112-51 · Question #68
Mark, a network administrator in an organization, was assigned the task of preventing data from falling into the wrong hands. In this process, Mark implemented authentication techniques and…
The correct answer is A. Data in use. The state in which Mark encrypted the data in the above scenario is data in use. Data in use refers to data that is being processed or manipulated by an application or a system, such as data stored on RAM or CPU registers. Data in use is the most vulnerable state of data, as it…
Question
Mark, a network administrator in an organization, was assigned the task of preventing data from falling into the wrong hands. In this process, Mark implemented authentication techniques and performed full memory encryption for the data stored on RAM. In which of the following states has Steve encrypted the data in the above scenario?
Options
- AData in use
- BData in transit
- CData inactive
- DData in rest
How the community answered
(25 responses)- A92% (23)
- C4% (1)
- D4% (1)
Explanation
The state in which Mark encrypted the data in the above scenario is data in use. Data in use refers to data that is being processed or manipulated by an application or a system, such as data stored on RAM or CPU registers. Data in use is the most vulnerable state of data, as it is exposed to various threats, such as memory scraping, buffer overflow, or side-channel attacks, that can compromise the confidentiality, integrity, or availability of the data. Data in use encryption is a technique that protects the data while it is being processed by encrypting it in memory using hardware or software solutions. Data in use encryption prevents unauthorized access or modification of the data, even if the system is compromised or the memory is dumped. Data in use encryption is one of the three types of data encryption, along with data at rest encryption and data in transit encryption.
Topics
Community Discussion
9
Prof. SaraFeb 4, 2026The correct answer is A, Data in use. Data in use refers to information actively loaded into volatile memory, meaning RAM, and being processed by the CPU, so any encryption targeting RAM content, such as full memory encryption schemes like Intel TME or AMD SME, is specifically designed to protect data in this state. A clean way to remember the three states is the mnemonic R-T-U: Rest is on disk, Transit is on the wire, and Use is in RAM. This domain maps directly to EC-Council CND Blueprint Domain 4 on data security, where candidates are expected to distinguish encryption controls by the state they address, not just the technology used.
Toby R.Feb 5, 2026Good breakdown, and worth adding that data in use also covers CPU registers and cache, not just RAM, so the "in RAM" framing is close but slightly undersells the scope of what TME and SME actually protect.
Arvydas C.Dec 30, 2025Honestly I initially marked D because "full memory encryption" sounds like a storage-at-rest control, but then I caught myself, RAM holds data actively being processed by running applications, which puts it squarely in the "data in use" category alongside CPU registers and cache. Authentication techniques layered on top further confirm this is about protecting data during active processing, not while it sits idle on disk.
Prof. SaraJan 1, 2026Solid self-correction, and the exam trap here is worth naming explicitly: the word "encryption" primes students to think "at rest," so blueprint writers use that exact vocabulary to test whether you anchor on the protection mechanism or on the data state, and state is always determined by what the data is doing, not what is protecting it.
Toby R.Jan 21, 2026Thought D at first, but RAM means active processing, so data in use.
Wesley A.Jan 23, 2026RAM holds the working set but the exam loves to catch you on the distinction between data "in use" right now versus data "in transit," so make sure you are not conflating volatile storage with network transmission scenarios they sometimes sneak in nearby.
Wesley A.Jan 13, 2026RAM encryption is the dead giveaway here. Data in use means the data is actively loaded into memory and being processed, and full memory encryption (think AMD SME or Intel TME) is the textbook control for that state. The tricky part is that D looks tempting because "stored on RAM" sounds like storage, but RAM is volatile working memory, not persistent rest storage like a hard drive or SSD. Also ignore the name swap in the question, they say Mark was assigned the task but then ask what Steve encrypted, which is just sloppy question writing, so do not let that throw you. The answer is A.
Hiroshi T.Jan 28, 2026I keep seeing people jump to A here but look at what the scenario actually describes. The RAM content being encrypted is not actively being processed or computed upon, it is sitting in memory waiting, which places it squarely in the inactive state, not the in-use state. The 112-51 blueprint distinguishes data in use as data being actively read or modified by a running CPU operation, whereas data that is resident in memory but idle maps to the inactive classification. Full memory encryption applied at the storage layer of RAM, without an active compute thread touching that data, is the textbook definition of protecting data inactive, and that framing lines up with what EC-Council documents as the three-state model in their official courseware.
Arvydas C.Jan 29, 2026Hiroshi, the three-state model places data in RAM under "data in use" regardless of whether a CPU thread is actively touching it at that exact moment, because it is loaded into volatile memory and available for immediate processing, which EC-Council's own courseware distinguishes from data at rest on persistent storage. Encrypting RAM content addresses that in-use state, making A the correct answer here.