Portfolio ↗

Quiz

2627 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2627 Architecture Fundamentals81 Distributed Systems101 Data Architecture90 Cloud Architecture77 Networking86 API & Integration Architecture78 Reliability & Resilience88 Observability81 Performance & Capacity Engineering90 Security Architecture85 Cost Architecture & FinOps82 Business Architecture93 Architecture Communication91 Enterprise Architecture91 Legacy Modernization82 AI-Era Architecture86 Software Architecture & Engineering84 Architecture Patterns84 Architecture Decision-Making91 The Architect's Meta-Skills92 Delivery & Release Engineering93 Platform Engineering & Developer Experience92 Testing & Quality Architecture90 Data Platform Architecture88 Streaming & Real-Time Data93 Data Governance & Semantics81 Frontend & Experience Architecture91 Edge, Mobile & IoT88 Regulatory & Data Protection Architecture90 Assurance, Audit & Model Risk88
Difficulty Any beginner intermediate advanced

21 questions in Security Architecture.

  1. Compliance Frameworks intermediate

    A global employment platform passes its compliance audits and is repeatedly found to have real security weaknesses. What is the gap?

    2 min answer deelcompliancecontrolsevidence
  2. Compliance Frameworks intermediate

    A vendor platform must satisfy security certification requirements while serving customers across many jurisdictions. How should compliance influence architecture without paralysing it?

    2 min answer compliancecontrolsautomationevidence
  3. Data Classification intermediate

    A consumer finance platform wants to apply controls proportionate to data sensitivity. How should classification work so it actually drives behaviour?

    2 min answer sliceclassificationcontrolsautomation
  4. Data Classification intermediate Multiple choice

    A data platform labels tables as public internal confidential or restricted in its catalogue. Six months on an auditor finds restricted columns in a dashboard that 400 people can open. Which control would have actually prevented it?

    3 min answer data classificationaccess controlgovernancemasking
  5. Data Classification intermediate

    A developer needs to reproduce a bug that only occurs with a specific customer's data. What do you allow?

    2 min answer privacyaccessoperations
  6. Data Classification intermediate

    A platform handles customer addresses, payment details, order history, retailer pricing and shopper location. Why does data classification matter architecturally, and what goes wrong without it?

    2 min answer data-classificationcontrolsresidencyretention
  7. Encryption intermediate Multiple choice

    A regulator asks whether customer data is encrypted. The team says yes, disks are encrypted. Is that a sufficient answer?

    2 min answer encryptionthreat-modelcompliance
  8. Encryption intermediate Multiple choice

    Your database is encrypted at rest. An attacker obtains valid application credentials. What does the encryption protect against?

    2 min answer encryptionthreat-modelkey-managementat-rest
  9. Identity & Access Management intermediate

    Forty developers share one service account to access a partner API because the partner charges per credential. What do you do?

    2 min answer identityattributioncontrols
  10. Security Incident Response intermediate

    At 09:00 a customer reports that a report they exported contains another customer's records. You have the on-call. Walk me through your first hour, and tell me what architectural question you would ask on day two.

    3 min answer incident responsemulti-tenancycontainmentforensics
  11. Network Security intermediate

    An enterprise wants to segment its network so that a compromised application server cannot reach the database directly. What does segmentation actually buy, and what commonly undermines it?

    2 min answer network-securitysegmentationlateral-movementdefence-in-depth
  12. OAuth 2.0 & OIDC intermediate

    A team proposes the OAuth password grant for your first-party mobile app because "it is our own app". Respond.

    2 min answer oauthmobileauthentication