Portfolio ↗

Quiz

2741 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2741 Architecture Fundamentals81 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking86 API & Integration Architecture78 Reliability & Resilience99 Observability92 Performance & Capacity Engineering90 Security Architecture95 Cost Architecture & FinOps92 Business Architecture93 Architecture Communication91 Enterprise Architecture91 Legacy Modernization92 AI-Era Architecture96 Software Architecture & Engineering84 Architecture Patterns84 Architecture Decision-Making91 The Architect's Meta-Skills92 Delivery & Release Engineering93 Platform Engineering & Developer Experience92 Testing & Quality Architecture102 Data Platform Architecture98 Streaming & Real-Time Data93 Data Governance & Semantics91 Frontend & Experience Architecture91 Edge, Mobile & IoT88 Regulatory & Data Protection Architecture90 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

90 questions in Regulatory & Data Protection Architecture.

  1. Data Residency advanced

    A global payroll platform must keep certain data within specific jurisdictions. What does that force into the architecture?

    2 min answer deelremoteresidencyregional
  2. Data Residency advanced

    A product must keep certain customers' data within specific jurisdictions. What are the architectural options, and which parts are hardest?

    3 min answer residencysovereigntypartitioningmulti-region
  3. Data Residency advanced

    An e-commerce group of Flipkart's shape runs an in-India cell for regulated payment data and an EU cell for everything else. A quarterly control test samples 500 rows from the EU warehouse and finds 38 carrying Indian cardholder identifiers. The routing layer is correct and the replication topology is correct. Where do you look and in what order?

    3 min answer data-residencytelemetry-leakagedata-classificationegress-control
  4. Data Residency advanced

    Six weeks before launch, legal confirms that customer data for one market must be processed and stored in-country. The architecture is single-region in another jurisdiction. What do you do?

    3 min answer residencyregulatoryarchitecturemigration
  5. Data Subject Rights intermediate

    A regulator asks how long after an erasure request the data is genuinely gone. Production deletes in seconds; backups are daily with 35-day retention; the warehouse is fed by change data capture; the search index rebuilds weekly; three processors hold copies. Roughly what number do you give and what does it rule out?

    2 min answer erasurebackupssuppression-listcdc
  6. Data Subject Rights advanced

    Design the architecture for handling access, correction and erasure requests across a large estate.

    1 min answer dsarerasurediscoveryorchestration
  7. Data Subject Rights advanced

    You receive a subject access request. Legal says you have 30 days to produce everything you hold about this person. What does your architecture need to make that possible?

    2 min answer gdprprivacyarchitecture
  8. Data Subject Rights advanced

    Your organisation receives its first subject access request. Nobody knows where the person's data is. How do you respond within thirty days?

    2 min answer privacydsardiscoveryprocess
  9. Digital Sovereignty advanced

    A customer requires data sovereignty. What three questions do you ask before designing anything?

    2 min answer sovereigntyresidencyaccessexit
  10. Digital Sovereignty advanced

    A government customer requires that no foreign entity can access their data or compel its disclosure. What are the options and what does each cost?

    1 min answer sovereigntyjurisdictionencryptionoperations
  11. Digital Sovereignty advanced

    A public-sector customer will only accept a sovereign cloud region operated under local control. The team has treated it as a change of deployment target. What has the business actually bought and what is the bill?

    2 min answer sovereigntysovereign-cloudportabilitydivergence
  12. Digital Sovereignty advanced

    Review this claim. A public-sector tenant is served from an in-country region of a global cloud, staffed locally, with customer-managed keys in the provider's key service and a contract forbidding foreign access. The CI pipeline, the identity provider, the observability backend and the provider's operator tooling all run outside the jurisdiction. The team calls this sovereign. What would you remove, what would you change, and what would you leave alone?

    2 min answer digital-sovereigntyexternal-key-storecontrol-planekey-custody