Portfolio ↗

Quiz

2908 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2908 Architecture Fundamentals91 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking86 API & Integration Architecture87 Reliability & Resilience99 Observability92 Performance & Capacity Engineering100 Security Architecture95 Cost Architecture & FinOps102 Business Architecture103 Architecture Communication102 Enterprise Architecture100 Legacy Modernization92 AI-Era Architecture96 Software Architecture & Engineering93 Architecture Patterns94 Architecture Decision-Making101 The Architect's Meta-Skills102 Delivery & Release Engineering103 Platform Engineering & Developer Experience102 Testing & Quality Architecture102 Data Platform Architecture98 Streaming & Real-Time Data103 Data Governance & Semantics91 Frontend & Experience Architecture101 Edge, Mobile & IoT98 Regulatory & Data Protection Architecture99 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

3 questions in Supply-Chain Provenance.

  1. Supply-Chain Provenance advanced

    An auditor asks you to prove that the container running in production is the one that passed security scanning three weeks ago. What must be true?

    2 min answer supply-chainauditprovenance
  2. Supply-Chain Provenance advanced

    The xz-utils backdoor disclosed on 29 March 2024 (CVE-2024-3094) was present in the release tarballs for versions 5.6.0 and 5.6.1 but not in the equivalent state of the public git repository: the malicious build-to-host.m4 macro shipped only in the distributed archive and activated a payload hidden in test fixtures during the build. Which assumption in a normal supply-chain pipeline does this defeat, and what would have caught it?

    3 min answer xzsupply-chainprovenancereproducible-builds
  3. Supply-Chain Provenance advanced

    What does provenance add beyond signing, and what makes it usable rather than ceremonial?

    2 min answer provenanceattestationverificationinventory