To study for VMware HCI Master Specialist Exam | vSAN认证考试题目学习
70. An administrator notes that the Data-At-Rest Encryption keys have expired.
Which action is needed to resolve this situation?
- A. Add a new Standard Key Provider at the vSAN cluster level
- B. Generate new encryptions keys at the vSAN cluster level
- C. Add an additional KMS at the vCenter server level
- D. Generate new encryptions keys at the vCenter server level
Explaination:
To resolve the situation where Data-At-Rest Encryption keys have expired, the appropriate action would depend on the specific system and configuration you are using. However, based on general practices in managing encryption keys in a virtualized environment like vSAN and vCenter, here are the implications of each option:
A. Add a new Standard Key Provider at the vSAN cluster level: This option involves setting up a new key provider in the vSAN cluster. While this could be a valid approach, it’s more about establishing a new key management solution rather than renewing or replacing expired keys.
B. Generate new encryption keys at the vSAN cluster level: This is likely the most direct approach to resolving expired encryption keys. By generating new keys at the vSAN cluster level, you directly address the issue with the expired keys in the specific environment where they are used.
C. Add an additional KMS (Key Management Server) at the vCenter server level: Adding an additional KMS could provide a new source of encryption keys, but it seems like a broader and more complex approach compared to simply generating new keys. This would be more relevant if the current KMS is inadequate or needs to be replaced.
D. Generate new encryption keys at the vCenter server level: Generating new keys at the vCenter server level might be relevant if the vCenter server manages the encryption keys for the vSAN. However, this depends on whether the vCenter is configured to handle key management for vSAN encryption.
In summary, if the goal is simply to replace expired encryption keys for Data-At-Rest in a vSAN environment, option B (Generate new encryption keys at the vSAN cluster level) would be the most straightforward and relevant choice. However, the best course of action can vary depending on the specific setup and policies of your environment.
- 管理员注意到静态数据加密密钥已经过期。
要解决这个问题需要采取什么行动？
- A. 在vSAN集群级别添加一个新的标准密钥提供商
- B. 在vSAN集群级别生成新的加密密钥
- C. 在vCenter服务器级别添加一个额外的KMS
- D. 在vCenter服务器级别生成新的加密密钥
解释：
为了解决静态数据加密密钥过期的问题，采取的适当行动将取决于您正在使用的特定系统和配置。然而，根据在像vSAN和vCenter这样的虚拟化环境中管理加密密钥的一般做法，这里是每个选项的含义：
A. 在vSAN集群级别添加一个新的标准密钥提供商：这个选项涉及在vSAN集群中设置一个新的密钥提供商。虽然这可能是一个有效的方法，但它更多地是建立一个新的密钥管理解决方案，而不是更新或替换过期密钥。
B. 在vSAN集群级别生成新的加密密钥：这可能是解决过期加密密钥最直接的方法。通过在vSAN集群级别生成新的密钥，您可以直接解决特定环境中使用的过期密钥问题。
C. 在vCenter服务器级别添加一个额外的KMS（密钥管理服务器）：添加一个额外的KMS可能会提供一个新的加密密钥来源，但与简单地生成新密钥相比，这似乎是一个更广泛和更复杂的方法。如果当前的KMS不足或需要被替换，这将更为相关。
D. 在vCenter服务器级别生成新的加密密钥：如果vCenter服务器管理vSAN的加密密钥，那么在vCenter服务器级别生成新密钥可能是相关的。然而，这取决于vCenter是否配置为处理vSAN加密的密钥管理。
总的来说，如果目标仅仅是为vSAN环境中的静态数据替换过期的加密密钥，那么选项B（在vSAN集群级别生成新的加密密钥）将是最直接和相关的选择。然而，最佳行动方案可能会根据您环境的具体设置和政策而有所不同。
