easyMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: An organization's security policy mandates that…
An organization's security policy mandates that data must be encrypted both at rest and in transit. Which combination of controls meets this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Full-disk encryption and TLS for network communications
Full-disk encryption protects data at rest, and TLS encrypts data in transit. Option A is incorrect because AES is an encryption algorithm, not a protocol; IPsec encrypts in transit but does not provide at-rest encryption. Option B is incorrect because BitLocker and EFS both provide at-rest encryption but do not encrypt data in transit. Option C is incorrect because S/MIME encrypts email in transit but does not provide at-rest encryption, and RBAC manages access control, not encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AES encryption for files and IPsec for network traffic
Why it's wrong here
AES is an algorithm, not a full solution for data at rest; IPsec protects in transit but not at rest.
- ✗
BitLocker and EFS
Why it's wrong here
BitLocker is full-disk encryption (at rest) but EFS is file-level encryption; neither addresses data in transit.
- ✗
S/MIME for email and RBAC for file access
Why it's wrong here
S/MIME encrypts email in transit but not at rest; RBAC does not encrypt data.
- ✓
Full-disk encryption and TLS for network communications
Why this is correct
Full-disk encryption secures data at rest, and TLS secures data in transit.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.