I85PREP
⌘ K
DMCP study materials
DMCP study resources

DMCP: Security and Compliance

DMCP · Work through your exam, one topic at a time.

All guide sections

Security and Compliance

Security and Compliance tests whether you can design controls that are enforceable and auditable: identity and least privilege, encryption with genuine key separation, segmentation that reduces audit scope, and the evidence trail an assessor will ask for.

Core rules

  • Least privilege and RBAC: named accounts, roles scoped to an object (array, cluster, folder), MFA on administrative paths, and no shared local administrator accounts.
  • Encryption at rest needs key management independent of the data. Self-encrypting drives plus an external KMIP key manager are the pattern; if the key server runs on the array it protects, compromise of the array yields the keys. Encryption in transit means TLS for management and IPsec or equivalent for replication links.
  • Scope reduction is the cheapest compliance win: place regulated data in a segmented zone with a documented boundary and the audit scope shrinks from the whole estate to that zone.
  • Logging: ship audit logs off-box to append-only or WORM storage, keep clocks synchronised, and set retention to match the regulation.
  • Hardening baselines (CIS or vendor) plus vulnerability management with a risk-based patch cadence. Compliance is evidence and security is posture; one does not imply the other.

Worked example

A regulated estate of 500 servers must cut audit scope. The 40 servers that store or transmit cardholder data are moved into a dedicated VLAN zone behind a firewall, with an inventory of allowed flows. Scope drops from 500 hosts to 40, and the evidence set becomes the firewall ruleset, the zone diagram, the flow matrix, and quarterly reviews. The reasoning: scope is defined by the boundary and the flows crossing it, so both must be documented - an undocumented boundary is not a boundary.

Traps

  • Encrypting data but storing keys alongside it, or having no documented rotation and recovery process.
  • Assuming replicas, snapshots, and backups fall outside encryption and retention scope.
  • Treating a compliance certificate as proof of security posture.
  • Shared administrative accounts that leave no per-action attribution in logs.
  • Retention shorter than the regulation, or legal hold ignored during decommission.