What is needed to enable dataset encryption for z/OS?

Question

Options

• ACPACF, Crypto coprocessor, and Secure Container levels
• BCrypto coprocessor, HCD, and RACF levels
• CCrypto coprocessor, CPACF, and RACF levels
• DCPACF, Crypto coprocessor, and ICSF levels

• A
  6% (3)
• B
  2% (1)
• C
  79% (42)
• D
  13% (7)

Explanation

Option C is correct because z/OS dataset encryption requires three cooperating components: CPACF (CP Assist for Cryptographic Functions) provides the hardware-accelerated AES encryption engine built into every z/Architecture processor; the Crypto coprocessor (e.g., CEX6S/CEX7S) handles secure key storage and key wrapping in a tamper-resistant environment; and RACF (Resource Access Control Facility) provides the security policy layer - managing key labels, defining who can access encrypted datasets, and authorizing ICSF calls.

Why the distractors fail:

• A replaces RACF with "Secure Container levels," which is not a defined z/OS encryption prerequisite - a nonsense distractor.
• B replaces CPACF with HCD (Hardware Configuration Definition), which is an I/O configuration tool with no role in cryptographic operations.
• D substitutes ICSF for RACF. While ICSF (Integrated Cryptographic Service Facility) is the middleware that talks to the crypto hardware, the question targets the security management layer, which is RACF - ICSF is a vehicle, RACF is the gatekeeper.

Memory tip: Think "C-C-R" - Chip, Coprocessor, RACF" - the chip (CPACF) encrypts, the coprocessor protects keys, and RACF enforces who gets access. If you confuse RACF with ICSF, remember: ICSF runs the crypto; RACF rules the crypto.

No community discussion yet for this question.