Examkin

Question

Difficulty: MediumData Protection and Storage Security Architecture

Match each storage security and data protection mechanism to its primary enterprise operational control function.

  • LUN MaskingRestricts logical volume access on a Storage Area Network (SAN) to specific authorized host Bus Adapter (HBA) port identifiers.
  • Hardware Security Module (HSM)Provides dedicated, tamper-resistant hardware for central generation, storage, and lifecycle management of cryptographic root keys.
  • Endpoint Data Loss Prevention (DLP)Monitors host activity and prevents classified enterprise files from being copied to unauthorized local external storage media.
  • TokenizationReplaces sensitive data fields with non-sensitive surrogate values to preserve format while protecting data at rest in databases.

Answer

LUN Masking matches restricting storage volume access by host HBA ports; Hardware Security Module matches dedicated hardware key management; Endpoint Data Loss Prevention matches monitoring and blocking unauthorized file transfers to local external storage; Tokenization matches replacing sensitive data fields with non-sensitive surrogate values.
Each security solution fulfills a distinct storage architecture requirement: LUN Masking isolates SAN volumes per host HBA, HSMs secure root cryptographic keys within dedicated hardware, Endpoint DLP enforces egress data policies on client endpoints, and Tokenization replaces sensitive data elements with non-cryptographic tokens.

Step-by-Step Solution

1
Analyze SAN block storage isolation mechanisms.
Identify LUN Masking as the storage architecture technique used to restrict volume visibility to authorized host HBAs.
Storage Area Networks require logical partitioning so servers only see assigned storage blocks.
2
Evaluate key protection architectures.
Map dedicated physical hardware appliances for root keys to Hardware Security Modules (HSMs).
HSMs offer hardened cryptographic boundaries separate from general application software.
3
Differentiate endpoint data protection controls from backend data obfuscation.
Assign file exfiltration blocking on host nodes to Endpoint DLP, and database field surrogate substitution to Tokenization.
DLP inspects user data transport actions, while tokenization alters data storage representations.

Key Concept

Enterprise Data Protection and Storage Architecture Controls
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic