A cloud administrator is securing data-at-rest and data-in-transit featured on an IaaS cloud platform. The volume to be secured is mounted storage from the same region and availability zone. The…

SSHv1 contains critical known vulnerabilities including weak key negotiation and session hijacking risks, and has been officially deprecated, making it unsuitable for any secure environment.

SSHv2 is the current, secure version of the SSH protocol used for encrypted SFTP file transfers between Linux servers. It corrects critical weaknesses present in SSHv1, including stronger key exchange and improved authentication mechanisms, making it the required choice for secure cross-zone transfers.

SSLv3 is deprecated and vulnerable to the POODLE attack (CVE-2014-3566), which allows an attacker to decrypt encrypted communications by forcing a protocol downgrade.

TLSv1.2 is a NIST-approved and widely mandated transport security protocol that protects data-in-transit from interception and tampering. Older protocols such as SSLv3 and TLSv1.0/1.1 have published exploitable vulnerabilities, making TLSv1.2 or higher the minimum acceptable standard per NIST SP 800-52.

AES (Advanced Encryption Standard) is the NIST-approved symmetric cipher for data-at-rest encryption, offering 128-bit or 256-bit key strengths that meet current security requirements. It replaces weaker algorithms such as 3DES, which suffers from the Sweet32 birthday attack vulnerability due to its 64-bit block size.

3DES was deprecated by NIST effective 2023 due to its 64-bit block size, which makes it vulnerable to Sweet32 birthday attacks under high-volume data transfer conditions.

MD5 is a cryptographically broken hashing algorithm susceptible to collision attacks and is unsuitable for any security-sensitive integrity verification or authentication purpose.