A database administrator is configuring an alternate site to replicate the data between the two sites. Which of the following is used to protect against eavesdropping across the network?

A VLAN logically segments network traffic for isolation purposes but does not encrypt data, leaving it readable to anyone with access to that segment.

Data-in-transit encryption (e.g., TLS or IPsec) wraps data in an encrypted channel so that any attacker intercepting packets on the network cannot read the payload. During replication between two geographically separate sites, data traverses potentially untrusted networks, making in-transit encryption the direct control against eavesdropping. Data-at-rest encryption, by contrast, only protects data stored on disk after it arrives.

An Access Control List (ACL) restricts which hosts or users can communicate, but does not encrypt the data flowing between permitted endpoints.

Data-at-rest encryption protects data stored on disk from unauthorized physical access, but has no effect on data being actively transmitted over the network.