Which of the following should an administrator implement to help reduce confidentiality risk for data at rest that is located in a public cloud?

Note: The listed correct answer of IPSec tunnel is questionable for this scenario. IPSec is a protocol suite that secures data in transit between two endpoints over a network, not data at rest stored in a cloud. However, if interpreted as protecting data as it moves to/from the cloud storage, an IPSec tunnel could protect data confidentiality during transmission to the cloud provider.

TLS protects data in transit by encrypting network communications, but does not address the confidentiality of data already at rest in cloud storage.

SSL is a deprecated transport-layer security protocol that, like TLS, only protects data in transit and not data stored at rest.

Encryption of data at rest is actually the most direct and correct solution for protecting confidentiality of stored data in a public cloud, making this answer disputed as 'wrong'.