A building department stores permit PDFs in Amazon S3 and uploads them from browsers over HTTPS. Staff ask how encryption at rest differs from encryption in transit for those permits. Which statement is accurate?
Select an answer to reveal the explanation.
Short Explanation
Leave the finished permit binder in a locked vault overnight — that is at rest. Carry the same binder across town in a locked courier pouch — that is in transit. HTTPS (TLS) covers the courier ride; S3 encryption covers the vault. Mixing those up is a classic exam trap.
Full Explanation
Encryption at rest protects data while it is stored, such as S3 server-side encryption for permit objects on durable storage. Encryption in transit protects data while it moves between endpoints, typically with TLS/HTTPS during upload or download. The two controls address different stages of the data lifecycle and are complementary rather than interchangeable.