Examkin

Soru

Zorluk: ZorData Protection and Storage Security Architecture

A digital media broadcasting corporation stores petabytes of high-definition video archives within an enterprise object storage platform. To fulfill compliance mandates from content licensors, the security team must implement a data protection solution that enforces hardware-rooted key protection, strict audit logging of key access requests, and annual key rotation. Crucially, the key rotation process must not require re-encrypting the underlying multi-terabyte static data objects. Which of the following storage security architectures best meets these combined requirements?

  1. Implement envelope encryption using Data Encryption Keys (DEKs) wrapped by Key Encryption Keys (KEKs) stored within a Hardware Security Module (HSM).Cevap
  2. B
    Encrypt each stored video archive directly using individual asymmetric RSA-4096 key pairs managed via software keystores.
  3. C
    Deploy an inline Network Data Loss Prevention (NDLP) appliance to inspect storage traffic and re-encrypt data streams during transport.
  4. D
    Configure Self-Encrypting Drives (SEDs) across storage nodes utilizing drive-level Media Access Control Security (MACsec).

Cevap

Envelope encryption using Data Encryption Keys (DEKs) wrapped by Key Encryption Keys (KEKs) inside a Hardware Security Module (HSM) satisfies all requirements.
Envelope encryption utilizes a symmetric Data Encryption Key (DEK) to encrypt bulk data objects and a Key Encryption Key (KEK) managed inside a Hardware Security Module (HSM) to encrypt the DEKs. When key rotation occurs, only the KEK wrapping the DEKs needs to be updated, enabling instant key rotation without reading or re-writing petabytes of static video files. This fulfills hardware-rooted security, access auditing, and zero-downtime key rotation requirements.

Adım Adım Çözüm

1
Analyze storage encryption scale and constraints
Re-encrypting petabytes of static video data during annual key rotation is computationally prohibitive and operationally unfeasible.
Direct bulk data re-encryption requires reading and re-writing all stored data objects.
2
Evaluate key management architectures
Envelope encryption separates data payload encryption (symmetric DEK) from root key protection (KEK).
Rotating the KEK only requires re-wrapping the DEK, leaving the underlying encrypted data payload untouched.
3
Integrate compliance requirements for hardware protection and auditing
Housing the KEK in a Hardware Security Module (HSM) fulfills hardware-rooted security and centralized audit logging requirements.
HSMs provide tamper-resistant key storage and detailed access trail generation.

Anahtar Kavram

Envelope Encryption and HSM Integration for Storage Security
Bu soruyu puanla

Konular

Data Protection and Storage Security Architecture

Bu konudan daha fazla soru