70-450 · Question #68
You are a professional level SQL Sever 2008 Database Administrator. You are experienced in managing databases in an enterprise-level organization,optimizing and sustaining the database life cycle…
The correct answer is C. Symmetric key encryption should be utilized. At the root of encryption tree is the Windows Data Protection API (DPAPI), which secures the key hierarchy at the machine level and is used to protect the service master key (SMK) for the database server instance. The DIVIK protects the database master key (DMK), which is…
Question
You are a professional level SQL Sever 2008 Database Administrator. You are experienced in managing databases in an enterprise-level organization,optimizing and sustaining the database life cycle. In the company, your job is to implement solutions on security, troubleshooting, deployment and optimization. A SQL Server 2008 infrastructure is managed by you. A database is utilized by the instance, and the database is utilized by a Web-based application. 15,000 transactions are processed by the application every minute. A column is contained by a table in the database, and the column is utilized only by the application. Sensitive data is stored in this column. The sensitive data should be stored with the highest security level. In addition, the least amount of memory space and processor time should be utilized. From the following four encryption types, which one should you utilize?
Options
- AAsymmetric key encryption should be utilized.
- BCertificate-based encryption should be utilized.
- CSymmetric key encryption should be utilized.
- DTransparent data encryption should be utilized.
How the community answered
(52 responses)- A2% (1)
- B10% (5)
- C83% (43)
- D6% (3)
Explanation
At the root of encryption tree is the Windows Data Protection API (DPAPI), which secures the key hierarchy at the machine level and is used to protect the service master key (SMK) for the database server instance. The DIVIK protects the database master key (DMK), which is stored at the user database level and which in turn protects certificates and asymmetric keys. These in turn protect symmetric keys, which protect the data. TDE uses a similar hierarchy down to the certificate. The primary difference is that when you use TDE, the DIVIK and certificate must bestored in the master database rather than in the user database. A new key, used only for TDE and referred to as the database encryption key {DEK), is created and stored in the user database. This hierarchy enables the server to automatically open keys and decrypt data in both cell-level and database-level encryption. The important distinction is that when cell-level encryption is used, all keys from the DIVIK down can be protected by a password instead of by another key. This breaks the decryption chain and forces the user to input a password to access data. In TDE, the entire chain from DPAPI down to the DEK must be maintained so that the server can automatically provide access to files protected by TDE. In both cell-level encryption and TDE, encryption and decryption through these keys is provided by the Windows Cryptographic API (CAPI). Symmetric keys use the same password to encrypt and decrypt data, so it is the less space consuming, because one asymmetric key will use one private and one public key.
Topics
Community Discussion
No community discussion yet for this question.