A backup drive containing copies of a production database's data files and backup files is stolen from a courier vehicle. The data was not encrypted. Which control would have prevented the thief from reading the data?
Select an answer to reveal the explanation.
Short Explanation
A stolen drive is your data at rest walking out the door, and database logins can't protect files that are being read on someone else's machine. Encrypt the data files and the backups, and the thief just gets scrambled bytes. TLS is the trap; it only guards data while it's moving across the network.
Full Explanation
Encryption at rest protects data stored on media, so files that leave the organization's control remain unreadable without the keys. Transparent data encryption encrypts data and log files at the storage layer, and backup encryption ensures backup files written from the database are also ciphertext; the keys are held separately, ideally in a key management system or hardware security module, not on the stolen media. TLS protects connections between clients and the server and has no effect on files copied to a drive. Dynamic data masking alters what non-privileged users see in query results while the underlying stored data remains plaintext, so someone who attaches the raw files elsewhere sees everything. Role-based access control is enforced by the running database engine; a thief who restores the files on an engine they control is not subject to the original server's permissions. Exam caveat: encrypting backups is only useful if the keys or certificates are backed up separately and securely, because losing them makes the organization's own backups unrecoverable. Operational check: attempt to restore an encrypted backup on a test server that lacks the key and confirm it fails, then confirm a restore succeeds on a server that has been given the key through the documented recovery procedure.