I85PREP
⌘ K
Dell DCA-ISM study materials
Dell DCA-ISM study resources

Dell DCA-ISM: Storage Security and Data Protection

Dell DCA-ISM · Work through your exam, one topic at a time.

All guide sections

Storage Security and Data Protection

Security questions test control placement: which control protects which asset, where encryption terminates, and who holds the key.

Principles and identity

  • Confidentiality, integrity and availability drive every control. Least privilege, separation of duties and defence in depth are the operating rules.
  • Administrative control: role-based access control on the array, integration with AD or LDAP for authentication, MFA for privileged accounts, and audit logging forwarded to syslog or a SIEM so array actions are attributable.

Encryption and key management

  • Data at rest: controller-based data-at-rest encryption on the array, or self-encrypting drives validated to FIPS 140-2. The key differentiator is where the key lives; an external key manager over KMIP keeps keys off the array, so a stolen enclosure yields nothing.
  • Data in flight: FC-SP with DH-CHAP for the fabric, IPsec for iSCSI, TLS for management, S3 and REST, SSH for CLI, and SMB signing or encryption for file traffic.
  • Key lifecycle is generation, rotation, escrow and revocation. Losing the key loses the data, which is the design intent behind crypto erase.

SAN access controls

  • Fabric zoning isolates which ports can talk; LUN masking on the array hides volumes from unauthorized initiators; iSCSI adds CHAP and port binding. Zoning and masking are complementary, never substitutes.

Data protection and compliance

  • Retention lock in governance mode can be overridden by a privileged user with audit; compliance mode cannot be shortened even by an administrator. WORM serves the same regulatory need.
  • Secure erase, crypto erase and NIST 800-88 sanitization govern decommissioning. Cyber Recovery vaults add an air gap and analytics to detect anomalous deletion patterns typical of ransomware.
  • Regulations: GDPR for personal data and erasure rights, HIPAA for health data, PCI-DSS for cardholder data, SOX for financial records.

Worked example

Forty 10 TB self-encrypting drives leave service. Overwriting one drive at 150 MB/s takes about 10,000,000 MB divided by 150, roughly 66,700 seconds, or 18.5 hours; across eight bays in five rounds that is around four days of secure erase work. Crypto erase destroys the media encryption key, rendering every block unreadable in minutes, and is the operational reason to deploy SEDs or external-key encryption.

Traps that cost marks

  • Mixing up zoning (fabric) and LUN masking (array).
  • Deploying array-managed encryption keys, then expecting protection from an administrator with array access.
  • Assuming compliance-mode retention lock can be undone by an admin.