350-201 Question 99
Select 3A financial services company wants to enhance its data protection strategy by implementing controls to prevent sensitive information from being leaked or improperly accessed. As a cybersecurity engineer, you are tasked with identifying the appropriate controls for protecting 'data in motion' and 'data at rest.' Which of the following controls should you recommend?
- A
Encrypting sensitive emails with TLS for secure transmission
- B
Implementing endpoint monitoring tools to track user activity
- C
Using full-disk encryption on employee laptops and servers
- D
Deploying a Data Loss Prevention (DLP) solution to monitor email traffic
- E
Encrypting sensitive database records stored on company servers
Show answer and explanation
Correct answers: A, C, E
Explanation
To protect 'data in motion,' encryption during transmission, such as using TLS for secure email communication, is essential. For 'data at rest,' full-disk encryption and encrypting sensitive database records provide robust protection against unauthorized access. These solutions align with cybersecurity best practices for securing sensitive information according to common standards.
- A. Correct.
Encrypting sensitive emails with TLS ensures that data is protected during transmission ('data in motion'). This is a key control to prevent interception of data by unauthorized parties.
- B. Incorrect.
While endpoint monitoring tools are useful for tracking user activity and detecting potential data misuse ('data in use'), they do not directly address the protection of 'data in motion' or 'data at rest.'
- C. Correct.
Using full-disk encryption ensures that data stored on laptops and servers ('data at rest') is protected even if the device is lost or stolen.
- D. Incorrect.
Deploying a DLP solution is primarily designed to monitor and control data leakage, but it does not directly ensure the encryption or protection of 'data in motion' or 'data at rest.'
- E. Correct.
Encrypting sensitive database records ensures that 'data at rest' is secure from unauthorized access, even if the database itself is compromised.