Volume encryption on storage protects PHI and PII at rest while the server still reboots unattended
Short answer
D Volume encryption on the storage protects the PHI and PII at rest and still lets the server reboot for patching without manual intervention.
Question
Key Takeaways
Volume encryption secures data at rest below the guest OS, so it needs no VM-level encryption support and no per-boot passphrase entry, satisfying both constraints in one control.
A database server holding PHI and PII is unencrypted, the environment offers no VM encryption and no key management system, and the server must reboot for patching without manual intervention. Enabling volume encryption on the storage encrypts data at rest independently of the VM and unlocks automatically at boot through the storage layer.
Common mistake: OS encryption (E) looks equivalent but typically demands a pin or passphrase during boot, which breaks the unattended patching requirement that rules it out.
Expert Analysis
Why the Answer Is Correct
Volume encryption applied at the storage layer encrypts the blocks holding the database regardless of guest OS support, so it works even where VM encryption and a KMS are unavailable. Because decryption is handled by the storage platform on attachment, the server can power cycle for patching with no human present. It directly fixes the reported exposure: the PHI and PII at rest become unreadable to anyone who obtains the underlying storage.
Why the Other Options Are Wrong
A, encrypting database queries, protects data only while in use on a connection and leaves the stored files exposed. B, an IPSec tunnel to clients, is transport security and likewise does nothing for data at rest on the server. C, protocol encryption between storage and hypervisor, guards one wire segment, not the stored data itself. E, OS encryption, would protect the volume but generally requires a pin or key entry at every boot, defeating the unattended patching requirement stated in the scenario.
Community Comment Notes
Pisces225 identifies the core logic that volume encryption protects data at rest without touching the VM or its OS, and notes IPSec belongs to in-transit protection. FasterN8 supplies the decisive contrast between D and E: OS encryption usually requires a pin before boot completes, which is exactly the manual intervention the scenario forbids. FrancisDrake finds the option set mismatched but raises no workable alternative.
Official Reference
https://csrc.nist.gov/pubs/sp/800/111/final
This link opens the official vendor documentation in a new tab.
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Pisces225 👍 4 Answered DEncrypts our data at rest which doesn't touch the VMs, the VM's OSs, but you'd include IPSec for in transit encryption as well. Fairly obvious they want D here though.
-
FrancisDrake 👍 2The solutions don't match the scenario. Maybe someone can enlighten me.
-
FasterN8 👍 1 Answered DBoth D and E provide the encryption needed to protect the data, but OS encryption will generally require a pin before it will complete booting = manual intervention.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.