How Is Sensitive Data at Rest Made Unreadable?
A company must ensure sensitive data at rest is rendered unreadable. Which of the following will the company most likely use?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
It tests whether you can match the phrase "rendered unreadable" to encipherment rather than to integrity, tokenization, or network zoning; the trap is choosing hashing because it is also a cryptographic operation.
This question asks which control renders sensitive data at rest unreadable, and the correct answer is encryption (C). Encryption converts stored plaintext into ciphertext that only holders of the decryption key can restore, which is why it—not hashing, tokenization, or segmentation—is the standard method for protecting data at rest.
The most common wrong pick is hashing (A), because candidates see a cryptography word and assume any cryptographic function hides data—but hashing is one-way and irreversible, so the protected data can no longer be used, and it is an integrity control, not a confidentiality control for stored data.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Encryption is the only option that transforms sensitive data at rest into ciphertext, so the data cannot be read without the corresponding decryption key; the question's phrase "rendered unreadable" is the textbook definition of encipherment. Real-world implementations such as full-disk encryption (BitLocker, LUKS), database transparent data encryption, and cloud KMS-backed encryption-at-rest all exist precisely to satisfy this requirement. This is also codified in guidance such as NIST SP 800-111, which addresses storage encryption technologies for end-user and server devices. Because encryption preserves recoverability for authorized parties while denying disclosure to everyone else, it satisfies both the confidentiality and usability needs implied by the stem. It additionally supports compliance mandates (for example, PCI DSS and HIPAA obligations to render stored cardholder or health data unreadable).Why the Other Options Are Wrong
Hashing (A) produces a fixed-length one-way digest used for integrity verification and password storage; the original value cannot be recovered, so it cannot protect data that must still be read and used by the business. Tokenization (B) replaces a value with a surrogate token, but the original sensitive value still exists in a token vault that must itself be protected—it reduces scope rather than encrypting the data at rest. Segmentation (D) is a network control (VLANs, subnets, microsegmentation) that limits reachability but does nothing to the bytes on a disk, so a stolen drive or misconfigured share still exposes clean plaintext. One voter abandoned the topic entirely, with Jedsturr writing "Iets EOL, keyword is Decomissioned", a remark that appears to belong to a different question and offers no support for D.Community Comment Notes
The community is effectively unanimous: SHADTECH123's highly upvoted explanation states that encryption transforms data into an unreadable format "using an algorithm and a key", and that only authorized parties holding the correct decryption key can restore the original readable form. dbrowndiver agreed that encryption is "the standard method for protecting data at rest" and tied it to regulatory compliance requirements, while Shaman73 simply recorded "C. Encryption". Nilab used the thread to ask whether the questions are still reliable ahead of an exam, a reminder that this item is a classic and recurring Security+ scenario rather than an obscure one. No commenter offered a technical argument against encryption, and the single dissenting vote for segmentation was not explained in security terms.Official Reference
Exam Strategy
When a Security+ stem contains trigger words like "at rest," "unreadable," "confidentiality," or "even if the disk is stolen," answer encryption unless the option set explicitly asks for integrity or authenticity. Eliminate network-centric answers (segmentation, zoning) immediately when the asset in question is stored data, and eliminate hashing whenever recoverability of the original value is implied.
Frequently Asked Questions
Why is hashing (A) not the right choice for making data at rest unreadable?
Hashing is a one-way function used for integrity checks and password verification, so the original value can never be recovered. Encryption hides the data while still allowing authorized decryption.
Does tokenization (B) render sensitive data at rest unreadable?
No. Tokenization swaps the real value for a surrogate token, but the original sensitive data still resides in a token vault that must be separately protected, so the stored data itself is not enciphered.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →