Which drive type includes an encryption circuit built into the hardware?

Which drive type includes an encryption circuit built into the hardware?

• A. A configuration that uses software encryption only.
• B. Self-Encrypting Drive (SED) is a HDD or SSD with an encryption circuit built into the drive.
• C. A cloud-based key management service.
• D. A hardware module that stores firmware.

Answer: (B)

Hardware-embedded encryption inside a storage device ensures data at rest is protected by an on-drive encryption engine. A Self-Encrypting Drive has a dedicated encryption processor built into the drive itself; it automatically encrypts data as it’s written and decrypts it as it’s read, with the keys stored securely on the drive. This means the encryption happens transparently and independent of the host system, so even if the drive is removed or accessed by an untrusted machine, the data remains protected because the keys never leave the drive. Software-only encryption relies on the host CPU and stores keys in software memory, which is not the same as having an encryption circuit on the drive. A cloud-based key management service isn’t a drive feature at all, and a hardware module that stores firmware isn’t describing encryption capabilities.

Hardware-embedded encryption inside a storage device ensures data at rest is protected by an on-drive encryption engine. A Self-Encrypting Drive has a dedicated encryption processor built into the drive itself; it automatically encrypts data as it’s written and decrypts it as it’s read, with the keys stored securely on the drive. This means the encryption happens transparently and independent of the host system, so even if the drive is removed or accessed by an untrusted machine, the data remains protected because the keys never leave the drive.

Software-only encryption relies on the host CPU and stores keys in software memory, which is not the same as having an encryption circuit on the drive. A cloud-based key management service isn’t a drive feature at all, and a hardware module that stores firmware isn’t describing encryption capabilities.