What is the difference between encryption at rest and in transit, and why do you need both?
What they are really testing: Whether you understand the two distinct threats each addresses and the basics of key management, not just "turn on encryption".
A real interview question
What is the difference between encryption at rest and in transit, and why do you need both?
What most people say
drag me
“At rest is when data is stored and in transit is when it moves; you enable both for full encryption.”
It defines the terms but not the threats, and "full encryption" ignores the actual hard part: key management. It also misses that data is still plaintext in memory and to anyone with valid access.
The follow-ups they ask next
Does at-rest encryption protect against a compromised application with valid credentials?
No. The app reads decrypted data through normal access. At-rest encryption defends against stolen media/snapshots; defending against misuse of valid access is authorization and monitoring.
What is envelope encryption and why use it?
Data is encrypted with a data key, which is itself encrypted by a master key in KMS. It lets you rotate the master key and manage access centrally without re-encrypting all the data.
What the interviewer is listening for
- Names the distinct threat each covers
- Knows both are needed
- Mentions KMS/rotation/envelope encryption
What sinks the answer
- Only defines the terms
- Thinks one replaces the other
- No notion of key management
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“In transit [encrypts data on the network via TLS, against eavesdropping]; at rest [encrypts stored data, against a stolen disk or snapshot]. You need both because [they cover different attack points and neither covers the other]. The hard part is [key management: a managed KMS, rotation, envelope encryption]. Caveat: [at-rest does not stop misuse of valid access, that is authorization].”
Keep going with security
Foundation
Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
Foundation
What is the CIA triad, and why is it a useful way to think about security?
Foundation
What is the difference between authentication and authorization?
Junior
How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
Junior
What is the difference between symmetric and asymmetric encryption, and where is each used?
Mid
What does it mean to "shift security left", and how would you build security into a CI/CD pipeline?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free