Design the self-service interface for provisioning a database, so that developers do not file tickets and security does not object.

What the interviewer is testing

Whether you can encode control into the shape of an interface rather than into an approval step.

The design principle

The developer chooses inside a space the platform has already made safe. Control moves from a reviewer to the constraints of what the interface can produce, which is stronger — a reviewer under time pressure approves things; an interface cannot emit an option it does not have.

The interface

What the developer supplies: service name, environment, engine from an approved list, size from a small tier set (small/medium/large, not instance types), and data classification.

What the platform decides without asking: encryption at rest with managed keys, network placement in a private subnet with no public access, backups with retention derived from the classification, credentials issued through workload identity with no static password anywhere, cost tags from the service catalogue, and monitoring with default alerts.

What is deliberately not offered: public network exposure, unencrypted storage, unapproved engines, region outside the approved set, and any size beyond the tiers — the last requiring an explicit conversation, which is the one case where a human step earns its cost.

What makes security comfortable

The controls are inherent, not procedural. There is no configuration a developer can supply that produces a non-compliant database, so the compliance evidence is the interface's own definition plus the continuous compliance check confirming reality matches.

That is a stronger assurance position than ticket review, and it is worth presenting to security in exactly those terms.

The trap to avoid

Scope creep in the interface. Every additional option multiplies combinations the platform must support, and a provisioning API with forty parameters has recreated the complexity it existed to hide. Say no to options, and add them only when several teams need the same one.

What a strong answer adds

The data classification input driving downstream behaviour automatically — retention, backup, access model, residency, audit logging — so one answer configures many controls consistently.

Common weak answers

A form that files a ticket faster. Exposing the underlying cloud API with defaults, which is not a guardrail.