hardMultiple Choice

CRISC Practice Question: The policy requiring TLS 1.2 or higher for all…

Exhibit

Refer to the exhibit.

Exhibit: JSON snippet of a cloud security policy:
{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "true"
        }
      }
    }
  ]
}

The policy requiring TLS 1.2 or higher for all data transmissions is intended to enforce what security control?

⚠ Common exam trap

A common mix-up: candidates confuse 'encryption in transit' with 'encryption at rest' because both involve encryption, but the policy's focus on transmission protocols (TLS) clearly distinguishes it as a network-layer control.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Encryption in transit

The policy explicitly requires TLS 1.2 or higher for all data transmissions, which enforces encryption in transit. This ensures that data is protected from interception or tampering while moving across networks, as opposed to being stored (at rest) or managed via classification or access rules.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Data classification
Why it's wrong here
Data classification labels information by sensitivity; it does not enforce transport security. TLS 1.2+ governs data in transit, so classification is the wrong control family here. Classification would be correct when the requirement is to tag and handle data according to sensitivity tiers.
✗
Access control
Why it's wrong here
Access control governs who may reach a resource through authentication and authorisation decisions; it does not protect data moving across a network. It is tempting because TLS endpoints authenticate parties, but the policy's purpose is cryptographic protection of transmitted data, which is the encryption control.
✗
Encryption at rest
Why it's wrong here
Encryption at rest protects stored data on disks and databases, whereas TLS secures data in transit between endpoints. The policy's transport-layer requirement cannot be satisfied by at-rest encryption. Encryption at rest would be correct when the requirement is protecting stored data.
✓
Encryption in transit
Why this is correct
TLS 1.2 or higher encrypts data while moving between systems, directly satisfying the policy's requirement for protecting transmissions. This is encryption in transit, distinct from encryption at rest, which protects stored data. The policy's scope — all data transmissions — maps precisely to data in motion, making this the control being enforced.

Go deeper

CRISC Practice Question: The policy requiring TLS 1.2 or higher for all…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question