Explain Encrypt at Rest vs In Transit vs Field-Level.

“Encrypt at rest vs in transit vs field‑level” explains where encryption is applied—at rest (storage), in transit (network), and field‑level (specific fields)—to secure data end‑to‑end. (#definition)

When to Use

At rest: disks, snapshots, backups, lost devices, cloud buckets.
In transit: user↔API, service↔service, partner links (TLS/HTTPS).
Field‑level: PII/PHI/PCI in multi‑tenant SaaS; share safely with analytics.

Example

Signup: TLS protects traffic; the database uses disk encryption; SSNs and card numbers are encrypted per column with app‑managed keys.

Want to go deeper and practice?

Explore [Grokking System Design Fundamentals], [Grokking the Coding Interview], and [Mock Interviews with ex-FAANG engineers] to cement these patterns and get feedback fast.

Why Is It Important

Limits breach blast radius, thwarts MITM, and meets GDPR/HIPAA/PCI requirements.
Enables least‑privilege data access and safer cross‑team sharing.

Interview Tips

Define all three, then compare scope, keys, and performance.
Sketch a data flow and mark where each applies; mention KMS, rotation, and envelope encryption.

Trade-offs

At rest: transparent, low effort; coarse control.
In transit: lightweight; plaintext at endpoints.
Field‑level: strongest isolation/selective sharing; more code, indexing limits, key sprawl.