Which of the following should an administrator implement to help reduce confidentiality risk for data at rest that is located in a public cloud?

An IPSec tunnel creates a secure and encrypted communication channel between an on-premises network and a public cloud environment. By forcing all access to data at rest within the cloud through this tunnel, it prevents unauthorized network interception and access attempts, thus reducing the confidentiality risk associated with the stored data.

TLS (Transport Layer Security) is a protocol used to secure data in transit over a network connection, primarily for application-layer communications like HTTPS, not for data stored on disk.

SSL (Secure Sockets Layer) is an older protocol superseded by TLS and is also designed to secure data in transit, not data persistently stored at rest.

Encryption is a primary method for protecting data at rest by rendering it unreadable without authorization; however, the question's designated correct answer focuses on securing the network access path to cloud-based data at rest rather than intrinsic data protection on the storage medium.