kms

Data keys, key-encryption keys, tenant isolation, rotation and crypto-shredding. The design is standard; the trade-offs at each level are the interview.

Both keep keys out of application memory; they differ in who you must trust and what you can prove. The scored answer chooses by threat model and requirement, not by fashion.

Every database encryption option protects against someone. The question is whether it protects against the attacker you are worried about, and most only stop thieves of disks and backups.