Examkin

Question

Difficulty: EasyData Protection and Storage Security Architecture

A storage administrator is configuring security mechanisms for sensitive database volumes hosted on an enterprise Storage Area Network (SAN). The administrator needs to protect data at rest with hardware-accelerated bulk encryption and ensure that top-level encryption keys are managed in a tamper-resistant environment. Which of the following technologies should the administrator deploy? (Select TWO.)

  1. Self-Encrypting Drives (SEDs) to perform automatic hardware-based disk encryptionAnswer
  2. Hardware Security Modules (HSMs) to generate and securely store root keying materialAnswer
  3. C
    Asymmetric RSA-4096 algorithms to encrypt all underlying storage blocks
  4. D
    Inline network firewalls to block unauthorized Fibre Channel LUN access
  5. E
    Digital signatures applied to storage arrays to enforce data non-repudiation

Answer

The administrator should deploy Self-Encrypting Drives (SEDs) for hardware bulk encryption and Hardware Security Modules (HSMs) for root key management.
Deploying Self-Encrypting Drives (SEDs) ensures bulk data on physical media is transparently encrypted at rest with minimal performance impact. Utilizing Hardware Security Modules (HSMs) ensures master encryption keys are generated, stored, and managed inside dedicated, tamper-resistant cryptographic hardware.

Step-by-Step Solution

1
Identify the requirement for hardware-accelerated bulk data encryption at rest.
Self-Encrypting Drives (SEDs) handle transparent, high-speed symmetric encryption at the drive controller level.
Bulk storage requires symmetric hardware ciphers like AES to maintain performance without host CPU overhead.
2
Identify the key management requirement for securing top-level encryption keys.
Hardware Security Modules (HSMs) isolate and safeguard key generation and key protection operations.
Centralized, tamper-resistant HSM devices ensure encryption keys are protected outside system memory.

Key Concept

Storage Security Architecture: Data at Rest Encryption and Key Management
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic