Encryption at rest and in transit in HLD - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Encryption at Rest

Which of the following best describes encryption at rest in a system?

A Data is encrypted when stored on disk or persistent storage to protect it from unauthorized access.

B Data is encrypted only when it is being sent over the network between services.

C Data is encrypted only during processing in memory to prevent leaks.

D Data is encrypted only when backed up to external storage devices.

💡 Hint

Think about when data is saved and not moving.

Encryption at rest means data is encrypted when stored on disks or databases to protect it if storage is compromised.

❓ Architecture

intermediate

Choosing Encryption Methods for Data in Transit

Which encryption method is most appropriate for securing data in transit between client and server?

A Hashing passwords before storing them in the database.

B Encrypting data backups with a symmetric key.

C TLS (Transport Layer Security) protocol to encrypt network communication.

D AES encryption applied directly to stored files on the server.

💡 Hint

Consider how data moves between devices over the network.

TLS encrypts data as it travels over the network, protecting it from eavesdropping or tampering.

❓ scaling

advanced

Scaling Encryption Key Management

In a large distributed system with thousands of servers, what is the best practice to manage encryption keys for data at rest?

A Store all encryption keys locally on each server to reduce network latency.

B Use a centralized key management service (KMS) that securely stores and rotates keys.

C Hardcode encryption keys in application code for easy access.

D Generate new keys randomly on each server without sharing.

💡 Hint

Think about security and ease of key rotation across many servers.

A centralized KMS allows secure storage, controlled access, and automated key rotation, which is critical at scale.

❓ tradeoff

advanced

Tradeoffs Between Encryption Performance and Security

Which statement best describes a common tradeoff when implementing encryption at rest and in transit?

A Stronger encryption algorithms always improve performance but reduce security.

B Encryption at rest eliminates the need for encryption in transit.

C Using no encryption improves security by avoiding key management complexity.

D Encrypting data increases CPU usage and latency but improves data confidentiality.

💡 Hint

Consider how encryption affects system resources and speed.

Encryption requires extra processing, which can slow down systems, but it protects data from unauthorized access.

❓ estimation

expert

Estimating Impact of Encryption on System Throughput

A web service processes 10,000 requests per second. Enabling TLS encryption adds 5ms latency per request due to handshake and encryption overhead. What is the approximate maximum throughput (requests per second) after enabling TLS?

A About 2,000 requests per second

B About 200 requests per second

C About 5,000 requests per second

D About 10,000 requests per second

💡 Hint

Calculate how added latency affects requests per second capacity.

Each request now takes 5ms longer. Since 1 second = 1000ms, max requests = 1000ms / 5ms = 200 requests per thread. But original throughput was 10,000 req/s, so system likely has concurrency. Assuming linear scaling, throughput reduces roughly by factor of 5ms added latency.

Practice

1. What is the main purpose of encryption at rest in system design?

easy

A. To protect stored data from unauthorized access

B. To speed up data transmission over the network

C. To compress data for storage efficiency

D. To authenticate users before accessing the system

Solution

1. Step 1: Understand encryption at rest

   Encryption at rest means encrypting data when it is stored on disks or databases to prevent unauthorized access.

2. Step 2: Identify the main goal

   The main goal is to protect stored data from being read by unauthorized users if the storage is compromised.

3. Final Answer:

   To protect stored data from unauthorized access -> Option A

4. Quick Check:

   Encryption at rest = Protect stored data [OK]

Hint: Encryption at rest means securing stored data only [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking encryption at rest speeds up data
• Mixing encryption with user authentication

2. Which of the following is the correct protocol used for encryption in transit?

easy

A. AES-256

B. TLS (Transport Layer Security)

C. SHA-256

D. RSA key exchange

Solution

1. Step 1: Identify encryption in transit protocols

   Encryption in transit protects data moving over networks. TLS is the standard protocol for this purpose.

2. Step 2: Differentiate options

   AES-256 is a symmetric encryption algorithm (used for data at rest), SHA-256 is a hash function, RSA is an encryption algorithm but not a protocol for transit encryption.

3. Final Answer:

   TLS (Transport Layer Security) -> Option B

4. Quick Check:

   Encryption in transit = TLS protocol [OK]

Hint: TLS is the standard for encrypting data in transit [OK]

Common Mistakes:

• Confusing encryption algorithms with protocols
• Choosing AES or RSA as transit protocols
• Mixing hash functions with encryption

3. Consider a system where data is encrypted with AES-256 before storage and TLS is used for network communication. What is the main benefit of this design?

medium

A. Data transmission speed is maximized

B. Only stored data is protected, transmission is not

C. Data is protected both when stored and when transmitted

D. Encryption is only applied to user passwords

Solution

1. Step 1: Analyze encryption at rest with AES-256

   AES-256 encrypts data stored on disk, protecting it from unauthorized access.

2. Step 2: Analyze encryption in transit with TLS

   TLS encrypts data moving over the network, preventing interception or tampering.

3. Step 3: Combine both protections

   Using both means data is secure when stored and when sent, covering both attack surfaces.

4. Final Answer:

   Data is protected both when stored and when transmitted -> Option C

5. Quick Check:

   AES-256 + TLS = Full data protection [OK]

Hint: AES for storage + TLS for network = full data protection [OK]

Common Mistakes:

• Assuming TLS speeds up transmission
• Thinking encryption only protects passwords
• Ignoring encryption in transit

4. A developer implemented encryption in transit using HTTP instead of HTTPS. What is the main issue with this approach?

medium

A. Data is not encrypted during transmission

B. Data is encrypted but stored insecurely

C. Encryption keys are exposed in the database

D. Data is encrypted only at rest, not in transit

Solution

1. Step 1: Understand difference between HTTP and HTTPS

   HTTP transmits data in plain text, while HTTPS uses TLS to encrypt data in transit.

2. Step 2: Identify the problem with using HTTP

   Using HTTP means data is sent unencrypted, vulnerable to interception and attacks.

3. Final Answer:

   Data is not encrypted during transmission -> Option A

4. Quick Check:

   HTTP = no encryption in transit [OK]

Hint: HTTP sends data unencrypted; HTTPS encrypts it [OK]

Common Mistakes:

• Confusing encryption at rest with in transit
• Assuming HTTP encrypts data
• Thinking keys are exposed due to HTTP

5. You are designing a cloud storage system that must comply with strict security standards. Which combination best ensures data confidentiality both when stored and when accessed remotely?

hard

A. Encrypt data only during transmission using SSL 2.0

B. Use SHA-256 hashing for stored data and HTTP for data transfer

C. Store data unencrypted and rely on VPN for secure access

D. Encrypt data at rest with AES-256 and use TLS 1.3 for all client-server communication

Solution

1. Step 1: Identify strong encryption for data at rest

   AES-256 is a widely accepted strong encryption standard for stored data.

2. Step 2: Choose secure protocol for data in transit

   TLS 1.3 is the latest secure protocol for encrypting data during transmission, better than older SSL versions.

3. Step 3: Evaluate other options

   SHA-256 is a hash, not encryption; HTTP is unencrypted; VPN alone does not encrypt stored data; SSL 2.0 is outdated and insecure.

4. Final Answer:

   Encrypt data at rest with AES-256 and use TLS 1.3 for all client-server communication -> Option D

5. Quick Check:

   AES-256 + TLS 1.3 = Best practice for confidentiality [OK]

Hint: Use AES-256 for storage and TLS 1.3 for transmission [OK]

Common Mistakes:

• Using outdated SSL instead of TLS
• Confusing hashing with encryption
• Relying only on VPN without encryption