Examkin

Question

Difficulty: Very hardData Protection and Storage Security Architecture

A biopharmaceutical research enterprise is refactoring its data protection and storage security architecture across a hybrid deployment containing high-throughput NVMe Storage Area Network (SAN) arrays and off-site cloud object storage. The design must ensure zero-trust data protection for proprietary genomic data at rest and during transit, enforce cryptographically isolated key management, maintain ultra-low latency bulk encryption, and prevent sensitive data exfiltration from endpoint storage interfaces. Which of the following architectural controls should the security architect select to satisfy these enterprise security objectives? (Select THREE.)

  1. Deploy Hardware Security Modules (HSMs) integrated via Key Management Interoperability Protocol (KMIP) to isolate Key Encryption Keys (KEKs) from host systems and manage Data Encryption Key (DEK) wrapping.Answer
  2. Configure Self-Encrypting Drives (SEDs) featuring hardware-based AES bulk encryption and cryptographic erase (crypto-shredding) functionality on the storage array controller.Answer
  3. Implement contextual Data Loss Prevention (DLP) controls at storage egress points and endpoints to monitor pattern signatures and block unauthorized exfiltration.Answer
  4. D
    Apply asymmetric RSA-4096 algorithms for real-time bulk data encryption during disk write operations across all NVMe SAN logical unit numbers (LUNs).
  5. E
    Utilize local RAID 10 disk array mirroring as the primary disaster recovery and immutable anti-ransomware data protection strategy.
  6. F
    Delegate sole authority for defining data classification levels and data access retention policies to the IT storage custodian team.

Answer

The correct controls are deploying HSMs via KMIP for isolated key management, utilizing hardware SEDs for low-latency bulk encryption at rest, and deploying DLP controls to prevent data exfiltration.
The combination of HSM-managed key envelopes via KMIP, array-level SED symmetric encryption, and enterprise DLP deployment provides complete defense-in-depth across data lifecycle states (rest, transit, use) while preserving NVMe SAN performance and regulatory separation of duties.

Step-by-Step Solution

1
Analyze key management and cryptographic isolation requirements.
Identified envelope encryption via HSM and KMIP as the robust standard for isolating Key Encryption Keys (KEKs) and wrapping Data Encryption Keys (DEKs).
Cryptographic key separation ensures storage administrators cannot compromise raw keys directly from storage nodes.
2
Evaluate high-performance bulk data storage encryption methods for NVMe SAN arrays.
Selected hardware-based Self-Encrypting Drives (SEDs) utilizing AES symmetric encryption.
Hardware-based SEDs offload cryptographic overhead from host CPUs, sustaining high NVMe throughput while offering instant crypto-shredding capability.
3
Address data exfiltration threats across storage and endpoint boundaries.
Enforced inline and endpoint Data Loss Prevention (DLP) monitoring.
DLP inspects content pattern markers to restrict unauthorized copying or egress of proprietary intellectual property.

Key Concept

Enterprise Data Protection and Storage Architecture Controls
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic