SY0-701 Question 223
Single answerData states: Data at rest , Data in transit , Data in useA healthcare organization is updating its security controls after an audit found gaps in how patient records are protected across their lifecycle. The environment includes a database storing records on encrypted SSDs, a web application that sends records to remote clinics over HTTPS, and an analytics server where records are decrypted in memory for processing. The security manager wants to ensure the team correctly identifies the primary data state being protected by each control before approving additional safeguards. Which of the following pairings is MOST accurate?
- A
Full-disk encryption on the database server protects data at rest; TLS on the web application protects data in transit; memory protection on the analytics server addresses data in use.
- B
Full-disk encryption on the database server protects data in transit; TLS on the web application protects data in use; memory protection on the analytics server addresses data at rest.
- C
Full-disk encryption on the database server protects data in use; TLS on the web application protects data at rest; memory protection on the analytics server addresses data in transit.
- D
Full-disk encryption on the database server protects all three data states equally; TLS and memory protection are only performance optimizations.
Show answer and explanation
Correct answer: A
Explanation
Security professionals must distinguish between data at rest, data in transit, and data in use because each state is exposed to different threats and requires different controls. Data at rest refers to information stored on media such as SSDs, databases, file servers, backups, and removable storage; common protections include full-disk encryption, file-level encryption, access controls, and key management. Data in transit refers to information moving across networks; common protections include TLS, IPsec, SSH, and secure VPNs. Data in use refers to information being actively processed, often in memory or by running applications; protections may include process isolation, memory protection features, privileged access controls, application hardening, and, in some environments, confidential computing technologies. This aligns with common guidance from NIST on data protection and transport security, including NIST SP 800-111 for storage encryption and NIST guidance on TLS such as SP 800-52. For Security+, candidates should be able to map a control to the correct data state in realistic operational scenarios.
- A. Correct.
Correct. Full-disk encryption is primarily used to protect stored information on drives, which is data at rest. TLS protects data while it is moving between systems, which is data in transit. Memory protection technologies and process isolation help reduce exposure of decrypted information while it is actively being processed, which is data in use. This mapping reflects standard Security+ expectations for identifying controls by data state.
- B. Incorrect.
Incorrect. This option reverses the data states. Full-disk encryption does not primarily protect data in transit; it protects stored data on physical or virtual disks. TLS does not protect data in use because it secures communications channels, not active processing in memory. Memory protection does not address data at rest because RAM is associated with active use rather than long-term storage.
- C. Incorrect.
Incorrect. This option misclassifies each control. Full-disk encryption does not primarily secure data in use, because once the operating system decrypts data for access, it is no longer protected by disk encryption alone. TLS does not protect data at rest; it secures sessions across networks. Memory protection is not a control for data in transit, because it is focused on active processes and system memory.
- D. Incorrect.
Incorrect. No single control protects all data states equally. Full-disk encryption is important, but it does not replace network encryption or protections for data being processed in memory. TLS and memory protection are security controls, not merely performance optimizations. This distractor reflects a common misconception that encrypting storage alone is sufficient for comprehensive data protection.