An enterprise security architect is refining the organization's data protection and storage security architecture. Match each enterprise storage security objective on the left with the primary storage control or mechanism on the right that best satisfies the requirement.
- Preventing unauthorized access to SAN block volumes by restricting visibility to specific Host Bus Adapter (HBA) World Wide Names (WWNs) at the storage controller layer.LUN Masking and Zoning
- Offloading cryptographic key generation, lifecycle management, and secure key storage to dedicated hardware compliant with FIPS 140-3 Level 3 requirements.Hardware Security Module (HSM)
- Ensuring hardware-level full disk encryption that transparently encrypts data at rest directly on disk controllers without OS overhead.Self-Encrypting Drives (SED)
- Replacing sensitive account numbers with surrogate values of identical length and character type before writing to database storage.Format-Preserving Tokenization
Answer
The correct pairings are: 1) Preventing unauthorized SAN volume access pairs with LUN Masking and Zoning. 2) Offloading key generation and lifecycle management to tamper-resistant hardware pairs with Hardware Security Module (HSM). 3) Hardware-level disk block encryption without OS reliance pairs with Self-Encrypting Drives (SED). 4) Replacing account numbers with format-matched surrogate tokens pairs with Format-Preserving Tokenization.
Each requirement directly aligns with a foundational storage security architectural control: LUN Masking/Zoning isolates SAN storage access; HSMs secure key management infrastructure; SEDs deliver hardware-based encryption at rest; and Format-Preserving Tokenization protects structured sensitive data while maintaining system schema constraints.
Step-by-Step Solution
Key Concept
Storage Architecture Security Controls & Encryption Mechanisms