Examkin

Question

Difficulty: HardData Protection and Storage Security Architecture

A healthcare technology organization is designing a data protection architecture to archive multi-terabyte patient records in a cloud-based storage repository. Regulatory mandates require that the enterprise security team maintain exclusive physical control over key generation, rotation, and revocation lifecycle operations. Additionally, the bulk encryption mechanism must support high-throughput processing for mass ingestion without delegating root key custody to the cloud service provider. Which of the following storage security architecture configurations best satisfies both performance requirements and regulatory key ownership constraints?

  1. Perform bulk symmetric data encryption on-premises using Data Encryption Keys (DEKs) that are wrapped by Key Encryption Keys (KEKs) generated and managed inside a local Hardware Security Module (HSM) prior to uploading the ciphertext.Answer
  2. B
    Encrypt all archived data payloads directly using host-side asymmetric RSA-4096 public keys managed by the local security team before transmitting the files to cloud storage.
  3. C
    Deploy an inline endpoint Data Loss Prevention (DLP) agent as a corrective control to intercept unencrypted outbound cloud uploads and perform automatic server-side re-keying.
  4. D
    Enforce transport-layer TLS encapsulation with ephemeral session keying provided by the cloud vendor to fulfill the compliance requirement for enterprise data-at-rest storage security.

Answer

Bulk symmetric data encryption on-premises utilizing Data Encryption Keys (DEKs) wrapped by Key Encryption Keys (KEKs) managed inside an enterprise Hardware Security Module (HSM) before cloud upload.
Envelope encryption combined with an on-premises Hardware Security Module (HSM) satisfies both requirements. Symmetric algorithms efficiently handle multi-terabyte bulk payload encryption, while maintaining KEKs within a physical on-premises HSM guarantees complete enterprise custody over key generation, rotation, and revocation operations.

Step-by-Step Solution

1
Analyze Key Lifecycle and Custody Requirements
Identified that key generation, rotation, and revocation must reside strictly on-premises in enterprise hardware under direct physical control.
Regulatory compliance mandates that root keys cannot be delegated to or held by the cloud provider.
2
Evaluate Cryptographic Performance Requirements
Selected symmetric encryption (e.g., AES-256) for bulk payload processing.
Symmetric algorithms provide high-throughput processing necessary for multi-terabyte archive ingestion.
3
Select Storage Architecture Envelope (Envelope Encryption)
Configured local HSM to manage root Key Encryption Keys (KEKs) that wrap short-lived Data Encryption Keys (DEKs).
Envelope encryption separates data payload encryption from key governance, providing scalability and strict on-premises key control.

Key Concept

Data Encryption at Rest and Key Management Architecture (Envelope Encryption & HSM)
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic