Examkin

Question

Difficulty: MediumData Protection and Storage Security Architecture

A security architect is designing a cloud backup and object storage architecture to safeguard critical corporate records against unauthorized data exfiltration and ransomware tampering. The design must guarantee data confidentiality at rest while preventing stored backup snapshots from being modified or deleted even if administrative credentials are compromised. Which TWO of the following technical controls should the architect incorporate into the storage design to satisfy these requirements? (Select TWO).

  1. Enforce AES-256 symmetric encryption managed through a dedicated key management service for bulk storage encryption.Answer
  2. Configure Write Once, Read Many (WORM) storage policies with object retention locks on backup buckets.Answer
  3. C
    Utilize RSA-4096 asymmetric key pairs as the primary mechanism to encrypt block storage volumes for high-speed read/write operations.
  4. D
    Apply SHA-256 cryptographic hashing to raw files to enforce data confidentiality across stored backup archives.
  5. E
    Deploy inline network intrusion prevention systems (IPS) to execute automated file encryption on local host directory trees.
  6. F
    Classify storage immutability rules as detective security controls aimed at logging unauthorized access attempts post-incident.

Answer

The architect should enforce AES-256 symmetric encryption managed via a key management service to ensure data confidentiality at rest, and configure Write Once, Read Many (WORM) storage policies with retention locks to ensure data immutability against deletion.
To satisfy both requirements, the organization needs a robust encryption mechanism for confidentiality at rest and an immutable storage policy for anti-deletion resilience. AES-256 symmetric encryption provides high-speed bulk storage encryption suitable for large backup volumes. Write Once, Read Many (WORM) storage policies enforce object immutability, prohibiting data overwrite or deletion even if administrative credentials are compromised.

Step-by-Step Solution

1
Identify confidentiality control requirement for bulk data at rest
AES-256 symmetric encryption delivers secure, fast bulk encryption appropriate for storage volumes and objects.
Symmetric algorithms are optimized for high-volume storage encryption performance compared to asymmetric ciphers.
2
Identify anti-tampering and anti-deletion control requirement for backup objects
Write Once, Read Many (WORM) policies combined with retention locks enforce data immutability.
WORM storage prevents any modification or destruction of written data objects even by privileged accounts during the retention period.

Key Concept

Data Protection and Storage Security Architecture
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic