Which statement correctly describes encryption at rest, encryption in transit, and basic key-management concepts?

• A. Encryption at rest protects stored data; in transit protects data moving over networks; key management includes generation, storage, rotation, access controls, and revocation.
• B. Encryption at rest protects data moving over networks; encryption in transit protects stored data.
• C. Both protect data only during processing.
• D. Encryption at rest and in transit are the same.

Answer: (A)

Protecting data depends on its state: when it’s stored versus when it’s moving, and how the cryptographic keys used to protect it are handled. Encryption at rest secures data that is stored on disks, databases, or backup media so that if the storage medium is accessed without authorization, the data remains unreadable. Encryption in transit secures data as it travels over networks between endpoints, guarding against eavesdropping and tampering.

Key management is the backbone that makes both forms of encryption effective. It covers generating strong keys, storing them securely (often using a hardware security module or a trusted key management service), rotating keys regularly to limit exposure after a compromise, enforcing who can access or use the keys through access controls, and revoking keys when they’re no longer trusted or when an override is needed.

The statement that ties these ideas together correctly identifies encryption at rest as protecting stored data, encryption in transit as protecting data in motion, and outlines essential key-management activities—generation, storage, rotation, access controls, and revocation. Other choices either swap the definitions, claim encryption only protects data during processing, or say the two forms are the same, which contradicts how these protections operate in different data states.