Service-managed vs customer-managed vs BYOK keys

WHAT THIS TESTS The interviewer wants to see that you understand encryption at rest as a spectrum of control and responsibility, and can pick a point on it based on compliance and operational capacity rather than defaulting to maximum control.

A GOOD ANSWER COVERS Service-managed keys, sometimes called provider-managed or platform-managed, are created, stored, and rotated entirely by the cloud provider. They require no effort and data is encrypted by default, but you have no visibility into the key, cannot set custom rotation or access policies, and cannot independently revoke access. Customer-managed keys live in a managed key service like AWS KMS or Azure Key Vault, but you control them: you define rotation schedules, attach access policies, get full audit logging, and can disable or delete the key to render the data unreadable, which is powerful for incident response and offboarding. The tradeoff is that you now own key lifecycle, and a misconfigured policy or deleted key can lock you out. Bring your own key goes further: you generate key material in your own hardware security module and import it into the cloud KMS, giving cryptographic provenance and meeting strict compliance or sovereignty mandates, at the highest operational cost and the risk of import or lifecycle mistakes. Some providers also offer hold your own key, where the key never leaves your premises.

COMMON WRONG ANSWERS Claiming BYOK is simply the most secure and therefore always correct, ignoring its operational burden and self-lockout risk. Thinking service-managed keys mean data is unencrypted. Confusing CMK with BYOK; CMK keys can be provider-generated but customer-controlled.

LIKELY FOLLOW-UPS How does key revocation disable data access? What is envelope encryption? What happens if you delete a CMK with data still encrypted under it?

ONE CONCRETE EXAMPLE A regulated team uses a customer-managed key in KMS so that when an employee leaves a project, revoking that key's access instantly cuts the team's ability to decrypt the dataset, with every key use recorded in the audit log.