Which statement is true about encryption in transit and encryption at rest?

Which statement is true about encryption in transit and encryption at rest?

• A. They should be used independently.
• B. Encryption in transit protects stored data; encryption at rest protects data in motion.
• C. Both are unnecessary for cloud storage.
• D. They provide complementary protection when used together.

Answer: (D)

Encryption in transit and encryption at rest address different moments when data needs protection. Encryption in transit protects data as it moves across networks, using protocols like TLS to keep information unreadable to anyone who might intercept the stream. Encryption at rest protects data when it’s stored on disks, databases, or backups, so that even if someone gains access to the storage medium, the data remains unreadable without the proper keys. Because data can be exposed either while moving or while stored, using both forms provides defense in depth and keeps data protected in both states. The statement that they work together—complementary protection when used together—is the best fit. Saying encryption in transit protects stored data and encryption at rest protects data in motion swaps their roles, which isn’t accurate. The idea that cloud storage doesn’t need either is unsafe, since both protections help reduce risk in cloud environments. Using them independently also misses the layered security benefit of having multiple protections in place.