SY0-701 Question 38
Single answerA healthcare company is moving a legacy patient records application to a new environment. The security team must protect data in transit between application servers and database servers, and also limit exposure of highly sensitive fields such as Social Security numbers so that database administrators cannot casually view them in plaintext. The application needs fast encryption for large amounts of data, and the solution should align with current best practices for key exchange and algorithm strength. Which solution BEST meets these requirements?
- A
Use TLS 1.3 between the application and database servers, negotiate session keys through asymmetric key exchange, encrypt the database traffic with AES-256, and use record-level encryption for the Social Security number field
- B
Use RSA alone to encrypt all database sessions and all stored patient data, because asymmetric encryption is more secure than symmetric encryption for bulk data
- C
Enable full-disk encryption on the database server and disable TLS, because disk encryption protects the records regardless of how they are transmitted
- D
Use file-level encryption on exported report files only, because protecting reports provides equivalent protection to encrypting database connections and sensitive records
Show answer and explanation
Correct answer: A
Explanation
The best answer is the layered approach in Option 1. In real environments, different encryption controls address different risks. Transport encryption, such as TLS 1.2 or preferably TLS 1.3, protects data in motion from eavesdropping and tampering. TLS uses asymmetric cryptography for server authentication and key establishment, then uses symmetric session keys for performance. This reflects the practical distinction between asymmetric and symmetric encryption tested on Security+.
For data at rest, encryption level matters. Full-disk, partition, and volume encryption primarily protect storage media, but they do not provide granular protection once the system is running. Database-level encryption can protect the database broadly, but if the requirement is to shield only specific sensitive values from casual access, record-level or field-level encryption is more appropriate. In this scenario, encrypting Social Security numbers at the record level reduces exposure even to privileged users who may otherwise have broad database access.
Regarding algorithms and key length, AES with 256-bit keys is widely accepted as a strong symmetric standard, while RSA or elliptic-curve methods are commonly used in key exchange and authentication rather than bulk data encryption. NIST guidance and common vendor best practices consistently recommend using approved, modern protocols and ciphers, such as TLS 1.2/1.3 and AES, while avoiding misuse of asymmetric encryption for large-volume data protection.
- A. Correct.
Correct. This option combines the appropriate encryption layers for the scenario. TLS 1.3 protects data in transit between the application and database servers. In modern TLS, asymmetric cryptography is used for authentication and key exchange, after which symmetric session keys are used for efficient bulk encryption. AES-256 is a strong symmetric algorithm commonly used for transport sessions and stored data protections. Record-level encryption is appropriate when only specific highly sensitive fields, such as Social Security numbers, require additional protection from unauthorized viewing, including by some administrators. This approach balances performance, confidentiality, and granular access control.
- B. Incorrect.
Incorrect. RSA and other asymmetric algorithms are not typically used to encrypt all bulk application traffic or all stored data directly because they are computationally inefficient compared with symmetric algorithms. A common misconception is that asymmetric encryption is simply 'more secure' and should replace symmetric encryption everywhere. In practice, asymmetric cryptography is generally used for authentication, digital signatures, and key exchange, while symmetric encryption such as AES is used for large data volumes.
- C. Incorrect.
Incorrect. Full-disk encryption protects data at rest on the storage device, especially if drives are lost or stolen, but it does not protect data in transit over the network. Once the database server is running and the disk is unlocked, an authorized process or administrator may still access plaintext data. Disabling TLS would leave application-to-database communications exposed to interception. This option confuses at-rest encryption with transport encryption.
- D. Incorrect.
Incorrect. File-level encryption on exported reports can help protect a specific subset of data at rest, but it does not secure live client/server database traffic and does not provide granular protection for sensitive fields inside the active database. This is a plausible but incomplete control that addresses only a narrow use case rather than the stated end-to-end requirement.