Encryption at rest refers to the cryptographic protection of data that is stored in a non-volatile state on physical media, such as hard drives, SSDs, or in a database. Encrypting a virtual machine disk is a direct example of this principle. The data on the disk is rendered unreadable to anyone who might gain unauthorized physical or logical access to the storage medium, as it can only be accessed with the correct decryption keys. This protects the data while it is inactive or "at rest."

A. A site-to-site VPN encrypts data in transit as it travels across a public network between two private networks.

C. An HTTPS connection encrypts data in transit between a user's web browser and the web server.

D. Sending an encrypted email protects the message content while it is in transit from the sender to the recipient.

---

1. Microsoft Learn. (n.d.). Describe encryption and hashing. In SC-900: Microsoft Security

Compliance

and Identity Fundamentals. Retrieved from https://learn.microsoft.com/en-us/training/modules/describe-encryption-hashing/2-what-is-encryption. In the section "States of data

" this module defines data at rest as "inactive data that's stored physically in a database

or on a drive."

2. Microsoft Azure Documentation. (2023

September 21). Azure data encryption at rest. Retrieved from https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest. This document explicitly lists "Azure Disk Encryption" as a service that provides encryption at rest

stating it "helps you encrypt your Windows and Linux IaaS virtual machine disks."

3. Microsoft Azure Documentation. (2023

September 21). Azure encryption overview. Retrieved from https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview. This overview clearly distinguishes between the two states

categorizing technologies like TLS (used by HTTPS) and VPNs under "Encryption in transit."