Which statement correctly describes encryption in transit and at rest?

• A. In transit protects stored data; at rest protects data moving across networks.
• B. In transit protects data moving across networks; at rest protects stored data. Use both as required by data sensitivity and regulatory requirements.
• C. In transit and at rest both protect data only during processing.
• D. In transit protects data at rest and in transit not needed.

Answer: (B)

Encryption serves two distinct moments in the data lifecycle: when data is moving and when it is stored. Encryption in transit protects data as it travels across networks, using protocols like TLS to prevent anyone who intercepts the traffic from reading it. Encryption at rest protects data that is stored on disks, databases, or backup media, ensuring that someone who gains physical access to the storage cannot read the data without the proper keys. Because data often moves between systems and then sits in storage, you typically implement both protections, choosing the level of protection based on how sensitive the data is and any regulatory requirements. For example, you’d encrypt data in transit (to protect it during transmission) and encrypt stored data (to protect it when at rest) and manage keys securely to enforce access controls.