Encryption at rest concept in MongoDB - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Encryption at Rest in MongoDB?

Encryption at Rest means that data stored on disk is encrypted to protect it from unauthorized access, even if someone gets physical access to the storage.

beginner

Why is Encryption at Rest important?

It protects sensitive data from being read by attackers if the storage device is stolen or accessed without permission.

intermediate

How does MongoDB implement Encryption at Rest?

MongoDB uses a feature called WiredTiger Encryption, which encrypts data files on disk using a key managed by the database or an external key management system.

intermediate

What is a Key Management System (KMS) in the context of Encryption at Rest?

A KMS securely stores and manages encryption keys used to encrypt and decrypt data, ensuring keys are protected and only accessible to authorized systems.

beginner

Does Encryption at Rest protect data when it is being used or transferred?

No, Encryption at Rest only protects data stored on disk. Data in use or in transit needs other protections like TLS or application-level encryption.

What does Encryption at Rest protect in MongoDB?

A Data in application memory

B Data stored on disk

C Data being sent over the network

D User passwords only

Encryption at Rest protects data stored on disk, not data in transit or in memory.

Which MongoDB storage engine supports Encryption at Rest?

A WiredTiger

B MMAPv1

C In-Memory

D None

WiredTiger supports Encryption at Rest in MongoDB.

What is the role of a Key Management System (KMS) in Encryption at Rest?

A Stores and manages encryption keys securely

B Encrypts data in transit

C Manages user authentication

D Backs up database files

A KMS securely stores and manages encryption keys used for encrypting data at rest.

Does Encryption at Rest protect data when it is being queried?

A Only for admin users

B Yes, always

C Only if TLS is enabled

D No, it only protects data on disk

Encryption at Rest protects data on disk, not data in use during queries.

What happens if someone steals the physical disk without Encryption at Rest?

A The data is automatically deleted

B They cannot access the data

C They can read the data easily

D The database locks itself

Without Encryption at Rest, stolen disks can be read by attackers.

Explain in your own words what Encryption at Rest means and why it is important in MongoDB.

Think about what happens if someone gets your database files physically.

Describe how MongoDB uses encryption keys and what role a Key Management System plays in Encryption at Rest.

Consider how keys are kept safe and used to lock/unlock data.