Explain Encrypt at Rest vs In Transit vs Field-Level.

Example

Signup: TLS protects traffic; the database uses disk encryption; SSNs and card numbers are encrypted per column with app‑managed keys.

Want to go deeper and practice?

Explore [Grokking System Design Fundamentals], [Grokking the Coding Interview], and [Mock Interviews with ex-FAANG engineers] to cement these patterns and get feedback fast.

Why Is It Important

• Limits breach blast radius, thwarts MITM, and meets GDPR/HIPAA/PCI requirements.
• Enables least‑privilege data access and safer cross‑team sharing.

Interview Tips

• Define all three, then compare scope, keys, and performance.

• Sketch a data flow and mark where each applies; mention KMS, rotation, and envelope encryption.

Trade-offs

• At rest: transparent, low effort; coarse control.
• In transit: lightweight; plaintext at endpoints.
• Field‑level: strongest isolation/selective sharing; more code, indexing limits, key sprawl.

Pitfalls

• Thinking full‑disk encryption protects queries/DB admins.
• Forgetting backups/logs/search indexes.
• Skipping internal TLS.
• Hard‑coding keys or no rotation.
• Leaking metadata (ciphertext lengths, IDs).