Examkin

Question

Difficulty: MediumData Protection and Storage Security Architecture

An e-commerce enterprise is deploying an automated cloud storage repository for sensitive database backups containing customer personally identifiable information (PII). Regulatory compliance mandates that all bulk data must be encrypted at rest with high throughput, while key lifecycle management must be secured by a dedicated hardware root of trust to prevent key extraction. Which architecture best fulfills both performance and key protection requirements?

  1. Encrypt bulk backups using symmetric Data Encryption Keys (DEKs) wrapped by Key Encryption Keys (KEKs) managed inside a Hardware Security Module (HSM).Answer
  2. B
    Encrypt bulk backup files directly using asymmetric RSA-4096 public keys and retain the private key in a software key vault.
  3. C
    Enforce strict network microsegmentation and firewall access control rules around the cloud backup storage endpoints.
  4. D
    Generate SHA-256 cryptographic hashes for all backup files before transfer to guarantee data-at-rest confidentiality.

Answer

Encrypt bulk backups using symmetric Data Encryption Keys (DEKs) wrapped by Key Encryption Keys (KEKs) managed inside a Hardware Security Module (HSM).
The correct answer utilizes envelope encryption. Bulk backup data is encrypted rapidly using symmetric Data Encryption Keys (DEKs), while the DEKs themselves are encrypted (wrapped) by Key Encryption Keys (KEKs) maintained securely inside a tamper-resistant Hardware Security Module (HSM). This architecture balances high-speed bulk data processing with rigid, hardware-enforced key governance.

Step-by-Step Solution

1
Analyze bulk data performance requirements
Bulk storage encryption requires high-speed symmetric ciphers (such as AES) rather than asymmetric encryption.
Symmetric encryption provides high throughput necessary for large database backup payloads.
2
Evaluate key protection and root-of-trust requirements
Key Encryption Keys (KEKs) should be stored and processed within a dedicated Hardware Security Module (HSM).
An HSM provides a tamper-resistant hardware root of trust that protects master keys from unauthorized extraction.
3
Synthesize the complete key governance model
Envelope encryption (wrapping symmetric DEKs with HSM-protected KEKs) satisfies both performance and security constraints.
Envelope encryption isolates key management from bulk data processing, meeting both operational efficiency and regulatory standards.

Key Concept

Envelope encryption and Hardware Security Module (HSM) key protection architecture
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic