How would you answer an interview scenario involving encryption and key management in Cloud Security?

For an interview scenario involving encryption and key management, I would first clarify the business goal, scale, constraints, and the failure or quality attribute the interviewer wants to explore. Cloud encryption protects data at rest and in transit, while key-management services control creation, storage, rotation, and use of cryptographic keys. In this scenario, a regulated workload requires customer-controlled encryption keys. Explain the architecture and operational controls you would add. For production, use provider-managed key services, TLS, managed identities, rotation, restricted key permissions, audit logs, and customer-managed keys when risk requires them. I would then explain the main alternatives and tradeoffs, identify likely failure modes, and describe how I would validate the solution through testing, observability, security controls, and recovery or rollback planning.