SY0-701 Question 222
Single answerData states: Data at rest , Data in transit , Data in useA healthcare organization stores patient records in a cloud-hosted database, allows clinicians to access the records through a web application, and processes the records in server memory while generating treatment recommendations. During a security review, the organization wants to verify that it is applying appropriate protections to each data state. Which of the following controls BEST maps to protecting data at rest, data in transit, and data in use, respectively?
- A
Full-disk or database encryption for stored records, TLS for browser-to-application sessions, and memory protection techniques such as process isolation or confidential computing for active processing
- B
TLS for stored records, hashing for browser-to-application sessions, and full-disk encryption for data being processed in server memory
- C
Database access control lists for stored records, VPN tunneling for browser sessions, and RAID for active processing
- D
Tokenization for stored records, digital signatures for browser-to-application sessions, and data classification labels for active processing
Show answer and explanation
Correct answer: A
Explanation
Security+ expects candidates to distinguish among the three data states and apply the appropriate control to each. Data at rest refers to data stored on disk, SSD, backup media, or databases, and common best practices include full-disk encryption, file-level encryption, or database encryption. Data in transit refers to data moving across networks, where TLS, IPsec, or VPN technologies are commonly used to preserve confidentiality and integrity. Data in use refers to data actively being processed in memory, registers, or CPU caches; this is harder to protect, so approaches include process isolation, privileged access controls, application hardening, and emerging technologies such as trusted execution environments or confidential computing. This mapping is consistent with widely accepted guidance from NIST, including data protection practices discussed across publications such as NIST SP 800-57 for cryptographic key management concepts and NIST SP 800-111 for storage encryption guidance.
- A. Correct.
Correct. This option properly aligns controls to the three data states. Data at rest is protected with storage-focused encryption such as full-disk encryption or database encryption. Data in transit is protected with transport encryption such as TLS between the browser and the application. Data in use refers to information being actively processed in memory or by the CPU, so protections such as process isolation, secure enclaves, or confidential computing are the best fit.
- B. Incorrect.
Incorrect. TLS is used to protect data in transit, not stored data at rest. Hashing is not the primary control for protecting confidentiality of browser sessions because hashes are one-way and do not provide encrypted communication. Full-disk encryption protects storage media, not data currently being processed in RAM.
- C. Incorrect.
Incorrect. Access control lists help limit who can access stored data, but they do not by themselves provide encryption for data at rest. VPN tunneling can protect data in transit, but the third control is the main issue: RAID improves availability and fault tolerance, not protection of data in use. This option mixes a valid transport control with controls that do not map cleanly to the requested data states.
- D. Incorrect.
Incorrect. Tokenization can reduce exposure of sensitive stored data in some architectures, but it is not the most direct or universal answer for protecting data at rest in this scenario. Digital signatures provide integrity, authenticity, and non-repudiation, but not confidentiality of browser sessions the way TLS does. Data classification labels support governance and handling requirements, but they do not directly protect data while it is actively being processed.