A company writes nightly backups to a disk array in its data center and then replicates those backup sets across a leased WAN link to a disaster recovery site. Which pairing of controls correctly protects the backups in each data state?
Select an answer to reveal the explanation.
Short Explanation
Two places, two jobs: the disk array is data at rest, and the WAN link is data in transit. You lock the storage with at-rest encryption and wrap the wire in an encrypted tunnel. The trap is mixing the tools up, like putting TLS on a disk or trusting a 'private' circuit to keep secrets.
Full Explanation
Backups sitting on the disk array are data at rest, so the matching control is storage-level encryption that renders the media useless if a disk or the array is stolen or improperly accessed. The replication traffic crossing the WAN is data in transit, so it needs a transport protection such as an IPsec site-to-site tunnel that encrypts and authenticates every packet between the two sites. Hashing the backup files provides integrity checking but leaves the content readable, and masking a replication stream would corrupt the very copies the recovery site depends on. Pairing TLS with the array and full-disk encryption with the WAN link inverts the categories: TLS is a session protocol for traffic, while full-disk encryption protects a storage device, not a network path. Tokenizing an entire backup set is not how backups are protected, because tokenization substitutes individual sensitive fields, and a leased circuit only isolates traffic from other customers; it does not encrypt anything, so a tap at the carrier still exposes the data. Exam caveat: always identify the data state first, then choose the control built for it. Operational check: verify encryption is enabled on the backup repository, confirm the replication path shows an established encrypted tunnel, and capture a sample of replication traffic to confirm it is not readable.