Encryption at rest protects persisted database data on storage media, but it is not a complete defense against every form of data exposure or breach. MongoDB ' s encrypted storage capabilities protect files and storage-level data, yet applications and the database server must still process authorized data in usable form. A compromised application account, stolen database credentials, excessive privileges, or a malicious authorized user can therefore expose data even when the underlying storage is encrypted. Network traffic also requires separate transport protection such as TLS; encryption at rest does not secure data as it travels between clients and servers. Option B incorrectly describes transport encryption rather than an at-rest capability. Option A is too subjective and not an inherent limitation, particularly in managed deployments where storage encryption may be enabled automatically. Option D is similarly overstated; encryption adds cryptographic work, but severe performance impact is not an intrinsic defining limitation. The correct security model is defense in depth: combine at-rest encryption with TLS, strong authentication, least-privilege authorization, auditing, and secure key management. Among the choices, C best captures the limitation that at-rest encryption alone cannot prevent all data breaches.

Study Guide reference/topic:Security, Networking, and Encryption - encryption at rest, TLS, authorization, and defense in depth.

===========