Examkin

Soru

Zorluk: KolayData Protection and Storage Security Architecture

A storage administrator is configuring security mechanisms for sensitive database volumes hosted on an enterprise Storage Area Network (SAN). The administrator needs to protect data at rest with hardware-accelerated bulk encryption and ensure that top-level encryption keys are managed in a tamper-resistant environment. Which of the following technologies should the administrator deploy? (Select TWO.)

  1. Self-Encrypting Drives (SEDs) to perform automatic hardware-based disk encryptionCevap
  2. Hardware Security Modules (HSMs) to generate and securely store root keying materialCevap
  3. C
    Asymmetric RSA-4096 algorithms to encrypt all underlying storage blocks
  4. D
    Inline network firewalls to block unauthorized Fibre Channel LUN access
  5. E
    Digital signatures applied to storage arrays to enforce data non-repudiation

Cevap

The administrator should deploy Self-Encrypting Drives (SEDs) for hardware bulk encryption and Hardware Security Modules (HSMs) for root key management.
Deploying Self-Encrypting Drives (SEDs) ensures bulk data on physical media is transparently encrypted at rest with minimal performance impact. Utilizing Hardware Security Modules (HSMs) ensures master encryption keys are generated, stored, and managed inside dedicated, tamper-resistant cryptographic hardware.

Adım Adım Çözüm

1
Identify the requirement for hardware-accelerated bulk data encryption at rest.
Self-Encrypting Drives (SEDs) handle transparent, high-speed symmetric encryption at the drive controller level.
Bulk storage requires symmetric hardware ciphers like AES to maintain performance without host CPU overhead.
2
Identify the key management requirement for securing top-level encryption keys.
Hardware Security Modules (HSMs) isolate and safeguard key generation and key protection operations.
Centralized, tamper-resistant HSM devices ensure encryption keys are protected outside system memory.

Anahtar Kavram

Storage Security Architecture: Data at Rest Encryption and Key Management
Bu soruyu puanla

Konular

Data Protection and Storage Security Architecture

Bu konudan daha fazla soru