focus on integrity and decentralization, not on shielding in-memory data from the platform operator. Quantum-resistant storage encryption secures data at rest or in transit, but it does not address exposure while the data are actively processed in memory. Therefore, confidential computing is the only option that directly meets the requirement to protect data in use with minimal code changes.