Free Preparation Discussions
MENU
VMware 3V0-21.23 Exam - Topic 1 Question 21 Discussion
Topic #: 1
An architect is reviewing the security and compliance requirements for a new application that will be hosted on a vSphere 8 environment.
The following information has been noted about the new application:
The application stores and processes confidential data
The supporting virtual infrastructure is shared with other departments
No other application stores or processes confidential data
The application virtual machines must be able to run on any ESXi host in the cluster
The storage layer is a iSCSI attached SAN
Data at Rest Encryption is in place for each presented LUN validated to FIPS 140-2
No budget is available for additional infrastructure components or software
Application data must not be accessible outside of the application's virtual machines
The architect has been tasked with providing a secure virtual machine design to host the application.
Which three design elements must the architect include to meet the requirements? (Choose three.)
Virtual Machine Encryption
To ensure that the application's confidential data is protected, Virtual Machine Encryption should be applied. This will ensure that even if someone gains access to the storage layer or the underlying infrastructure, the data in the virtual machine is encrypted and cannot be accessed outside of the VM, as required by the security and compliance requirements.
The vSphere Native Key Provider
The vSphere Native Key Provider can be used to manage encryption keys within the vSphere environment. Since no budget is available for additional infrastructure components or software, leveraging vSphere's native capabilities for key management ensures that encryption is securely handled without introducing external dependencies. This also aligns with the requirement to not introduce additional infrastructure.
External Key Management Service (KMS) provider
While the vSphere Native Key Provider can manage keys within the environment, if there is a requirement for a more secure or compliant key management solution, an External Key Management Service (KMS) may be used. The KMS provider allows for centralized management of encryption keys, ensuring that the keys are securely stored and controlled according to compliance standards (e.g., FIPS 140-2). Although the Native Key Provider may suffice, this option ensures that key management adheres to stricter compliance needs, especially for confidential data.
Tyisha
2 days ago