CAS-001 · Question #393
Company A needs to export sensitive data from its financial system to company B's database, using company B's API in an automated manner. Company A's policy prohibits the use of any intermediary…
The correct answer is A. Company A must install an SSL tunneling service on the financial system. The constraints are: (1) no intermediary systems - transfer must be direct, (2) Company A's financial system does not natively support encryption, (3) Company B's API supports encryption. Option A - installing an SSL tunneling service (e.g., stunnel) on Company A's financial…
Question
Company A needs to export sensitive data from its financial system to company B's database, using company B's API in an automated manner. Company A's policy prohibits the use of any intermediary external systems to transfer or store its sensitive data, therefore the transfer must occur directly between company A's financial system and company B's destination server using the supplied API. Additionally, company A's legacy financial software does not support encryption, while company B's API supports encryption. Which of the following will provide end-to-end encryption for the data transfer while adhering to these requirements?
Options
- ACompany A must install an SSL tunneling service on the financial system.
- BCompany A's security administrator should use an HTTPS capable browser to transfer the data.
- CCompany A should use a dedicated MPLS circuit to transfer the sensitive data to company B.
- DCompany A and B must create a site-to-site IPSec VPN on their respective firewalls.
How the community answered
(45 responses)- A58% (26)
- B9% (4)
- C22% (10)
- D11% (5)
Explanation
The constraints are: (1) no intermediary systems - transfer must be direct, (2) Company A's financial system does not natively support encryption, (3) Company B's API supports encryption. Option A - installing an SSL tunneling service (e.g., stunnel) on Company A's financial system - wraps the unencrypted output of the legacy application in an SSL/TLS tunnel before it leaves the host. The tunnel terminates at Company B's API server, providing true end-to-end encryption originating directly from the financial system without an intermediary. Option B (HTTPS browser) is manual and not automated. Option C (MPLS) provides network isolation but not encryption - data is transmitted in cleartext over the dedicated circuit. Option D (site-to-site IPSec VPN) encrypts traffic between the two organizations' firewalls/gateways, but the data travels unencrypted inside each organization's internal network segment before reaching or after leaving the VPN endpoint - it does not provide end-to-end encryption from the financial application itself.
Topics
Community Discussion
No community discussion yet for this question.