Volume encryption on storage protects PHI and PII at rest while the server still reboots unattended
Given a scenario, apply data security and compliance controls in cloud environments.
AnswerCorrect answer: D — Volume encryption on the storage protects the PHI and PII at rest and still lets the server reboot for patching without manual intervention.
A systems administrator is informed that a database server containing PHI and PII is unencrypted. The environment does not support VM encryption, nor does it have a key management system. The server needs to be able to be rebooted for patching without manual intervention. Which of the following will BEST resolve this issue?
Ensure all database queries are encrypted.
Create an IPSec tunnel between the database server and its clients.
Enable protocol encryption between the storage and the hypervisor.
Enable volume encryption on the storage. Correct Answer
100% of anonymous learners picked answer D.
Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Volume encryption secures data at rest below the guest OS, so it needs no VM-level encryption support and no per-boot passphrase entry, satisfying both constraints in one control.
A database server holding PHI and PII is unencrypted, the environment offers no VM encryption and no key management system, and the server must reboot for patching without manual intervention. Enabling volume encryption on the storage encrypts data at rest independently of the VM and unlocks automatically at boot through the storage layer.
OS encryption (E) looks equivalent but typically demands a pin or passphrase during boot, which breaks the unattended patching requirement that rules it out.
Community Discussion (3 comments)
Pisces225👍 4Selected: D
Encrypts our data at rest which doesn't touch the VMs, the VM's OSs, but you'd include IPSec for in transit encryption as well. Fairly obvious they want D here though.
FasterN8👍 1Selected: D
Both D and E provide the encryption needed to protect the data, but OS encryption will generally require a pin before it will complete booting = manual intervention.
FrancisDrake👍 2
The solutions don't match the scenario. Maybe someone can enlighten me.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Log in to comment, report an error, or add a note about this question.
Expert Analysis
Why the Answer Is Correct
Volume encryption applied at the storage layer encrypts the blocks holding the database regardless of guest OS support, so it works even where VM encryption and a KMS are unavailable. Because decryption is handled by the storage platform on attachment, the server can power cycle for patching with no human present. It directly fixes the reported exposure: the PHI and PII at rest become unreadable to anyone who obtains the underlying storage.
Why the Other Options Are Wrong
A, encrypting database queries, protects data only while in use on a connection and leaves the stored files exposed. B, an IPSec tunnel to clients, is transport security and likewise does nothing for data at rest on the server. C, protocol encryption between storage and hypervisor, guards one wire segment, not the stored data itself. E, OS encryption, would protect the volume but generally requires a pin or key entry at every boot, defeating the unattended patching requirement stated in the scenario.
Community Comment Notes
Pisces225 identifies the core logic that volume encryption protects data at rest without touching the VM or its OS, and notes IPSec belongs to in-transit protection. FasterN8 supplies the decisive contrast between D and E: OS encryption usually requires a pin before boot completes, which is exactly the manual intervention the scenario forbids. FrancisDrake finds the option set mismatched but raises no workable alternative.