Examkin

Question

Difficulty: MediumData Protection and Storage Security Architecture

Match each enterprise data protection architectural control to its corresponding storage security function.

  • Tokenization with Format-Preserving EncryptionReplaces sensitive values with surrogate tokens while preserving existing database column schemas and validation rules.
  • Hardware Security Module (HSM) with KMIPProvides centralized, tamper-resistant generation and lifecycle management of root keys across heterogeneous storage arrays.
  • LUN Masking and Fabric ZoningRestricts Storage Area Network (SAN) access so that only authorized host bus adapters (HBAs) can attach to specific storage targets.
  • Cryptographic Erase on Self-Encrypting Drives (SED)Rapidly renders physical storage drives unreadable during decommissioning by destroying the internal media encryption key.

Answer

Tokenization with Format-Preserving Encryption matches replacing sensitive values with surrogate tokens while preserving database column schemas. Hardware Security Module (HSM) with KMIP matches providing centralized, tamper-resistant key generation and management. LUN Masking and Fabric Zoning matches restricting SAN access so only authorized HBAs can attach to specific storage targets. Cryptographic Erase on SEDs matches rapidly rendering physical drives unreadable during decommissioning by destroying internal encryption keys.
Each storage security mechanism operates at a distinct operational layer of data storage architecture: application/database field protection (tokenization with FPE), root key lifecycle governance (HSM with KMIP), SAN fabric path isolation (LUN masking and zoning), and media sanitization at end-of-life (cryptographic erase).

Step-by-Step Solution

1
Analyze field-level data protection and schema preservation needs.
Identify Tokenization with Format-Preserving Encryption as the technique that substitutes sensitive values while keeping existing field formatting intact.
Tokenization replaces raw sensitive entries with surrogate values, avoiding database application syntax errors without storing actual plaintext.
2
Evaluate key protection architectures and interoperability protocols.
Connect HSM with KMIP to centralized hardware key generation, storage, and cross-platform key management communication.
HSMs provide physical and logical tamper protection for keys, and KMIP standardizes key management operations across multi-vendor storage environments.
3
Examine SAN network segmentation and storage access restriction controls.
Match LUN Masking and Fabric Zoning to Host Bus Adapter (HBA) initiator-to-target access enforcement.
Zoning isolates FC switch network communication, and LUN masking ensures storage controllers restrict volume visibility to intended host HBAs.
4
Assess storage drive retirement and media sanitization mechanisms.
Link Cryptographic Erase on SEDs to the immediate destruction of the internal Data Encryption Key (DEK).
Destroying the underlying DEK makes all encrypted blocks on self-encrypting drives permanently unrecoverable in seconds.

Key Concept

Data Protection and Storage Security Architecture Controls
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic