States of Data

Question 1 of 6

A security analyst discovers that a stolen laptop contained an unencrypted database of 50,000 customer records. The laptop was protected only by a Windows login password. The attacker removed the hard drive and connected it to a separate system. Which data state does this scenario primarily involve, and what control would have prevented the exposure?

A. Data in transit — TLS encryption should have been applied to protect data moving to the attacker's system B. Data at rest — full disk encryption would have made the drive unreadable after physical removal C. Data in use — the data was being processed at the time of theft and should have been encrypted in RAM D. Data in transit — the attacker used a network connection to extract the data, so TLS was the relevant control

Question 2 of 6

In November 2013, attackers stole 110 million credit card records from Target Corporation. Target had encrypted both stored cardholder data and payment network transmissions. Which data state did the attackers exploit, and how?

A. Data at rest — attackers decrypted the stored database using a stolen encryption key B. Data in transit — attackers performed a man-in-the-middle attack to intercept encrypted payment traffic C. Data in use — malware scraped decrypted credit card numbers from POS terminal RAM during transaction processing D. Data at rest — attackers bypassed database encryption by exploiting a SQL injection vulnerability

Question 3 of 6

A network administrator wants to encrypt all traffic transmitted between the headquarters office and three branch offices. The encryption should operate at the network layer and protect all IP traffic regardless of application. Which technology is MOST appropriate?

A. IPsec site-to-site VPN B. TLS on all web servers C. Full disk encryption on branch office workstations D. File-level encryption on shared network drives

Question 4 of 6

A European company is evaluating a U.S. cloud provider for storing personal data about its EU customers. The legal team raises concerns about which laws will govern the stored data. Which concept BEST describes the core legal issue?

A. Data in use — the data will be actively processed by the cloud provider's servers B. Geolocation — the cloud provider's servers are in a different location than the company C. Full disk encryption — the cloud provider must encrypt all EU customer data at rest D. Data sovereignty — data stored in the U.S. is subject to U.S. laws, potentially conflicting with GDPR requirements

Question 5 of 6

An organization implements a policy where employees connecting from within the corporate building can access highly sensitive financial systems, while the same credentials from home provide read-only access only. Which security technology is enabling this location-based access differentiation?

A. Full disk encryption — the financial system data is encrypted and only accessible from the building B. Geolocation-based access control — location is used as an additional factor to determine access level C. Data sovereignty — corporate data must be accessed only from within the country D. TLS — the financial system encrypts all sessions differently based on network source

Question 6 of 6

Why is data in RAM considered "data in use" and why is it almost always decrypted?

A. RAM encryption is technically impossible — the hardware does not support it B. Decrypting RAM would require too much storage space for the decryption keys C. The CPU must read and operate on plaintext data to perform computations — ciphertext cannot be meaningfully processed by standard applications D. Operating systems automatically decrypt all data when loaded into RAM as a performance optimization

Matching

1. Malware installed on a payment terminal reads the card processing application's memory and extracts credit card numbers during the brief transaction authorization window — the card data exists in plaintext here because the application must process it

2. A security team encrypts all hard drives on employee laptops using BitLocker with TPM + PIN; if a laptop is stolen while powered off, the drive contents cannot be read without the PIN

3. A web application uses HTTPS (TLS on TCP 443) to encrypt customer login credentials and session data between the user's browser and the web server — an interceptor on the network sees only ciphertext

4. An organization storing EU customer data on servers in Singapore discovers that Singapore's local data protection laws apply to that data — not just the EU regulations — because data is subject to the laws of the country where it is stored

1. 2. 3. 4.

A. Data in Use

B. Data at Rest

C. Data in Transit

D. Data Sovereignty

States of Data Quiz

Matching