Examkin

Question

Difficulty: MediumData Protection and Storage Security Architecture

A pharmaceutical research organization is updating its storage architecture to host confidential genomic sequencing datasets. The security architect must satisfy two primary requirements: guarantee bulk data encryption at rest on storage area network (SAN) arrays without degrading host processing performance, and prevent research data from being copied to unauthorized physical media or unapproved endpoints. Which of the following technical security solutions should the architect select to meet these requirements? (Select TWO)

  1. Deploy Self-Encrypting Drives (SEDs) utilizing hardware-based cryptographic controllers on the SAN storage arraysAnswer
  2. B
    Implement software-based asymmetric RSA encryption across all bulk storage volumes
  3. Deploy an enterprise Data Loss Prevention (DLP) solution configured with endpoint and storage monitoring policiesAnswer
  4. D
    Configure RAID 5 array striping across storage pools to establish data non-repudiation
  5. E
    Install perimeter network firewalls to block physical data transfers to external USB media

Answer

The architect should deploy Self-Encrypting Drives (SEDs) on the SAN storage arrays and implement an enterprise Data Loss Prevention (DLP) solution with endpoint monitoring policies.
Deploying Self-Encrypting Drives (SEDs) satisfies the requirement for transparent, hardware-accelerated bulk data encryption without imposing software encryption overhead on host CPUs. Implementing Data Loss Prevention (DLP) directly controls data movements on endpoints, enforcing rules to inspect content and block unauthorized file transfers to removable media.

Step-by-Step Solution

1
Evaluate the requirement for high-performance bulk data encryption at rest.
Determine that hardware-based encryption using Self-Encrypting Drives offloads crypto operations from the CPU, maintaining storage performance.
Software bulk encryption adds heavy computational overhead on host processors.
2
Evaluate the requirement to prevent unauthorized copying of sensitive datasets to removable drives or unapproved endpoints.
Determine that an enterprise Data Loss Prevention (DLP) agent on endpoints can monitor and block unauthorized egress and USB copying.
DLP specifically monitors data in use and data on endpoints to enforce compliance rules against data exfiltration.

Key Concept

Data Protection and Storage Security Architecture
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic