CAS-001 · Question #173
A security administrator at a Lab Company is required to implement a solution which will provide the highest level of confidentiality possible to all data on the lab network. The current…
The correct answer is B. Transport encryption. The existing infrastructure already includes full disk encryption (data at rest). The gap in the architecture is protecting data while it traverses the network - data in transit. Transport encryption (e.g., TLS/SSL, IPsec) addresses this by encrypting data as it moves between…
Question
A security administrator at a Lab Company is required to implement a solution which will provide the highest level of confidentiality possible to all data on the lab network. The current infrastructure design includes:
- Two-factor token and biometric based authentication for all users
- Attributable administrator accounts
- Logging of all transactions
- Full disk encryption of all HDDs
- Finely granular access controls to all resources
- Full virtualization of all servers
- The use of LUN masking to segregate SAN data
- Port security on all switches
The network is protected with a firewall implementing ACLs, a NIPS device, and secured wireless access points. Which of the following cryptographic improvements should be made to the current architecture to achieve the stated goals?
Options
- APKI based authorization
- BTransport encryption
- CData at rest encryption
- DCode signing
How the community answered
(48 responses)- A6% (3)
- B63% (30)
- C10% (5)
- D21% (10)
Explanation
The existing infrastructure already includes full disk encryption (data at rest). The gap in the architecture is protecting data while it traverses the network - data in transit. Transport encryption (e.g., TLS/SSL, IPsec) addresses this by encrypting data as it moves between systems, which is essential for confidentiality in a networked environment. PKI-based authorization (Option A) addresses authentication and access control, not confidentiality directly. Data at rest encryption (Option C) is already implemented via full disk encryption of all HDDs, so adding more would be redundant. Code signing (Option D) ensures integrity and authenticity of software, not confidentiality of data. Transport encryption is the missing layer that completes a defense-in-depth confidentiality strategy.
Topics
Community Discussion
No community discussion yet for this question.