File servers encrypt taxpayer data at rest, yet internal APIs send Social Security numbers in cleartext across the city WAN. Which data-protection gap is illustrated?
Select an answer to reveal the explanation.
Short Explanation
Bolting the filing cabinet is great until you shout the contents down a crowded hallway. Encryption at rest does not help SSNs riding clear across the WAN. Cover the data wherever it lives—at rest, in motion, and while applications are using it.
Full Explanation
Encrypting taxpayer data at rest on file servers while internal APIs send Social Security numbers in cleartext across the city WAN illustrates protecting data at rest without equivalent controls for data in transit—and the need to consider data in use. Confidentiality controls must follow the data through storage, movement, and processing. Cabinet locks do not help if contents are shouted across the hallway; disk encryption does not help SSNs riding clear on the WAN.
Blaming excessive focus only on data in use inside CPU registers fails by concept: the described gap is missing transit protection, not over-focus on CPU state. Over-classification of WAN links as Public media fails as a misdiagnosis—the issue is cleartext sensitive payloads, not mislabeled links. Requiring encryption solely for USB while ignoring servers fails as the opposite of the stem, which already encrypts servers at rest and neglects transit.
Exam caveat: CISSP data states are at rest, in transit, and in use; controls must cover the relevant states for the data's classification. Operational check: enforce TLS or equivalent on internal APIs carrying SSNs, ban cleartext taxpayer identifiers on the WAN, and review application paths for data-in-use exposure beyond disk encryption.