Portfolio ↗

Quiz

2988 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2988 Architecture Fundamentals91 Distributed Systems111 Data Architecture100 Cloud Architecture97 Networking96 API & Integration Architecture97 Reliability & Resilience99 Observability92 Performance & Capacity Engineering100 Security Architecture105 Cost Architecture & FinOps102 Business Architecture103 Architecture Communication102 Enterprise Architecture100 Legacy Modernization102 AI-Era Architecture106 Software Architecture & Engineering93 Architecture Patterns94 Architecture Decision-Making101 The Architect's Meta-Skills102 Delivery & Release Engineering103 Platform Engineering & Developer Experience102 Testing & Quality Architecture102 Data Platform Architecture98 Streaming & Real-Time Data103 Data Governance & Semantics91 Frontend & Experience Architecture101 Edge, Mobile & IoT98 Regulatory & Data Protection Architecture99 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

3 questions in Communicating Threat Models.

  1. Communicating Threat Models advanced

    A security review hands engineering 47 findings on a five-by-five likelihood-impact matrix: 9 high, 12 medium, 26 low, each with a numeric score and a risk-accepted column that three rows already use. Nine weeks later two findings are fixed. Review this pack. What would you remove, what would you change, and what would you keep even though it looks odd?

    3 min answer threat modelfindingsrisk matrixprioritisation
  2. Communicating Threat Models advanced

    A security team stops scoring findings on a five-by-five likelihood-impact matrix and instead writes each one as a reachable attack path with the single change that closes it. Remediation throughput triples in a quarter. What has the organisation given up, and when does that bill arrive?

    2 min answer threat-modelrisk-registersecurity-communicationaudit
  3. Communicating Threat Models advanced

    How do you run a threat model that results in code changes rather than a report?

    2 min answer threat-modellingactionableprioritisationownership