Skip to content
AI Security

Interview question · Cryptography, PKI & TLS

Should all data be encrypted at rest? Which threats does it address, and which does it not?

'Yes, always' is the right default and the wrong answer. The interviewer wants the list of attackers it does nothing against.

easyNewPreparation tags: Amazon, Google, MicrosoftUpdated Nov 2026

'Yes, always' is the right default and the wrong answer. The interviewer wants the list of attackers it does nothing against.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A team says customer data is safe because the database disk is encrypted, and an AI agent with database read access is being added.

  1. What does encryption at rest protect against?
  2. What does it not protect against?
  3. What does the AI agent change?
  4. What protects data from authorised-path attacks?
  5. How should keys be handled?
  6. How would you correct the team's assumption?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackWhy is authenticated encryption the default, and what does nonce reuse break?Next in this trackDesign key management with envelope encryption and a KMS for a multi-tenant service.Next in this trackDesign mutual TLS between internal services. How does its trust model differ from the web PKI?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.