An organization wants to use a public cloud provider for IaaS instances. They will develop and deploy their own applications within these instances. The organization falls under the compliance regulations for PCI.
What should the organization have before deploying their applications in the public cloud?
A . Direct access to cloud provider infrastructure logs
B . Thorough understanding of the storage path data flows
C . Direct access to cloud provider network encryption keys
D . Thorough understanding of the application data flows
Answer: D