Examkin

Question

Difficulty: MediumData Protection and Storage Security Architecture

A healthcare organization is refactoring its data architecture to secure sensitive patient diagnostic records stored on a Network Attached Storage (NAS) array. The security requirements dictate that data must be encrypted at rest, key lifecycle operations must be centrally managed and audited, and storage administrators must not have direct access to root cryptographic keys or store them on the local NAS hardware. Which of the following data protection solutions best fulfills these architectural requirements?

  1. Integrate the NAS array with a centralized Key Management Interoperability Protocol (KMIP) server backed by a Hardware Security Module (HSM).Answer
  2. B
    Encrypt the bulk NAS storage volumes using asymmetric RSA keys generated and stored locally on each NAS controller.
  3. C
    Implement stateful network firewall controls and VLAN microsegmentation between the database hosts and the NAS array.
  4. D
    Apply Hash-based Message Authentication Codes (HMAC) across all NAS file system blocks.

Answer

Integrate the NAS array with a centralized Key Management Interoperability Protocol (KMIP) server backed by a Hardware Security Module (HSM).
Integrating a storage array with a Key Management Interoperability Protocol (KMIP) server backed by a Hardware Security Module (HSM) ensures bulk data at rest is encrypted using symmetric keys managed through a standardized enterprise protocol. The HSM provides dedicated, tamper-resistant hardware to generate, store, and audit root keys independently of the NAS array and administrators.

Step-by-Step Solution

1
Analyze storage encryption and key management requirements.
Identified the need for bulk encryption at rest, centralized key lifecycle administration, and secure key storage isolated from the NAS device.
Storing keys locally on storage arrays introduces security risks and management overhead.
2
Evaluate key management standards and hardware security controls.
KMIP enables standardized communication between storage devices and centralized key management systems, while HSMs provide tamper-resistant hardware protection for root keys.
Combining KMIP and HSM satisfies both centralized management and secure key storage demands.
3
Compare against incorrect alternatives.
Asymmetric bulk encryption is computationally impractical, firewall segmentation only addresses network boundary security, and HMACs provide integrity rather than confidentiality.
Only the KMIP and HSM integration meets all requirements for data at rest encryption and secure key management.

Key Concept

Centralized Storage Key Management and HSM Integration
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic