Protecting data at rest

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which of these is an example of data at rest?

A An email travelling across the internet to a server

B Customer records saved in a company database

2. A staff laptop is stolen. Which control best keeps the stored files unreadable?

A Full disk encryption

B A firewall on the school network

3. True or false: if a laptop has a login password but its disk is not encrypted, the data is fully protected if the laptop is stolen.

A True

B False

4. Which measure protects data at rest by limiting who can open the stored files?

A Access control, such as user permissions

B Using HTTPS on the website

5. A company stores its backups on a portable hard drive. What should it do to protect that backup if the drive is lost?

A Encrypt the backup

B Leave it unencrypted because backups are not important

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1BitLocker: encrypt entire laptop drive		AEncrypting a backup file so the stored copy cannot be read if the backup drive is lost or stolen
2AES-256 encrypt backup_2026.zip		BFull disk encryption that makes the stored files unreadable if the laptop is stolen without the key
3Data at rest is stored data, so a database can be protected by encrypting the stored table columns		CALTER TABLE customers ENCRYPT COLUMN cardNumber;
4Access control protects data at rest by letting only approved staff open stored files		DThe stored files are not encrypted, so a thief who removes the drive can read all the data at rest.
5Laptop with customer files saved in plain text, protected only by a screen saver		EThe backup holds a full copy of the data at rest but has no encryption or access control, so anyone who takes it can read it.
6Backup tape kept in an unlocked drawer, unencrypted, with no access control		FGRANT SELECT ON customers TO analyst_role;

Definitions

data at rest

Fill in the Blanks

Complete each line of code by filling in the missing parts.

backup = ENCRYPT(backup, _________)

laptop.disk = _______(laptop.disk, key)

thiefCanRead = ___ diskEncrypted

ALTER DATABASE sales SET __________ ON;

SETACCESS(backupDrive, "interns", ____)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF device = laptop THEN

B disableDiskEncryption()

C END IF

Question 2

A db ← openDatabase('students')

B setEncryption(db, ON)

C setAlgorithm(db, 'Caesar')

Question 3

A user ← login()

B IF user.role ≠ 'guest' THEN

C key ← getKey(user)

D display(encrypt(file, key))

E END IF

Question 4

A backup ← copy(database)

B enc ← encrypt(backup, key)

C store(enc, offsiteDrive)

D keepKey(key, offsiteDrive)

Question 5

A laptop.stolen ← TRUE

B IF laptop.diskEncrypted THEN

C thiefCanRead ← TRUE

D ELSE

E thiefCanRead ← TRUE

F END IF

Answer Key

Protecting data at rest

Section A: Quick Questions

B — Customer records saved in a company database

A — Full disk encryption

B — False

A — Access control, such as user permissions

A — Encrypt the backup

Section B: Match the Pairs

BitLocker: encrypt entire laptop drive → Full disk encryption that makes the stored files unreadable if the laptop is stolen without the key

AES-256 encrypt backup_2026.zip → Encrypting a backup file so the stored copy cannot be read if the backup drive is lost or stolen

Data at rest is stored data, so a database can be protected by encrypting the stored table columns → ALTER TABLE customers ENCRYPT COLUMN cardNumber;

Access control protects data at rest by letting only approved staff open stored files → GRANT SELECT ON customers TO analyst_role;

Laptop with customer files saved in plain text, protected only by a screen saver → The stored files are not encrypted, so a thief who removes the drive can read all the data at rest.

Backup tape kept in an unlocked drawer, unencrypted, with no access control → The backup holds a full copy of the data at rest but has no encryption or access control, so anyone who takes it can read it.

Section C: Definitions

data at rest — Data stored on a device, server or backup, not moving. Protect it with encryption (disk or database) and access control, so a stolen laptop or backup is unreadable.

Section D: Fill in the Blanks

backup = ENCRYPT(backup, backupKey)

laptop.disk = ENCRYPT(laptop.disk, key)

thiefCanRead = NOT diskEncrypted

ALTER DATABASE sales SET ENCRYPTION ON;

SETACCESS(backupDrive, "interns", NONE)

Section E: Spot the Error

B — Data at rest on a laptop is protected by turning disk encryption on. Disabling it leaves the files readable if the laptop is stolen. It should be enableDiskEncryption().

C — The Caesar cipher is far too weak to protect a database at rest and is easily broken. A strong algorithm such as AES-256 should be used.

D — An authorised user needs to read the stored data, so the encrypted file must be decrypted with the key. It should be decrypt(file, key), not encrypt.

D — The key must be kept apart from the encrypted backup. Storing it on the same drive means anyone who steals the backup also gets the key. It should be separateVault.

C — If the disk is encrypted, a thief who steals the laptop cannot read the data. This branch should set thiefCanRead to FALSE.