Examkin

Question

Difficulty: Very hardData Protection and Storage Security Architecture

A enterprise cloud services provider is decommissioning a high-density, multi-tenant Storage Area Network (SAN) array containing sensitive tenant data. The SAN storage tier utilizes Self-Encrypting Drives (SEDs) configured to manage media encryption keys via a centralized Key Management Interoperability Protocol (KMIP) cluster. Due to lease agreements, the physical NVMe solid-state drives must remain intact and intact hardware must be returned to the lessor within a strict two-hour window. Which of the following technical procedures provides the most effective and cryptographically sound method to ensure all tenant data is permanently unrecoverable before the drives are removed?

  1. Instruct the centralized KMIP server to purge the Media Encryption Keys (MEKs) or Key Encryption Keys (KEKs) associated with the SED array to execute cryptographic erasure.Answer
  2. B
    Execute a full multi-pass zeroization and block-overwrite utility across all physical NVMe drive sectors directly from the storage controller console.
  3. C
    Reconfigure Fibre Channel switch zoning and LUN masking rules to clear all Host Bus Adapter (HBA) World Wide Names (WWNs) associated with the storage array.
  4. D
    Re-encrypt the raw block volumes at the host level using an asymmetric RSA-4096 public key pair before unmounting the storage pools.

Answer

Destroying or purging the Key Encryption Keys (KEKs) or Media Encryption Keys (MEKs) on the centralized KMIP server to perform cryptographic erasure (crypto-shredding) is the most effective approach.
Cryptographic erasure (crypto-shredding) relies on deleting the encryption key (MEK/KEK) that protects encrypted data at rest. Because the storage array utilizes Self-Encrypting Drives integrated with a KMIP key manager, purging the keys on the KMIP cluster renders all underlying block data instantaneously unrecoverable while leaving physical drive hardware completely undamaged.

Step-by-Step Solution

1
Analyze storage architecture components
Identified Self-Encrypting Drives (SEDs) connected to an external enterprise Key Management Interoperability Protocol (KMIP) server storing key material.
Data at rest on SEDs is encrypted at the hardware level using symmetric keys locked by master keys managed externally.
2
Evaluate time and physical hardware constraints
Physical drives must remain undamaged due to lease return obligations, and decommissioning must occur within two hours.
Physical destruction (degaussing, shredding) violates lease terms, and full sector zeroization across multi-terabyte NVMe arrays exceeds the allowed timeframe.
3
Select cryptographic erasure method
Sanitize the media instantly by revoking/deleting the corresponding KEKs/MEKs on the KMIP key management cluster.
Without access to the decryption keys, the encrypted data remaining on the flash sectors becomes mathematically impossible to decipher, achieving NIST SP 800-88 compliant sanitization in seconds.

Key Concept

Cryptographic Erasure (Crypto-shredding) & Centralized Key Management (KMIP)
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic