What type of encryption is used to protect sensitive data in transit over a network?

Payload encryption protects the actual data content (e.g., via protocols like IPsec ESP or TLS record layer), while transport encryption secures the communication channel itself (e.g., TLS/SSL handshake). Together, these two forms of encryption comprehensively protect sensitive data as it traverses a network, addressing both the data and the path it travels.

Authentication Headers (AH) is an IPsec protocol that provides data integrity and authentication but does NOT provide encryption of the data payload, making it insufficient for protecting sensitive data confidentiality in transit.

Keyed-Hashing for Message Authentication (HMAC) is a mechanism for verifying data integrity and authenticity using a hash function combined with a secret key, but it does not encrypt data and therefore does not protect confidentiality of data in transit.

Point-to-Point Encryption (P2PE) is a specific standard used primarily in payment card industry (PCI) environments to encrypt cardholder data from the point of interaction to a secure decryption environment, and is not a general-purpose network transit encryption type.