Encrypting data at rest and in transit

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A student app stores user emails in a database on a server. Which type of encryption protects the emails if someone steals the database file?

A Encryption at rest

B Encryption in transit

2. A login form sends a password from a phone to a server across public Wi-Fi. Which protection stops an attacker on that network from reading it?

A Encryption in transit using TLS (HTTPS)

B Encryption at rest on the server's disk

3. True or false: Encrypting a database means the data no longer needs to be protected when it is sent to another system.

A True: encrypted storage also covers data sent over a network

B False: data needs protection both at rest and in transit

4. A company backs up its customer database to an external drive that is taken off-site. What should it do to protect the backup if the drive is lost?

A Encrypt the backup file

B Rely on the database's login password only

5. Where is the safest place to keep the key that decrypts an encrypted database?

A In a text file next to the encrypted database

B In a separate, access-controlled key store

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1AES-256 encrypt database column		Aif (request.protocol != 'https') { reject(); }
2fetch('https://api.shop.com/orders')		Bkey = vault.get_secret('DB_KEY')
3Encryption keys must be protected by keeping them separate from the data they encrypt		CThe encryption key is hard-coded and stored beside the encrypted data, so anyone who steals the backup also gets the key.
4Defence against interception: refuse unencrypted connections and only allow encrypted ones		DData is stored unencrypted, so only data in transit is protected. Stored data at rest must be encrypted too.
5db.save(password_plaintext) // encrypt only on login page		EProtects data at rest so stolen database files or backups cannot be read without the key
6ENCRYPTION_KEY = 'abc123' // saved in app.js with the encrypted backup		FProtects data in transit because TLS encrypts the connection between client and server

Definitions

Encryption at rest and in transit

Fill in the Blanks

Complete each line of code by filling in the missing parts.

encrypted = _______(record, key) SAVE encrypted TO database

url = "_____://shop.example.com/pay"

import os key = os.______("DB_KEY")

IF ___ connection.encrypted THEN BLOCK send(data) END IF

r = requests.get(url, verify=____)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A BEGIN saveCustomerData

B encrypted ← decrypt(data, key)

C WRITE encrypted TO database

D END

Question 2

A BEGIN sendPayment

B SET protocol TO "HTTP"

C SEND cardNumber

D END

Question 3

A BEGIN backupDatabase

B dump ← EXPORT(database)

C locked ← encrypt(dump, key)

D SAVE dump TO backupDrive

E END

Question 4

A BEGIN startApp

B DECLARE key

C key ← "Secret123"

D encrypt(data, key)

E END

Question 5

A BEGIN setupDatabase

B DISABLE encryptionAtRest

C SET cipher TO "AES-256"

D END

Answer Key

Encrypting data at rest and in transit

Section A: Quick Questions

A — Encryption at rest

A — Encryption in transit using TLS (HTTPS)

B — False: data needs protection both at rest and in transit

A — Encrypt the backup file

B — In a separate, access-controlled key store

Section B: Match the Pairs

AES-256 encrypt database column → Protects data at rest so stolen database files or backups cannot be read without the key

fetch('https://api.shop.com/orders') → Protects data in transit because TLS encrypts the connection between client and server

Encryption keys must be protected by keeping them separate from the data they encrypt → key = vault.get_secret('DB_KEY')

Defence against interception: refuse unencrypted connections and only allow encrypted ones → if (request.protocol != 'https') { reject(); }

db.save(password_plaintext) // encrypt only on login page → Data is stored unencrypted, so only data in transit is protected. Stored data at rest must be encrypted too.

ENCRYPTION_KEY = 'abc123' // saved in app.js with the encrypted backup → The encryption key is hard-coded and stored beside the encrypted data, so anyone who steals the backup also gets the key.

Section C: Definitions

Encryption at rest and in transit — Encrypting data both while stored (databases, backups) and while moving over a network (TLS), so intercepted or stolen data stays unreadable without the key.

Section D: Fill in the Blanks

encrypted = ENCRYPT(record, key)
SAVE encrypted TO database

url = "https://shop.example.com/pay"

import os
key = os.getenv("DB_KEY")

IF NOT connection.encrypted THEN
    BLOCK send(data)
END IF

r = requests.get(url, verify=True)

Section E: Spot the Error

B — Data must be encrypted before it is stored in the database (encryption at rest). Calling decrypt on plain data does not protect it. Line 2 should use encrypt(data, key).

B — HTTP sends data as plain text, so an attacker on the network could read the card number. Encryption in transit needs HTTPS (TLS), so the protocol should be "HTTPS".

D — The backup is encrypted in line 3 but the unencrypted dump is saved instead. If the backup drive is stolen the data is readable. It should save the encrypted version: SAVE locked TO backupDrive.

C — Hard-coding an encryption key in the source code exposes it to anyone who can read the code or repository. The key should be loaded from a secure key vault: key ← READ keyVault.

B — Turning off encryption at rest leaves stored records readable if the database files are stolen. The setup should ENABLE encryptionAtRest.