Quiz

2667 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2667 Architecture Fundamentals81 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking86 API & Integration Architecture78 Reliability & Resilience88 Observability81 Performance & Capacity Engineering90 Security Architecture95 Cost Architecture & FinOps92 Business Architecture93 Architecture Communication91 Enterprise Architecture91 Legacy Modernization92 AI-Era Architecture86 Software Architecture & Engineering84 Architecture Patterns84 Architecture Decision-Making91 The Architect's Meta-Skills92 Delivery & Release Engineering93 Platform Engineering & Developer Experience92 Testing & Quality Architecture90 Data Platform Architecture88 Streaming & Real-Time Data93 Data Governance & Semantics81 Frontend & Experience Architecture91 Edge, Mobile & IoT88 Regulatory & Data Protection Architecture90 Assurance, Audit & Model Risk88

Difficulty Any beginner intermediate advanced

66 questions in Security Architecture.

Quiz

A critical CVE is announced in a widely-used library. Walk me through the first four hours.

A data-protection platform depends on hundreds of third-party libraries. What controls meaningfully reduce supply chain risk, and which are theatre?

A developer tools company distributes software used inside thousands of organisations. What supply chain controls matter most, and why is this threat model different from a typical SaaS?

An organisation wants to reduce software supply-chain risk. What actually reduces it, in what order, and which popular measures provide less than they appear to?

Your pipeline signs every container image. Is your supply chain secure?

Run a threat model on a new payment integration: our service calls a third-party payment provider and receives webhooks. Where are the interesting threats?

A platform uses signed tokens for service-to-service and client authentication. Which properties must be verified on every use, and what goes wrong when they are not?

A team is designing token-based authentication for a distributed system. What are the significant design decisions, and which common JWT choices cause problems later?

After a routine signing key rotation, roughly 3% of API requests start failing with 401s. The rate decays over about ten minutes and returns on the next rotation. Tokens look valid and clocks are synchronised. What is happening?

An identity provider issues tokens that applications validate locally without a network call. What does that buy, and what is the necessary consequence for revocation?

Your JWT-based auth means a fired employee keeps access for 15 minutes after their account is disabled. Security says that is unacceptable. What are the options?