CompTIA DS0-001 Exam - Topic 1 Question 63 Discussion

The correct answer is D. Envelope encryption. CompTIA DataSys+ describes envelope encryption as a key management and data protection method that combines the efficiency of symmetric encryption with the security and manageability of hierarchical key structures. In this approach, data is first encrypted using a data encryption key (DEK), and then the DEK itself is encrypted (or ''wrapped'') using a key encryption key (KEK), often referred to as a managed root key.

Envelope encryption is widely used in enterprise database systems and cloud platforms because it provides strong security while simplifying key rotation and management. Encrypting large volumes of data directly with a root or master key would be inefficient and risky. Instead, DataSys+ explains that symmetric DEKs are used for fast data encryption, while the root key is used only to protect the DEKs. If a root key must be rotated or compromised, only the wrapped DEKs need to be re-encrypted---not the underlying data.

Option A, asymmetric encryption, uses public and private key pairs but is computationally expensive and not typically used to encrypt large datasets directly. Option B, DEK-based encryption, is incomplete because it describes only the use of data encryption keys and does not account for the additional wrapping layer that defines envelope encryption. Option C, symmetric encryption, correctly describes how data is encrypted but does not include the managed key hierarchy required by the question.

CompTIA DataSys+ emphasizes envelope encryption as a best practice for data-at-rest protection, particularly in environments that require compliance, auditing, and centralized key management. It is commonly implemented using hardware security modules (HSMs) or cloud key management services.

Therefore, the method where data is encrypted with a DEK and then wrapped with a managed root key is envelope encryption, making option D the correct and fully verified answer.