Explain encryption at rest vs encryption in transit, and why both are necessary for data protection.

• A. Encryption at rest protects data stored on disks, while encryption in transit protects data as it moves over networks. Both are needed.
• B. Encryption at rest is the same as encryption in transit.
• C. Encryption in transit encrypts data only at rest.
• D. Encryption is optional for both states.

Answer: (A)

Data protection happens in two states: at rest and in transit. Encryption at rest secures data that is stored on disks, databases, backups, or other storage, so that even if someone gains physical access to the storage or the storage is stolen, the data remains unreadable without the decryption keys. Encryption in transit protects data as it moves across networks—between clients and servers or between services—so that eavesdroppers, tampering, or impersonation on the communication channel can’t expose or alter the information.

Both are necessary because data can be exposed in different stages. Even with encrypted storage, data can be decrypted when accessed by authorized systems, or keys could be compromised, and storage devices can be lost or stolen. Conversely, data in transit can be secured, but once it reaches its destination, it may be stored, possibly unencrypted, unless additional at-rest protection is in place. Together, they provide protection across the data’s lifecycle, addressing threats that occur both while data sits on storage and while it traverses networks.

The other options aren’t accurate because encryption at rest and encryption in transit are distinct protections for different states of data, encryption in transit is not about data at rest, and encryption is not universally optional in modern environments.