Question 1
IntermediateCustomer Requirements · Requirements Gathering and Stakeholder Engagement
During a requirements gathering workshop for a financial institution, the CISO states that all data at rest must be encrypted using FIPS 140-2 validated modules. The Infrastructure Director mentions that the current storage array does not support native encryption but cannot be replaced due to budget constraints. How should this requirement be classified in the design documentation?
Answer and explanation
Correct answer: A
This situation represents a conflict between a business requirement (encryption) and a constraint (budget/legacy hardware). In VCDX methodology, the inability to replace hardware is a hard constraint. The design must satisfy the requirement within this constraint, likely by implementing vSphere VM Encryption or Guest OS encryption, rather than array-based encryption.
