Explain the role of data encryption at rest and in transit and key management concepts.

• A. Encryption is only for data in transit
• B. Encryption protects data confidentiality; at rest encrypts stored data, in transit protects data in transit; key management includes key generation, storage, rotation, access control
• C. Key management is optional
• D. Encryption replaces backups

Answer: (B)

Encryption protects data confidentiality by turning information into unreadable ciphertext unless someone has the proper key. For data at rest, encryption secures stored information on disks, databases, and backups, so even if storage is accessed, the data remains unreadable. For data in transit, encryption protects information as it moves across networks—think TLS for web traffic or VPNs—so eavesdropping or tampering is prevented. Key management is essential because the security of encryption rests on how well the keys are generated, stored, protected, rotated, and who has access to them. Proper key management also includes lifecycle practices like regular rotation, access controls, auditing, and secure storage (often using hardware security modules) to prevent key leakage. Without robust key management, encrypted data can become vulnerable even if strong cryptography is used. Encryption complements other safeguards (like backups and access controls) rather than replacing them.