100-160 Question 45
Select 2A cybersecurity analyst is tasked with ensuring the security of sensitive data stored in a database. The data is at rest and will also need to be securely transmitted to another system. Which of the following methods should the analyst implement to protect the data in both states?
- A
Encrypt the data at rest using AES-256
- B
Use a hashing algorithm like SHA-256 to encrypt the data
- C
Establish a TLS connection to encrypt the data in transit
- D
Utilize a self-signed certificate for the secure transmission
- E
Encrypt the data at rest using DES
Show answer and explanation
Correct answers: A, C
Explanation
Encrypting data at rest using AES-256 ensures strong protection against unauthorized access to stored data. For data in transit, using TLS establishes a secure channel that encrypts the data as it moves between systems. These methods provide effective encryption for both states of data, meeting the security requirements while avoiding weak algorithms like DES or improper methods like hashing.
- A. Correct.
AES-256 is a strong symmetric encryption algorithm widely used for securing data at rest due to its high level of security and efficiency.
- B. Incorrect.
Hashing algorithms like SHA-256 are designed for integrity verification, not encryption. They cannot be used to encrypt data.
- C. Correct.
TLS (Transport Layer Security) is a protocol specifically designed to encrypt data in transit, ensuring confidentiality and integrity during transmission.
- D. Incorrect.
While self-signed certificates can be used, they are not considered as secure as certificates issued by a trusted Certificate Authority (CA), and they are not recommended for production environments.
- E. Incorrect.
DES (Data Encryption Standard) is an outdated encryption algorithm with known vulnerabilities, making it unsuitable for protecting sensitive data.