Portfolio ↗

Quiz

2707 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2707 Architecture Fundamentals81 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking86 API & Integration Architecture78 Reliability & Resilience88 Observability81 Performance & Capacity Engineering90 Security Architecture95 Cost Architecture & FinOps92 Business Architecture93 Architecture Communication91 Enterprise Architecture91 Legacy Modernization92 AI-Era Architecture96 Software Architecture & Engineering84 Architecture Patterns84 Architecture Decision-Making91 The Architect's Meta-Skills92 Delivery & Release Engineering93 Platform Engineering & Developer Experience92 Testing & Quality Architecture90 Data Platform Architecture98 Streaming & Real-Time Data93 Data Governance & Semantics91 Frontend & Experience Architecture91 Edge, Mobile & IoT88 Regulatory & Data Protection Architecture90 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

28 questions in Assurance, Audit & Model Risk.

  1. Architecture Compliance Checks intermediate

    A policy-as-code gate has run in warn mode for 18 months across 400 repositories. The dashboard shows 2,300 open violations. Leadership asks you to switch it to blocking next month. What happens if you do, and what is the sequence that actually works?

    2 min answer policy-as-codegateswarn-modemigration
  2. Architecture Compliance Checks intermediate

    Which architecture requirements can be checked automatically, and which cannot?

    2 min answer marqetaautomated-checksfitness-functionsjudgement
  3. Assurance, Audit & Model Risk intermediate

    Zoom went from about 10 million daily meeting participants in December 2019 to more than 300 million in April 2020, then froze feature development for 90 days to work on security and privacy. What forced that, and which kinds of control break first when demand grows 30x in four months?

    2 min answer zoomsurgecontrolsfeature-freeze
  4. Audit Evidence intermediate

    An audit requires evidence that controls operated throughout the period. How should that evidence be produced?

    2 min answer chargebeeevidenceautomationsampling
  5. Audit Evidence intermediate

    Your organisation is preparing for its first SOC 2 audit. The security team is asking engineers for screenshots of configurations. What would you change, and what is the architectural argument?

    2 min answer complianceevidenceautomationcertification
  6. Bias & Fairness Controls intermediate

    A lending team's fairness dashboard shows approval-rate parity across protected groups, refreshed monthly, green for six months. Review it. What would you remove, what would you change, and what would you leave alone?

    3 min answer fairnessmetricsmonitoringproxies
  7. Certification Impact on Architecture intermediate

    An organisation pursues a certification. What should change in the architecture, and what should not?

    2 min answer druvacertificationcontrolsscope
  8. Certification Impact on Architecture intermediate

    Your organisation is starting SOC 2. Someone proposes scoping it to the whole estate "to be safe". What is your advice?

    2 min answer certificationscopecompliancearchitecture
  9. Continuous Controls Monitoring intermediate Multiple choice

    An annual audit tests a control by sampling 25 changes from the 10,000 made that year. Suppose 5% of changes actually violate the control. Roughly what is the probability that the sample contains at least one violation?

    2 min answer samplingassurancedetectioncontinuous-controls
  10. Exception & Waiver Management intermediate

    A platform team introduces time-boxed waivers so that teams can ship against a policy exception with a stated expiry rather than waiting for a fix. Delivery speeds up. What has the organisation given up, and when does that bill arrive?

    3 min answer waiversexceptionspolicydebt
  11. Exception & Waiver Management intermediate

    A standard cannot be met for a legitimate case. What should the exception process look like, and what does the register tell you?

    2 min answer growwexceptionswaiversregister
  12. Exception & Waiver Management intermediate

    Exceptions to standards are granted and accumulate indefinitely. What should the waiver process look like?

    1 min answer waiversexceptionsexpiryrisk-acceptance