Which of the following is the BEST way to protect Personally Identifiable Information (PII) from being exploited due to vulnerabilities of varying web applications?

Cryptographic storage protects PII at rest in a database or file system but does not protect it while being transmitted over a network through vulnerable web applications.

Full disk encryption secures data stored on physical drives but provides no protection for PII actively transmitted between clients and web applications over a network.

Encrypted communications protocols such as TLS/HTTPS protect PII as it traverses the network between the client and web application, mitigating interception risks that arise from web application vulnerabilities. This control applies universally across all web applications regardless of their individual security posture. It directly addresses the threat of exposure during transmission, which is the primary attack surface for web application vulnerabilities targeting PII.

Security tokens protect the authentication process for logging in but do not encrypt or otherwise protect PII payloads being sent or received by the web application.