1 min lesson
Encryption: in transit, at rest and where the keys live
Choose two examples from the table in "Encryption: in transit, at rest and where the keys live" and explain what each teaches you to do.
Step 1 of 2
Encryption: in transit, at rest and where the keys livename the key location or the design is incomplete
Encryption is easy to assert and easy to get wrong. The interviewer is listening for whether you know where the keys actually live, because data encrypted with a key stored next to it isn't meaningfully protected.
- Layer
- In transit
- What protects it
- TLS 1.3 client→edge, mTLS service→service
- The real question
- Where does TLS terminate and is the next hop re-encrypted or plaintext?
- Layer
- At rest
- What protects it
- Disk/object/db encryption via a KMS
- The real question
- Who can call the KMS to decrypt and is that access audited?
- Layer
- Key custody
- What protects it
- A KMS / HSM holds the key material
- The real question
- Is the key separated from the data, rotated and access-logged?
| Layer | What protects it | The real question |
|---|---|---|
| In transit | TLS 1.3 client→edge, mTLS service→service | Where does TLS terminate and is the next hop re-encrypted or plaintext? |
| At rest | Disk/object/db encryption via a KMS | Who can call the KMS to decrypt and is that access audited? |
| Key custody | A KMS / HSM holds the key material | Is the key separated from the data, rotated and access-logged? |
"It's encrypted" is not an answer. "It's encrypted with a KMS-held key that only these two roles can decrypt and every decrypt is logged" is.