Q67 [Scenario]: Compliance requires encrypting sensitive fields (SSN, Credit Cards) such that even database administrators cannot read plain text. How do you satisfy this?

Implement Client-Side Field Level Encryption (CSFLE) or In-Use Encryption. The driver automatically encrypts sensitive document fields on the application client side before sending binary payloads to MongoDB. The database server stores strictly encrypted cipher-text and never possesses the decryption keys.

Key Takeaways
  • Client-Side Field Level Encryption (CSFLE) encrypts data on client drivers.
  • Database servers never see unencrypted plain text for CSFLE fields.
Knowledge Check

Which encryption mechanism encrypts data on client drivers BEFORE sending payloads to MongoDB?