Examkin

Question

Difficulty: MediumData Protection and Storage Security Architecture

An online education platform stores terabytes of static video assets on a high-throughput network-attached storage (NAS) array. To comply with data privacy standards, the organization must protect the stored media files against physical drive theft from the data center without creating CPU bottlenecks on the storage array controllers. The development team initially suggested using asymmetric RSA-4096 encryption for every file written to disk. Which storage security architecture should the security engineer recommend to meet both performance and data-at-rest confidentiality requirements?

  1. Deploying Self-Encrypting Drives (SEDs) using hardware-based symmetric AES encryption managed by a central key management system.Answer
  2. B
    Encrypting each media file individually with asymmetric RSA-4096 keys to optimize read and write operations during bulk data processing.
  3. C
    Implementing Transport Layer Security (TLS) encryption across all storage network interfaces to secure data residing on physical disk platters.
  4. D
    Configuring network Data Loss Prevention (DLP) policy rules on perimeter firewalls as the primary preventive control against physical disk theft.

Answer

Deploying Self-Encrypting Drives (SEDs) using hardware-based symmetric AES encryption managed by a central key management system.
The option advocating Self-Encrypting Drives (SEDs) with symmetric AES encryption is correct because SEDs perform media encryption directly within the drive controller hardware using dedicated AES chips. This guarantees data-at-rest confidentiality against physical drive theft while completely offloading cryptographic calculations from the main storage array CPUs.

Step-by-Step Solution

1
Identify the primary operational constraint and security requirement.
The requirement calls for data-at-rest protection against physical drive theft while avoiding CPU performance bottlenecks on the storage controllers.
Bulk storage encryption must be hardware-accelerated and transparent to maintain throughput.
2
Evaluate cipher selection for bulk data encryption.
Symmetric ciphers (such as AES-256) must be used for bulk data rather than asymmetric ciphers (such as RSA).
Asymmetric ciphers carry high mathematical complexity and severe performance overhead when encrypting large media files.
3
Select the appropriate storage hardware control mechanism.
Self-Encrypting Drives (SEDs) satisfy the requirement by executing AES encryption on dedicated drive controller chips upon write and decrypting upon read.
SEDs offload cryptographic operations completely from host and storage array CPUs, providing zero performance degradation and immediate cryptographic erasure capabilities upon disk removal.

Key Concept

Data at Rest Encryption and Self-Encrypting Drives (SEDs)
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic