Examkin

Question

Difficulty: HardData Protection and Storage Security Architecture

A software development firm hosts its multi-tenant build infrastructure on a high-performance Storage Area Network (SAN). During a security assessment, auditors identified two main storage architecture vulnerabilities: block-level data traffic traversing the storage fabric between compute hypervisors and storage arrays is unencrypted and subject to packet sniffing, and logical unit numbers (LUNs) can potentially be accessed by unauthorized host adapters attached to the same fabric switches. Which set of storage architecture controls most effectively mitigates both identified vulnerabilities?

  1. Enforce Fibre Channel Security Protocol (FC-SP) with IPsec transport encryption across the fabric, paired with hardware switch zoning and storage array LUN masking.Answer
  2. B
    Apply asymmetric RSA encryption to bulk data payloads prior to host transmission, relying on host operating system file system permissions to manage volume isolation.
  3. C
    Deploy network-based Data Loss Prevention (DLP) inspect appliances inline between fabric switches to filter raw SCSI block streams and drop unauthorized LUN commands.
  4. D
    Install Endpoint Detection and Response (EDR) host agents on all hypervisors to inspect block network interfaces and configure software firewalls on storage controllers.

Answer

Enforcing Fibre Channel Security Protocol (FC-SP) with IPsec transport encryption across the fabric, paired with hardware switch zoning and storage array LUN masking, provides comprehensive protection for both data in transit and volume segregation.
The solution requiring Fibre Channel Security Protocol (FC-SP) with IPsec transport encryption across the fabric, paired with hardware switch zoning and storage array LUN masking, directly addresses both security gaps. FC-SP and IPsec encrypt block-level SAN traffic in transit across the storage network, neutralizing passive sniffing attacks. Hardware zoning on SAN switches isolates HBA port communications, and array-level LUN masking restricts logical volume visibility exclusively to authorized initiator World Wide Names (WWNs) or iSCSI Qualified Names (IQNs).

Step-by-Step Solution

1
Analyze data-in-transit security requirements for SAN storage traffic.
Unencrypted block-level storage traffic across Fibre Channel or IP-based SANs requires transport layer encryption such as FC-SP or IPsec to prevent network sniffing.
Encryption at the fabric layer protects raw block communications between hypervisor initiators and array targets.
2
Analyze volume access isolation requirements at the storage layer.
Restricting volume access to authorized host bus adapters (HBAs) requires a combination of network-layer switch zoning and storage-layer LUN masking.
Zoning controls fabric switch communication paths, while LUN masking ensures only designated initiator WWNs/IQNs can mount specific storage volumes.
3
Synthesize the controls into a unified storage security architecture.
Combining FC-SP/IPsec with zoning and LUN masking directly resolves both fabric sniffing and unauthorized LUN mounting threats.
This strategy applies defense-in-depth across the SAN fabric and storage array control plane.

Key Concept

SAN Data Protection and Storage Network Segregation
Estimated Time:2m 0s
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic