CAS-002 · Question #656
A security administrator at a Lab Company is required to implement a solution which will provide the highest level of confidentiality possible to all data on the lab network. The current…
The correct answer is B. Transport encryption. The existing architecture already provides data-at-rest protection via full disk encryption, so the missing cryptographic control needed to maximize confidentiality is encryption of data while it moves across the network.
Question
A security administrator at a Lab Company is required to implement a solution which will provide the highest level of confidentiality possible to all data on the lab network. The current infrastructure design includes:
- Two-factor token and biometric based authentication for all users
- Attributable administrator accounts
- Logging of all transactions
- Full disk encryption of all HDDs
- Finely granular access controls to all resources
- Full virtualization of all servers
- The use of LUN masking to segregate SAN data
- Port security on all switches
The network is protected with a firewall implementing ACLs, a NIPS device, and secured wireless access points. Which of the following cryptographic improvements should be made to the current architecture to achieve the stated goals?
Options
- APKI based authorization
- BTransport encryption
- CData at rest encryption
- DCode signing
How the community answered
(27 responses)- A19% (5)
- B67% (18)
- C4% (1)
- D11% (3)
Why each option
The existing architecture already provides data-at-rest protection via full disk encryption, so the missing cryptographic control needed to maximize confidentiality is encryption of data while it moves across the network.
PKI-based authorization primarily addresses identity verification and access control rather than directly encrypting data to provide confidentiality.
Transport encryption - such as TLS - protects data confidentiality as it traverses the network, which is the gap in the described architecture. Since full disk encryption already covers data at rest, adding transport-layer encryption ensures data cannot be intercepted in transit, completing end-to-end confidentiality. Without it, sensitive data could be captured on internal network segments despite all other controls being in place.
Data at rest encryption is already implemented through full disk encryption of all HDDs, making this a redundant addition rather than a new improvement.
Code signing ensures software integrity and authenticity but does not provide confidentiality of data transmitted or stored on the network.
Concept tested: Transport encryption to complement data-at-rest encryption
Source: https://learn.microsoft.com/en-us/windows-server/security/tls/transport-layer-security-protocol
Topics
Community Discussion
No community discussion yet for this question.