GCFA · Question #308
You work as a Network Administrator for Blue Well Inc. Your company's network has a Windows 2000 server with the FAT file system. This server stores sensitive data. You want to encrypt this data to…
The correct answer is A. File-level security will be available on the disk where data is stored. B. Data will be encrypted and secure. D. Other permissions on encrypted files will remain unaffected. Converting FAT to NTFS and applying an encryption solution achieves three of the six stated goals. The goals of minimizing administrative effort and removing encryption responsibility from the file owner are not met by the described steps.
Question
You work as a Network Administrator for Blue Well Inc. Your company's network has a Windows 2000 server with the FAT file system. This server stores sensitive data. You want to encrypt this data to protect it from unauthorized access. You also have to accomplish the following goals:
- Datashould be encrypted and secure.
- Administrative effort should be minimum.
- You should have the ability to recover encrypted filesin case the file owner leaves the company.
- Other permissionson encrypted filesshould be unaffected.
- File-level security is required on the disk where data is stored. Encryption or decryption of filesshould
not be the responsibility of the file owner. You take the following steps to accomplish these goals:
- Convert the FATfile system to NTFSfile system.
- Use third-party data encryption software.
What will happen after taking these steps? Each correct answer represents a complete solution. Choose all that apply.
Options
- AFile-level security will be available on the disk where data is stored.
- BData will be encrypted and secure.
- CEncryption or decryption of files will no longer be the responsibility of the file owner.
- DOther permissions on encrypted files will remain unaffected.
- EAdministrative effort will be minimum.
How the community answered
(60 responses)- A83% (50)
- C5% (3)
- E12% (7)
Why each option
Converting FAT to NTFS and applying an encryption solution achieves three of the six stated goals. The goals of minimizing administrative effort and removing encryption responsibility from the file owner are not met by the described steps.
Converting from FAT to NTFS is required to enable file-level security through NTFS access control lists; FAT provides no file-level permission model, so this conversion directly satisfies the file-level security requirement.
The encryption step applied after NTFS conversion ensures that sensitive data is cryptographically protected against unauthorized access, satisfying the goal that data be encrypted and secure.
With EFS, encryption and decryption are tied to the file owner's user account and private key - the owner is inherently responsible for the encrypted files, so this goal is not fulfilled by the described steps.
NTFS encryption via EFS does not modify existing NTFS ACL permissions on files - access control entries remain intact alongside the encryption attribute, so other permissions on encrypted files are unaffected.
Using third-party encryption software in addition to the NTFS conversion introduces additional key management, software licensing, and deployment overhead, meaning minimum administrative effort is not achieved.
Concept tested: NTFS conversion and EFS encryption capabilities and limitations
Source: https://learn.microsoft.com/en-us/windows/security/information-protection/encrypting-file-system/encrypting-file-system-overview
Topics
Community Discussion
No community discussion yet for this question.