Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)Cloud SecurityHard
A cloud security team is tasked with ensuring that all sensitive data stored in their cloud object storage is encrypted both at rest and in transit. They have already implemented server-side encryption for data at rest. What additional measure should they take to secure data in transit when accessed by applications?
- AEnable multi-factor authentication (MFA) for all object storage access.
- BEnsure all client applications use HTTPS/TLS for communication.
- CUtilize Identity and Access Management (IAM) policies to restrict access.
- DConfigure Network Access Control Lists (NACLs) to block unencrypted traffic.
Show answer & explanationAnswer & explanation
Correct answer: B. Ensure all client applications use HTTPS/TLS for communication.
HTTPS (HTTP Secure), which uses TLS (Transport Layer Security) encryption, is the standard and most effective method for encrypting data in transit over networks, including when accessing cloud object storage. This ensures confidentiality and integrity of data as it moves between client applications and the cloud service.
Why the other options are wrong
- A. MFA strengthens authentication but does not encrypt the data itself while it is moving across the network.
- C. IAM policies control who can access data but do not encrypt the data itself during transit.
- D. NACLs filter network traffic based on IP/port/protocol but cannot enforce or perform encryption for data in transit; they can only block unencrypted protocols if configured.
Data in Transit Encryption
The process of encrypting data as it moves across networks, such as between a client application and a cloud service, to protect its confidentiality and integrity from eavesdropping or tampering.
- Typically achieved using HTTPS/TLS.
- Protects data during communication.
- Complements data at rest encryption for comprehensive security.
Memory trick: For data 'T'ransport, 'T'LS is 'T'he 'L'ogical 'S'olution.