Your company uses a cryptographic key system to encrypt tapes. After several years of use and
thousands of tapes shipped to off-site locations, an IT audit reveals that encryption keys have
been inadvertently stored as ciphertext on file shares to which everyone in the company has read
permissions.

Which response reflects industry best practice?

A.
All data encrypted with the keys exposed as ciphertext should be considered safe.

B.
All data encrypted with the keys exposed as ciphertext and not yet sent off-site as an encrypted
tape should be re-keyed (decrypted and re-encrypted using a new key).

C.
All data encrypted with the keys exposed as ciphertext should be re-keyed (decrypted and reencrypted using a new key).

D.
All data encrypted with the keys exposed as ciphertext should be considered safe as ciphertext
is very difficult to use.

Explanation: