1. OpenTelemetry intermediate

    An organisation with several existing telemetry systems considers adopting OpenTelemetry. What does it actually solve, and what does adopting it not fix?

    2 min answer segmentopentelemetrystandardsvendor-lock-in
  2. Organisational Constraints intermediate

    Every change to a cross-team interface must be approved by an architecture forum that meets weekly with six 20-minute slots. About 14 requests arrive each week. Over the next two quarters, what happens to the queue and — more importantly — what happens to the designs themselves?

    3 min answer decision latencygovernancequeueingover-design
  3. Outbox intermediate

    A service must update its database and publish an event. Why is doing both directly incorrect, and what does the outbox pattern guarantee?

    2 min answer outboxdual-writeatomicityat-least-once
  4. Outcome Measurement intermediate

    A nine-month consolidation retired four systems and released about 0.4 FTE of support effort in each of four teams. The programme closed as a success, verified by the delivery plan. Eleven months after the business case was signed, finance reports run cost unchanged and the £1.2m annual saving nowhere in the ledger. What failed, and which decision made it possible?

    3 min answer benefitsoutcome measurementfinancedecommissioning
  5. Outcome Measurement intermediate

    A platform ships a major architectural change and declares it successful because it was delivered on time. What should have been measured?

    2 min answer outcome-measurementhypothesisevidencearchitecture
  6. Outcome Measurement intermediate

    An engineering organisation reports velocity, deployment frequency and story points. Leadership cannot tell whether the investment is working. What is missing?

    2 min answer chargebeeoutcomesmetricsdelivery
  7. OWASP Risks intermediate

    A marketplace hosts seller-generated content including descriptions, images and shop pages. Which common web risks are amplified, and what controls apply?

    2 min answer owaspxssuser-contentcsp
  8. OWASP Risks intermediate Multiple choice

    A penetration test reports that every object identifier in your API is a sequential integer and flags insecure direct object reference. Ownership is checked in shared middleware on every route. Three endpoints still returned another user's data: a bulk update that takes an array of identifiers, a nested comment fetch, and a CSV export. Where do you look first?

    3 min answer broken-access-controlidorobject-level-authorizationmiddleware
  9. Pagination & Filtering intermediate

    A list endpoint returning 2 million records times out on deep pages and returns 500 for validation failures. Fix both properly.

    2 min answer paginationcursorserrorshttp-semantics
  10. Pagination & Filtering intermediate Multiple choice

    An insurance API returns policy and claim lists that can be very large. Which pagination approach should be used, and what breaks with the obvious one?

    2 min answer ackopaginationcursorsconsistency
  11. Pagination & Filtering intermediate

    Your API issues opaque cursors for keyset pagination. Three weeks after a client stored one, you change the default sort from created_at to relevance_score. The client resumes with the old cursor. What happens, and what should happen?

    2 min answer paginationcursorsversioningsilent failure
  12. Parallel Run intermediate

    An enterprise runs old and new systems in parallel to validate the replacement. What makes a parallel run effective, and what makes it expensive theatre?

    2 min answer parallel-runverificationcomparisoncutover