N10-009 Question 246
Single answerLogical security: Encryption (Data in transit, Data at rest), Certificates (Public key infrastructure (PKI), Self-signed)A company is rolling out a new internal web application that employees will access from laptops on the corporate network and through a VPN when working remotely. The security team has two requirements: users must not receive browser certificate warnings, and sensitive customer records stored on the application server's drives must remain protected if the physical disks are stolen. Which solution best meets both requirements?
- A
Install a self-signed certificate on the web server and require HTTPS for remote users only
- B
Use a certificate issued by the company's internal PKI for the web server and enable full-disk encryption on the application server
- C
Use HTTP internally and a public CA certificate only for VPN users; protect the stored records with RAID
- D
Deploy a wildcard self-signed certificate to all clients manually and rely on NTFS permissions to protect the server's disks
Show answer and explanation
Correct answer: B
Explanation
The scenario requires protection for both data in transit and data at rest. For data in transit, HTTPS should be used for all access to the internal web application, not just remote access. To avoid certificate warnings, the server certificate must chain to a trusted certificate authority. In an enterprise environment, an internal PKI is a common and valid solution because corporate-managed devices can trust the internal CA automatically. Self-signed certificates are generally suitable only for limited testing or tightly controlled environments because they are not inherently trusted by clients. For data at rest, full-disk encryption is the appropriate control because it protects the contents of the server's drives if they are removed or stolen. This aligns with common security best practices from enterprise PKI guidance and platform encryption recommendations, such as using trusted CA-issued certificates for TLS and using disk encryption technologies to protect stored data.
- A. Incorrect.
This does not fully meet the requirements. A self-signed certificate will typically generate browser trust warnings unless every client is manually configured to trust it, which does not align well with the requirement that users must not receive certificate warnings. Also, requiring HTTPS only for remote users leaves internal traffic unencrypted, so data in transit is not consistently protected on the corporate network.
- B. Correct.
This is the best answer. A certificate issued by the company's internal PKI can be trusted automatically by domain-joined corporate devices when the internal root CA is distributed through standard enterprise management, preventing browser warnings. Enabling full-disk encryption protects data at rest, helping ensure that customer records are not readable if the server's physical drives are stolen. This combination addresses both certificate trust for data in transit and encryption for data at rest.
- C. Incorrect.
This is incorrect because HTTP internally leaves application traffic unencrypted on the local network, which is a poor security practice for sensitive customer data. In addition, RAID improves availability and performance but does not provide encryption or confidentiality for stored data. A public CA certificate for VPN users does not solve the lack of encryption for internal web access.
- D. Incorrect.
This is incorrect for two reasons. First, a self-signed certificate is not the same as a certificate issued by a trusted PKI hierarchy; manually distributing trust can work in limited cases but is more error-prone and less scalable, and the wording does not guarantee all systems will trust it without warnings. Second, NTFS permissions control logical access for authorized operating system users, but they do not protect data if someone steals the physical disks and accesses the contents offline.