A security architect is updating an enterprise data protection framework to address regulatory compliance and storage security requirements across cloud and on-premises infrastructure. Match each data protection technology to the enterprise operational requirement it primarily fulfills.
- Hardware Security Module (HSM)Safeguards root key material and processes cryptographic operations within a dedicated tamper-resistant physical boundary.
- Format-Preserving TokenizationReplaces primary account numbers with non-sensitive surrogate values while maintaining structural formatting for legacy application compatibility.
- SAN LUN MaskingRestricts storage volume visibility at the controller level to specific Host Bus Adapter (HBA) World Wide Names (WWNs).
- DLP Document FingerprintingDetects unauthorized egress of sensitive unstructured data by comparing file content hashes against known confidential documents.
Answer
Hardware Security Module (HSM) matches dedicated cryptographic key protection in tamper-resistant hardware; Format-Preserving Tokenization matches substituting sensitive values with formatted surrogates; SAN LUN Masking matches isolating storage volumes by Host Bus Adapter (HBA) WWNs; and DLP Document Fingerprinting matches identifying sensitive unstructured file exfiltration using content hashes.
Each pair correctly matches a key storage and data protection architecture technology to its operational role. HSM provides physical and logical protection for master keys; format-preserving tokenization protects sensitive payloads while avoiding application breaking changes; SAN LUN masking enforces volume access boundaries; and DLP document fingerprinting protects unstructured IP exfiltration.
Step-by-Step Solution
Key Concept
Enterprise storage security controls must align specific architectural mechanisms—such as hardware key protection, storage volume isolation, data tokenization, and DLP content inspection—with distinct threat models and operational constraints.