An application can reach the Data Domain either over a plain NFS export across a shared campus network that every department traverses, or over DD Boost with in-flight encryption enabled on the same network. The storage team wants to pick whichever option needs the least configuration. What should drive that protocol decision?

The security profile of an access path is a property of the protocol and how it is configured: a plain NFS export with system authentication transmits backup payload without per-session encryption, whereas DD Boost supports in-flight encryption negotiated between the client and the appliance, giving confidentiality of data in transit. That matters whenever frames cross segments other teams control, because capture on a shared fabric is a practical threat. Protocol selection therefore balances capability, throughput, and network trust, and a least-configuration tiebreaker quietly deletes the decisive input. Claiming both paths encrypt identically at the transport layer is a myth: TCP carries bytes, not confidentiality, and nothing wraps a plain NFS payload automatically. The rule that file protocols always win on shared networks because they encrypt by default misstates typical export behavior and is precisely wrong on a network every department can read. Buying a third-party encryption gateway is unnecessary when the appliance already offers an encrypted ingest path. Exam caveat: on a genuinely isolated, controlled backup network, an unencrypted file path can be a deliberate, documented decision, but it must be made, not defaulted into. Operational check: confirm the DD Boost client's encryption setting on the appliance and record how in-flight protection was verified for the shared network path.