A web application's login page submits credentials over plain HTTP, and a packet capture on the local network shows usernames and passwords in cleartext. Which control directly protects the credentials while they are in transit?
Select an answer to reveal the explanation.
Short Explanation
If you send a password over plain HTTP, it's like mailing it on a postcard. Anybody who handles it can read it. TLS seals it in an envelope; hashing and disk encryption only protect it after it's already arrived.
Full Explanation
Transport encryption protects data in transit between two endpoints. Enabling TLS for the web application, so that the login page and form submissions use HTTPS, encrypts the session after a handshake that authenticates the server with its certificate. A packet capture then shows only encrypted records, and an attacker on the network cannot read credentials or tamper with the session. Salted hashing protects stored passwords at rest in the database, which is an important control, but credentials still cross the network in cleartext before they are hashed. Full disk encryption protects the server's storage if a drive is stolen; it has no effect on packets traveling between the browser and the server. Obfuscating JavaScript makes client-side code harder to read but does not encrypt the form data sent over the network, and any obfuscation can be reversed. Exam caveat: match the control to the data state described; in transit points to TLS or other transport encryption, at rest points to disk, file, or database encryption, and in use points to protections like secure enclaves. Operational check: redirect all HTTP requests to HTTPS, enable HTTP Strict Transport Security so browsers refuse to downgrade, disable obsolete protocol versions, and repeat the packet capture to confirm that no credentials appear in cleartext.