SY0-701 - Security Architecture (18% of the exam) - Section 3.3

Compare and contrast concepts and strategies to protect data.

Define data classification levels and the three data states - at rest, in transit, and in use - and match appropriate protections such as encryption, tokenisation, and masking to each state. Recognise how data sovereignty constraints affect where data may be stored or processed, and how classification drives the choice between encryption and less-reversible methods like masking.

data classificationdata statesdata sovereigntyencryptiontokenization and masking

Practice question for this objective

Free sampleSecurity Architecturemedium

Which option best contrasts the three states of data that protection strategies are normally designed to address?

AData at rest is stored on removable media, data in transit moves between datacentres, and data in use is the subset of records currently held by a specific business owner.
BData at rest is unencrypted by default, data in transit is encrypted by TLS, and data in use is anonymised through tokenisation before any function reads it.
CData at rest is held on persistent storage, data in transit is moving across a network path, and data in use is loaded into application memory or CPU registers for active processing. Correct
DData at rest is structured records in a database, data in transit is unstructured streams over the network, and data in use is the cached copy held by a content delivery network.

Distinguish data at rest, in transit, and in use by where the data lives at a given moment so that appropriate protections can be selected. Each state exposes the data to different threats and therefore calls for different mitigations: full-disk or database encryption for rest, TLS or IPsec for transit, and memory protection, enclaves, or careful key handling for use. Mapping the data to its current state is the first step in choosing a control.

Why A is wrong: Rest is not limited to removable media, transit is not restricted to datacentre links, and the in-use state is about active processing rather than business ownership.

Why B is wrong: The three states describe lifecycle position, not the controls applied; encryption and tokenisation are mitigations that may or may not be present in each state.

Why C is correct: The three states differ by where the data lives at a point in time, which determines the relevant protection mechanism such as disk encryption, transport encryption, or memory protection.

Why D is wrong: Structure and CDN caching are not what define the states; the distinction is whether the data is stored, moving, or being processed at the moment in question.

See more SY0-701 practice questions, answers explained.

Exam traps in Security Architecture

Answers that look right on this material and are not. Each one is a distractor from a different question in the SY0-701 bank for this domain.

Encrypting the SharePoint site at rest with platform managed keys and relying on the corporate antivirus on each laptop to protect files while they are open and in transit.
Why it is wrong: Storage-tier encryption alone leaves cleartext exposure when files are opened on a workstation or sent outside the tenant, and antivirus is a malware control rather than a confidentiality control over privileged content.
Choosing the region with the lowest end-to-end network latency to the insurer's London office, so that analyst dashboards load quickly during business hours.
Why it is wrong: Latency is a real consideration for user experience, but it is a performance concern rather than a legal one and does not address the foreign-government access risk that the legal team has flagged.
Extending the existing TLS coverage so that every connection between the analysts' notebooks and the data warehouse uses the same cipher suite as production traffic.
Why it is wrong: Stronger transport encryption is a data in transit control and does not change the fact that, once decrypted into a notebook's memory, the records are accessible to other processes on the analyst's host.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.