A cybersecurity team is building a cloud-based storage system in a multinational corporation. Which approaches should be undertaken in line with the concept of "data at rest" to protect sensitive…

Question

Options

• AFocus primarily on encrypting data transfers between global locations, using high-standard encryption protocols like SSL/TLS, which are in line with multiple global jurisdictions.
• BEnforce strict role-based access control systems for data in use, tailored to comply with the most stringent international data protection standards, and conduct regular internal audits.
• CImplement encryption standards like AES-256 for all stored data, conduct frequent key rotations, and use compliance measures adhering to the relevant local data protection laws.
• DSegment data of each country into its own separate storage in line with GDPR and encrypt it using AES-4096, rotate keys frequently, and ensure every company employee can access it.

• A
  11% (7)
• B
  7% (4)
• C
  80% (49)
• D
  2% (1)

Explanation

Option C directly addresses data at rest - the specific state in question - by applying AES-256 encryption to stored data, combining it with key rotation to limit exposure if a key is compromised, and adapting compliance measures jurisdiction by jurisdiction, which is exactly what a multinational deployment requires.

Why the distractors fail:

• A targets data in transit (SSL/TLS secures network transfers), not data sitting in storage - a classic misdirection that tests whether you know the three data states.
• B focuses on data in use (role-based access controls and audits govern who can work with data), which is a valid security layer but an entirely different protection domain than encryption at rest.
• D contains two fatal flaws: AES-4096 does not exist (AES only supports 128, 192, and 256-bit key sizes), and granting access to "every company employee" violates the principle of least privilege, creating a massive insider-threat risk.

Memory tip: Map the three data states to physical analogies - in transit = mail in a truck (TLS/SSL), in use = letter open on a desk (access controls), at rest = letter locked in a vault (AES-256). Any question mentioning "stored data" or "cloud storage" is almost always asking about the vault.

No community discussion yet for this question.