Reviewed by Aditya Kumar · Last reviewed 2026-03-24
Architectural layers: (1) At rest—SSE-S3, SSE-KMS, or customer-managed keys; Azure Blob encryption. (2) In transit—TLS 1.2+; VPC endpoints to avoid public internet. (3) Access—IAM least privilege; bucket policies; Block Public Access; Lake Formation/Unity Catalog for...
Architectural layers: (1) At rest—SSE-S3, SSE-KMS, or customer-managed keys; Azure Blob encryption. (2) In transit—TLS 1.2+; VPC endpoints to avoid public internet. (3) Access—IAM least privilege; bucket policies; Block Public Access; Lake Formation/Unity Catalog for column-level. (4) Masking—tokenize PII in ETL; views with column-level security. Why layered: Defense in depth; compliance (GDPR, HIPAA). Cost: KMS adds ~$1/10K keys; VPC endpoints reduce data transfer cost. Best practice: Classify data; versioning + MFA delete for critical buckets; CloudTrail; DLP for discovery.
Red Flag: Saying 'encryption is enough' without access controls. Pro-Move: 'We use SSE-KMS, IAM policies, and Lake Formation for column-level—PII tables have separate policies; we audit quarterly.'
According to DataEngPrep.tech, this is one of the most frequently asked Cloud/Tools interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.