In transit: Data moving over networks. Use TLS (HTTPS). Encrypts communication between client and server. Prevents eavesdropping.
At rest: Data stored in databases, files, backups. Use AES- encryption. Cloud providers offer managed encryption (AWS KMS, GCP KMS).
In interviews: "All traffic uses HTTPS. Database has encryption at rest enabled. Sensitive fields like SSN are encrypted at the application layer with customer-specific keys."