CAS-002 · Question #715
The security administrator reports that the physical security of the Ethernet network has been breached, but the fibre channel storage network was not breached. Why might this still concern the…
The correct answer is A. The storage network uses FCoE. B. The storage network uses iSCSI. FCoE and iSCSI both encapsulate storage traffic over the Ethernet network, so a physical breach of Ethernet infrastructure exposes that storage traffic even when the native Fibre Channel fabric is untouched.
Question
The security administrator reports that the physical security of the Ethernet network has been breached, but the fibre channel storage network was not breached. Why might this still concern the storage administrator? (Select TWO).
Options
- AThe storage network uses FCoE.
- BThe storage network uses iSCSI.
- CThe storage network uses vSAN.
- DThe storage network uses switch zoning.
- EThe storage network uses LUN masking.
How the community answered
(24 responses)- A67% (16)
- C21% (5)
- D8% (2)
- E4% (1)
Why each option
FCoE and iSCSI both encapsulate storage traffic over the Ethernet network, so a physical breach of Ethernet infrastructure exposes that storage traffic even when the native Fibre Channel fabric is untouched.
FCoE (Fibre Channel over Ethernet) wraps Fibre Channel frames inside Ethernet frames and transmits them across the Ethernet fabric; any attacker who has breached the physical Ethernet layer can capture or tamper with FCoE storage frames in transit.
iSCSI encapsulates SCSI commands inside IP packets sent over the Ethernet network, meaning a physical breach of the Ethernet segment grants an attacker direct access to iSCSI storage traffic without requiring any compromise of the Fibre Channel SAN.
vSAN is a software-defined, hypervisor-based storage technology that also runs over Ethernet, but it is not a Fibre Channel protocol and was not identified as the storage network in use.
Switch zoning is an access control mechanism native to Fibre Channel switches that restricts host-to-storage visibility; it operates entirely within the FC fabric and is not affected by a breach of the Ethernet network.
LUN masking is enforced at the storage array controller level to restrict which hosts can access specific logical units; it does not operate at the network transport layer and is unaffected by an Ethernet-layer breach.
Concept tested: Ethernet-dependent storage protocols FCoE and iSCSI security risk
Source: https://datatracker.ietf.org/doc/html/rfc3720
Topics
Community Discussion
No community discussion yet for this question.