A thief has broken into the CEO's car and stolen the executive laptop. The criminal is currently running it with forward-facing dawn shop. The machine is encrypted, backed up, and was powered down…

Question

Options

• AData at Rest
• BData in Use
• CData Loss
• DData in Motion

• A
  87% (26)
• B
  7% (2)
• C
  3% (1)
• D
  3% (1)

Explanation

Data at Rest is correct because the laptop was powered down at the time of theft, meaning the data sits idle on the storage medium - not being processed or transmitted. Even though the machine is now running at a pawn shop, the question anchors the classification to the state at the time of the incident, and in threat modeling the initial threat vector is assessed against the data's state when compromised.

Why the distractors are wrong:

• B (Data in Use) requires data to be actively loaded into memory and processed by a running system - the laptop was off when stolen, so no active processing was occurring at the point of compromise.
• C (Data Loss) is an outcome or risk category, not a data classification - it describes what could happen, not the state of the data.
• D (Data in Motion) applies to data being transmitted across a network; the laptop was offline and powered down, so no data was in transit.

Memory tip: Think of the three states as a traffic analogy - at rest = parked car, in motion = car on the highway, in use = car engine running in a garage. A powered-down stolen laptop is the parked car: it's going nowhere and doing nothing, so the data is at rest.

No community discussion yet for this question.