Skip to content
AI Security

Interview question · Cryptography, PKI & TLS

Design key management with envelope encryption and a KMS for a multi-tenant service.

Data keys, key-encryption keys, tenant isolation, rotation and crypto-shredding. The design is standard; the trade-offs at each level are the interview.

hardEssentialNewPreparation tags: Amazon, Google, MicrosoftUpdated Nov 2026

Data keys, key-encryption keys, tenant isolation, rotation and crypto-shredding. The design is standard; the trade-offs at each level are the interview.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

You must encrypt terabytes of customer files in object storage for many tenants, with keys managed in a cloud KMS.

  1. Why not send every file to the KMS for encryption?
  2. How does envelope encryption work?
  3. How do tenants stay separate?
  4. How does rotation work?
  5. How can a tenant's data be deleted cryptographically?
  6. What design would you implement?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackDesign mutual TLS between internal services. How does its trust model differ from the web PKI?Next in this trackWhat problem does Certificate Transparency solve, and how would you use it defensively?Next in this trackWhy is certificate revocation hard, and what do CRLs, OCSP and short-lived certificates each trade off?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.