Portfolio ↗

Quiz

2707 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2707 Architecture Fundamentals81 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking86 API & Integration Architecture78 Reliability & Resilience88 Observability81 Performance & Capacity Engineering90 Security Architecture95 Cost Architecture & FinOps92 Business Architecture93 Architecture Communication91 Enterprise Architecture91 Legacy Modernization92 AI-Era Architecture96 Software Architecture & Engineering84 Architecture Patterns84 Architecture Decision-Making91 The Architect's Meta-Skills92 Delivery & Release Engineering93 Platform Engineering & Developer Experience92 Testing & Quality Architecture90 Data Platform Architecture98 Streaming & Real-Time Data93 Data Governance & Semantics91 Frontend & Experience Architecture91 Edge, Mobile & IoT88 Regulatory & Data Protection Architecture90 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

8 questions in Assurance, Audit & Model Risk.

  1. Audit Evidence beginner Multiple choice

    Your assurance report covers a twelve-month observation window ending 31 March. In February the assessor asks for the pipeline record of every production deploy in that window. CI build logs are kept 90 days and the cloud audit trail 90 days. What do you fix?

    3 min answer audit-evidenceretentionsoc2evidence-by-construction
  2. Bias & Fairness Controls beginner Multiple choice

    A team removes the ethnicity field from a credit model's training data and tells the risk committee the model can no longer discriminate. What is the most accurate response?

    2 min answer fairnessproxy-variablesunawarenessmonitoring
  3. Change Advisory vs Automated Gates beginner Multiple choice

    A change advisory board meets weekly and approves about 60 changes in a 40-minute meeting. Attendance is good and the minutes are complete. What assurance does the meeting actually provide?

    3 min answer change managementcabapprovalthroughput
  4. Control Design vs Operation beginner Multiple choice

    A quarterly access review is documented, approved and assigned an owner. The evidence shows it was performed in January and in September, and not in the other two quarters. The auditor calls the control ineffective. The owner argues the control is well designed. Who is right?

    2 min answer controlsdesign effectivenessoperating effectivenessevidence
  5. Control Design vs Operation beginner

    On 31 January 2017 GitLab lost about six hours of database data after an engineer removed the wrong directory during replication troubleshooting. The company had five backup and replication mechanisms. None of them produced a usable recent restore. What does that say about the difference between a control being designed and a control operating?

    2 min answer gitlabbackupscontrolsrestore-testing
  6. Human-in-the-Loop Design beginner Multiple choice

    A claims system shows the reviewer a risk score of 0.87, the recommendation Reject, and a confirm button with the recommendation already selected. Median time on screen is 4 seconds. Audit records this as human oversight. What is the smallest change that makes the oversight real?

    2 min answer human-in-the-loopautomation-biasoversightui-as-control
  7. Model Documentation beginner

    A team is asked to produce documentation for a model that scores loan applications. They propose a technical write-up of the architecture and the training data. What is missing, who actually reads this document, and what is it not?

    2 min answer model-cardsdocumentationgovernanceintended-use
  8. Three Lines Model beginner Multiple choice

    Your payroll SaaS vendor emails its SOC 2 Type II report covering January to December. The risk committee marks the vendor risk as covered and closes the item. What has that report actually given you?

    3 min answer soc2third-party-riskcuecassurance