Examkin

Question

Difficulty: MediumData Protection and Storage Security Architecture

A financial institution requires a storage security architecture for its high-performance database cluster. The design must protect data at rest against physical drive theft from the data center without incurring host operating system processor overhead, while centralizing cryptographic key management inside a dedicated tamper-resistant hardware appliance. Which of the following solutions best satisfies these security and architectural requirements?

  1. Self-Encrypting Drives (SEDs) integrated with an enterprise Hardware Security Module (HSM)Answer
  2. B
    Software-level database column encryption utilizing RSA asymmetric key pairs for bulk data storage
  3. C
    Cryptographic SHA-256 hashing applied to storage LUNs to provide physical data protection at rest
  4. D
    Stateful network firewalls deployed at the SAN switch boundaries to prevent unauthorized physical storage access

Answer

Self-Encrypting Drives (SEDs) integrated with an enterprise Hardware Security Module (HSM) best satisfies the requirements.
Self-Encrypting Drives (SEDs) perform symmetric bulk encryption directly on the drive controller hardware, ensuring data at rest is protected without placing cryptographic processing burdens on the host server CPU. Integrating SEDs with a Hardware Security Module (HSM) provides dedicated, tamper-resistant hardware for central key generation, storage, and lifecycle management, satisfying all criteria in the scenario.

Step-by-Step Solution

1
Analyze requirement for physical storage encryption without host CPU overhead
Hardware-level disk encryption, such as Self-Encrypting Drives (SEDs), performs cryptographic operations directly on the disk controller, avoiding host processor degradation.
Software-based disk or database column encryption consumes host CPU cycles and memory.
2
Analyze requirement for centralized, tamper-resistant key management
Hardware Security Modules (HSMs) provide tamper-evident key storage and centralized lifecycle management for storage encryption keys.
Storing keys in software or host memory exposes them to memory dump attacks and lacks hardware tamper resistance.
3
Synthesize the optimal combined storage architecture
Combining SEDs with an HSM delivers full hardware-offloaded data-at-rest protection and secure key management.
This combination directly fulfills all scenario constraints.

Key Concept

Storage Security and Key Management Architecture
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic