Examkin

Soru

Zorluk: Çok zorData Protection and Storage Security Architecture

An enterprise health technology organization is deploying a high-throughput centralized database storage system processing millions of protected health information (PHI) records daily. Compliance standards mandate hardware-level protection for cryptographic key management where master keys are non-exportable and tamper-resistant. Additionally, data-at-rest bulk block encryption performance overhead must be offloaded directly to dedicated disk hardware, preventing media encryption keys from residing in host operating system memory. Which of the following storage security architectures satisfies both the performance and key isolation requirements?

  1. Self-Encrypting Drives (SEDs) utilizing hardware-based full disk encryption managed by an enterprise Hardware Security Module (HSM) for Key Encryption Key (KEK) lifecycle operationsCevap
  2. B
    Host-managed software bulk encryption using RSA-4096 asymmetric key pairs stored directly within Trusted Platform Module (TPM) chips across cluster nodes
  3. C
    SAN microsegmentation with inline packet-filtering firewalls executing transparent TLS termination for block-level storage array traffic
  4. D
    Software-level database column encryption utilizing host operating system file access control lists (FACLs) and kernel virtual memory paging encryption

Cevap

Self-Encrypting Drives (SEDs) utilizing hardware-based full disk encryption managed by an enterprise Hardware Security Module (HSM) for Key Encryption Key (KEK) lifecycle operations
The combination of Self-Encrypting Drives (SEDs) and a Hardware Security Module (HSM) perfectly satisfies both requirements. SEDs perform AES bulk encryption directly on the drive controller, eliminating OS memory key exposure and CPU performance overhead. The HSM provides a dedicated, tamper-resistant hardware appliance for securely generating, storing, and managing the Key Encryption Keys (KEKs) used to unlock or manage the drives.

Adım Adım Çözüm

1
Analyze the performance requirement for bulk storage encryption.
Bulk encryption must be executed at the disk hardware layer without host CPU/RAM overhead or exposing media keys in OS memory, pointing directly to Self-Encrypting Drives (SEDs).
SEDs implement hardware AES circuit encryption directly on the drive controller, ensuring near-zero latency and protecting Data Encryption Keys (DEKs) inside hardware.
2
Analyze the hardware key isolation and compliance requirement.
Key Encryption Keys (KEKs) and master keys must reside in dedicated, non-exportable hardware, pointing to a Hardware Security Module (HSM).
HSMs provide FIPS 140-2/3 validated tamper-evident environments for managing top-level cryptographic keys.
3
Synthesize the combined storage security architecture.
Pairing SEDs (for hardware-offloaded bulk encryption) with an enterprise HSM (for master KEK management) fulfills all compliance and throughput criteria.
This dual-layer hardware approach meets enterprise compliance for zero host-memory key exposure and high-performance throughput.

Anahtar Kavram

Storage Security Architecture: Integrating SEDs for hardware-level bulk encryption with HSMs for key governance
Bu soruyu puanla

Konular

Data Protection and Storage Security Architecture

Bu konudan daha fazla soru