What encryption and authentication strategies are appropriate for protecting VIM data in transit and at rest?

• A. TLS for data in transit, AES-256 or equivalent at rest, secure keys management, RBAC, MFA, and audit trails.
• B. FTP for transit, DES encryption at rest, no authentication.
• C. No encryption; rely on physical security.
• D. TLS for data in transit; no at-rest encryption; user passwords only.

Answer: (B)

Protecting VIM data in transit and at rest requires strong, layered encryption combined with solid authentication and monitoring. For data in transit, using TLS ensures the channel is encrypted, tamper-resistant, and authenticated, so eavesdropping and man-in-the-middle attacks are prevented. For data at rest, encrypting stored data with a strong algorithm like AES-256 keeps information unreadable even if the storage medium is compromised. Key management is essential: use secure storage and rotation of encryption keys, with strict access controls so only authorized services and personnel can use them. Access should be governed by role-based access control, MFA should be employed to prevent credential-based breaches, and comprehensive audit trails should log access and actions to support accountability and incident response.

The other approaches fall short because they rely on insecure or outdated methods, lack encryption where it matters, or omit essential authentication and oversight. Using an insecure transport protocol like FTP exposes data in transit; weak encryption such as DES is easily compromised and does not provide contemporary protection; not encrypting at rest leaves stored data vulnerable; relying on passwords alone without multi-factor authentication or robust access controls increases the chance of unauthorized access.