Quick Answer
The correct answer is implementing TLS for data in transit and AES-256 for data at rest. This combination directly satisfies the encryption implementation for PHI mobile app mandate because TLS (Transport Layer Security) encrypts the communication channel between the mobile app and the server, preventing eavesdropping and tampering during transmission, while AES-256 provides a strong symmetric cipher to protect stored personal health information on the device or backend, ensuring confidentiality even if physical security is breached. On the Certified Information Systems Auditor CISA exam, this question tests your grasp of fundamental encryption controls in the domain of information asset protection; a common trap is confusing SSL with TLS or selecting weaker algorithms like DES or RC4. Remember the memory tip: “TLS talks, AES rests”—TLS secures the conversation in transit, AES secures the files at rest.
This CISA practice question tests your understanding of information systems acquisition, development and implementation. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization is developing a mobile app that will handle personal health information (PHI). The security team mandates that data must be encrypted both in transit and at rest. Which of the following implementation strategies BEST ensures compliance?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Use HTTPS for all network communication and store data in plaintext
Why wrong: Missing at-rest encryption.
Use SSL and encrypt all data with a simple XOR cipher
Why wrong: Weak encryption.
Rely on platform-level encryption provided by the mobile OS
Why wrong: May not be sufficient for PHI.
Implement TLS for data in transit and AES-256 encryption for data at rest
Covers both requirements.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Implement TLS for data in transit and AES-256 encryption for data at rest
Option D is correct because it uses TLS (the modern, secure successor to SSL) to encrypt data in transit, ensuring confidentiality and integrity during network communication, and AES-256, a strong symmetric encryption standard, to encrypt data at rest. This combination directly satisfies the mandate for encryption both in transit and at rest, as TLS protects against eavesdropping and tampering on the wire, while AES-256 protects stored PHI from unauthorized access if the device is lost or compromised.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Use HTTPS for all network communication and store data in plaintext
Why it's wrong here
Missing at-rest encryption.
Use SSL and encrypt all data with a simple XOR cipher
Why it's wrong here
Weak encryption.
Rely on platform-level encryption provided by the mobile OS
Why it's wrong here
May not be sufficient for PHI.
Implement TLS for data in transit and AES-256 encryption for data at rest
Why this is correct
Covers both requirements.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
The trap here is that candidates may confuse 'platform-level encryption' (Option C) as sufficient, but the CISA exam tests the understanding that platform encryption does not cover data in transit and may not meet specific regulatory requirements for application-layer encryption at rest.
Detailed technical explanation
TLS 1.2/1.3 (RFC 5246/8446) uses a handshake to negotiate session keys via asymmetric cryptography (e.g., ECDHE) and then encrypts the bulk data with symmetric ciphers like AES-GCM, ensuring forward secrecy. AES-256 (FIPS 197) operates on 128-bit blocks with a 256-bit key, requiring 2^256 brute-force attempts to break, and is often used in XTS or GCM modes for storage encryption. In practice, a healthcare app might use TLS to transmit PHI to a backend server and then encrypt the local database with AES-256 using a key derived from the user's biometric or a hardware-backed keystore (e.g., Android Keystore or iOS Keychain) to meet HIPAA requirements.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Information Systems Acquisition, Development and Implementation — study guide chapter
Learn the concepts, then practise the questions
Information Systems Acquisition, Development and Implementation practice questions
Targeted practice on this topic area only
All CISA questions
509 questions across all exam domains
Certified Information Systems Auditor CISA study guide
Full concept coverage aligned to exam objectives
CISA practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise CISA questions linked to Governance and Management of IT.
Practise CISA questions linked to Information Systems Acquisition, Development and Implementation.
Practise CISA questions linked to Information Systems Operations and Business Resilience.
Practise CISA questions linked to Protection of Information Assets.
Practise CISA questions linked to Information System Auditing Process.
Practise CISA questions linked to CISA fundamentals.
Practise CISA questions linked to CISA scenario.
Practise CISA questions linked to CISA troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Information Systems Acquisition, Development and Implementation — This question tests Information Systems Acquisition, Development and Implementation — Read the scenario before looking for a memorised answer..
The correct answer is: Implement TLS for data in transit and AES-256 encryption for data at rest — Option D is correct because it uses TLS (the modern, secure successor to SSL) to encrypt data in transit, ensuring confidentiality and integrity during network communication, and AES-256, a strong symmetric encryption standard, to encrypt data at rest. This combination directly satisfies the mandate for encryption both in transit and at rest, as TLS protects against eavesdropping and tampering on the wire, while AES-256 protects stored PHI from unauthorized access if the device is lost or compromised.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.