questionnaire asks if our data is encrypted at rest how do I know that

Encryption at rest and in transit are two different questions

The question "is data encrypted at rest" specifically concerns encryption at rest — data on disk, in the database, in backups. That is a different box than encryption in transit (TLS in data traffic), and many questionnaires ask for both separately, even if the wording combines them. So check whether the questionnaire expects one answer or actually verifies two separate claims. For "yes" you must be able to demonstrate that it applies to the systems relevant for the service to that customer — not that it is like that everywhere in your IT landscape.

Proof is usually one of three things: a configuration export or screenshot from your cloud provider (for example encryption-at-rest enabled by default on AWS RDS or Azure Storage), an extract from your ISO 27001 Statement of Applicability if the organisation is ISO 27001-certified is, or a passage from your own cryptography policy. If you have no separate policy, then "no, no separate document" is the honest answer — a technical measure without documented policy behind it is a different risk than no encryption, and you are entitled to make that distinction in your explanation. Encryption is often included in the broader sense under policy on cryptography and encryption, so if that question appears in the same list, you use the same proof for both.

Where this falls under the ten measures

Cryptography and encryption are mentioned as a separate measure in Article 21(2) of the NIS2 Directive, alongside, among others, access control and incident handling. In ISO 27001 Annex A, encryption is a separate control measure within the cryptography domain — which is why auditors ask for separate proof of it, even if your general security policy already addresses the subject. If you yourself fall under the Cybersecurity Act, this is one of the points for which you as an entity under the NIS2 Directive account for yourself, not only towards customers who ask for it.