TLS protects citizen browser sessions to the permitting portal, while volume encryption protects data stored on attached disks. Which statement correctly contrasts these controls?
Select an answer to reveal the explanation.
Short Explanation
TLS is the armored truck moving data between browser and portal; disk encryption is the locked vault when that data sits still. One covers the journey, the other covers storage—you usually need both. Mixing them up leaves either the road or the warehouse exposed.
Full Explanation
TLS encrypts data in transit between clients and services, protecting citizen browser sessions to a permitting portal on the wire. Disk or volume encryption protects data at rest on attached storage so lost disks, snapshots, or stolen media are unreadable without keys. The correct contrast is transit versus rest—not interchangeable controls.
Claiming TLS only encrypts idle disks and volume encryption only secures packets reverses the models. Saying neither relates to confidentiality is false. Asserting volume encryption replaces TLS on every public HTTPS endpoint leaves session traffic exposed.
Exam caveat: application-level encryption, database TDE, and KMS-managed keys refine at-rest designs; TLS versions/ciphers refine in-transit designs. Exams love "in transit vs at rest" pairing.
Operational check: enforce HTTPS/TLS on the permitting portal with modern ciphers, enable volume encryption on attached disks with managed keys, verify HTTP redirects to HTTPS, and test that detached volumes remain ciphertext. Document both controls in the city’s data-protection standard.
Remember key custody: volume encryption without recoverable municipal key procedures can turn a routine host failure into permanent citizen data loss—test restore of encrypted volumes under the same runbook as TLS certificate renewal.