← VCE Data Analytics U4O2

Protecting data at rest

Data stored on a device, server or backup, not moving. Protect it with encryption (disk or database) and access control, so a stolen laptop or backup is unreadable.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 61, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 70, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 92, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 5, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 50, QCE Digital Solutions Unit 4 — Prototype Digital Data Exchanges — Module 119, WA Computer Science ATAR Year 11 — Cyber Security — Module 90

Understanding Protecting data at rest in VCE Data Analytics U4O2

What it does: Database encryption protects stored data at rest, so the card numbers are unreadable without the key even if the database files are copied. A stolen laptop is only safe if its disk is encrypted. A screen saver does not protect data at rest.

Common mistakes: Data at rest on a laptop is protected by turning disk encryption on. Disabling it leaves the files readable if the laptop is stolen. It should be enableDiskEncryption(). The Caesar cipher is far too weak to protect a database at rest and is easily broken. A strong algorithm such as AES-256 should be used.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Protecting data at rest to a class →

This module's key terms are also in a printable crossword (Modules 44–79) and word search (Modules 44–113).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which of these is an example of data at rest?

An email travelling across the internet to a serverCustomer records saved in a company database

Matches

Laptop with customer files saved in plain text, protected only by a screen saver

↓

The stored files are not encrypted, so a thief who removes the drive can read all the data at rest.

Applying

Meanings

Term

data at rest

Meaning

Data stored on a device, server or backup, not moving. Protect it with encryption (disk or database) and access control, so a stolen laptop or backup is unreadable.

Practice

diskEncrypted ← TRUE

Testing

Gaps

backup = ENCRYPT(backup, )

Check Answer

Spots

1IF device = laptop THEN

2 disableDiskEncryption()

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which of these is an example of data at rest?

A. An email travelling across the internet to a server

B. Customer records saved in a company database ✓

Data at rest is stored on a device, server or backup. Data moving across a network is data in transit.

2. A staff laptop is stolen. Which control best keeps the stored files unreadable?

A. Full disk encryption ✓

B. A firewall on the school network

Disk encryption scrambles the stored files, so a thief cannot read them without the key. A firewall protects network traffic, not a stolen device.

3. True or false: if a laptop has a login password but its disk is not encrypted, the data is fully protected if the laptop is stolen.

A. True

B. False ✓

A thief can remove the drive and read the files from another computer. Encryption is needed to protect the stored data.

4. Which measure protects data at rest by limiting who can open the stored files?

A. Access control, such as user permissions ✓

B. Using HTTPS on the website

Access control decides who can read or change stored data. HTTPS protects data while it moves between browser and server.

5. A company stores its backups on a portable hard drive. What should it do to protect that backup if the drive is lost?

A. Encrypt the backup ✓

B. Leave it unencrypted because backups are not important

Backups hold a full copy of the data, so they are data at rest too. Encrypting them keeps a lost or stolen drive unreadable.

Match the Pairs

BitLocker: encrypt entire laptop drive → Full disk encryption that makes the stored files unreadable if the laptop is stolen without the key

AES-256 encrypt backup_2026.zip → Encrypting a backup file so the stored copy cannot be read if the backup drive is lost or stolen

Data at rest is stored data, so a database can be protected by encrypting the stored table columns → ALTER TABLE customers ENCRYPT COLUMN cardNumber;

Access control protects data at rest by letting only approved staff open stored files → GRANT SELECT ON customers TO analyst_role;

Laptop with customer files saved in plain text, protected only by a screen saver → The stored files are not encrypted, so a thief who removes the drive can read all the data at rest.

Backup tape kept in an unlocked drawer, unencrypted, with no access control → The backup holds a full copy of the data at rest but has no encryption or access control, so anyone who takes it can read it.

Key Term

data at rest

Data stored on a device, server or backup, not moving. Protect it with encryption (disk or database) and access control, so a stolen laptop or backup is unreadable.

Fill in the Blanks

1. backup = ENCRYPT(backup, backupKey)

Hint: Type the variable that holds the secret used to scramble the backup file.

2. laptop.disk = ENCRYPT(laptop.disk, key)

Hint: Type the function name that scrambles the whole disk so a thief cannot read it.

3. thiefCanRead = NOT diskEncrypted

Hint: Type the logical operator that flips true to false, so a stolen laptop with an encrypted disk is unreadable.

4. ALTER DATABASE sales SET ENCRYPTION ON;

Hint: Type the keyword that protects the stored contents of a database by scrambling them.

5. SETACCESS(backupDrive, "interns", NONE)

Hint: Type the permission level that stops interns from reading the backup drive.

Spot the Error

Question 1

A IF device = laptop THEN

B disableDiskEncryption()

C END IF

Line B — Data at rest on a laptop is protected by turning disk encryption on. Disabling it leaves the files readable if the laptop is stolen. It should be enableDiskEncryption().

Question 2

A db ← openDatabase('students')

B setEncryption(db, ON)

C setAlgorithm(db, 'Caesar')

Line C — The Caesar cipher is far too weak to protect a database at rest and is easily broken. A strong algorithm such as AES-256 should be used.

Question 3

A user ← login()

B IF user.role ≠ 'guest' THEN

C key ← getKey(user)

D display(encrypt(file, key))

E END IF

Line D — An authorised user needs to read the stored data, so the encrypted file must be decrypted with the key. It should be decrypt(file, key), not encrypt.

Question 4

A backup ← copy(database)

B enc ← encrypt(backup, key)

C store(enc, offsiteDrive)

D keepKey(key, offsiteDrive)

Line D — The key must be kept apart from the encrypted backup. Storing it on the same drive means anyone who steals the backup also gets the key. It should be separateVault.

Question 5

A laptop.stolen ← TRUE

B IF laptop.diskEncrypted THEN

C thiefCanRead ← TRUE

D ELSE

E thiefCanRead ← TRUE

F END IF

Line C — If the disk is encrypted, a thief who steals the laptop cannot read the data. This branch should set thiefCanRead to FALSE.

Student with a class code? Join your class →