How should data classified as Confidential be protected both in transit and at rest?

• A. Encrypt data in transit with TLS 1.2+, encrypt data at rest, enforce strict access controls and key management.
• B. Keep all data in plaintext for speed.
• C. Only encrypt data at rest.
• D. Use antivirus software only.

Answer: (C)

Data confidentiality is best protected by guarding information both as it moves and while it’s stored. Encrypting data in transit with TLS 1.2+ prevents eavesdropping and tampering as it travels between systems, while encrypting data at rest protects stored information from unauthorized access if storage is breached. When you also enforce strict access controls and robust key management, only authorized parties can decrypt and use the data, no matter whether it’s moving or resting. Relying on plaintext or on protection for only one state leaves confidentiality exposed, and antivirus software alone doesn’t address the need to protect the actual content of the data.