2 / 7 Encryption, Keys & Secrets

Volumes at Rest

An auditor asks what your database's encrypted volumes (keys held in cloud KMS) actually protect against. Which risks does volume-level encryption at rest genuinely reduce? Select all that apply.

A

A SQL injection flaw that makes the running database return rows to the attacker

B

Credentials captured from an unencrypted network hop between the app tier and the database

C

A physical drive pulled from a decommissioned server and read on another machine

D

A raw volume snapshot copied into an account that has no permission to use the KMS key

E

A logical dump taken through the database's own export tooling with a stolen application credential