Portfolio ↗

Quiz

2741 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2741 Architecture Fundamentals81 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking86 API & Integration Architecture78 Reliability & Resilience99 Observability92 Performance & Capacity Engineering90 Security Architecture95 Cost Architecture & FinOps92 Business Architecture93 Architecture Communication91 Enterprise Architecture91 Legacy Modernization92 AI-Era Architecture96 Software Architecture & Engineering84 Architecture Patterns84 Architecture Decision-Making91 The Architect's Meta-Skills92 Delivery & Release Engineering93 Platform Engineering & Developer Experience92 Testing & Quality Architecture102 Data Platform Architecture98 Streaming & Real-Time Data93 Data Governance & Semantics91 Frontend & Experience Architecture91 Edge, Mobile & IoT88 Regulatory & Data Protection Architecture90 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

98 questions in Assurance, Audit & Model Risk.

  1. Certification Impact on Architecture advanced Multiple choice

    An online retailer collects card numbers in a form on its own checkout page and posts them to a payment provider. 240 engineers can deploy the checkout service and the annual PCI DSS assessment is consuming three months of engineering time. Which single change most reduces the assessed scope?

    3 min answer pci-dssscope-reductiontokenisationcertification
  2. Certification Impact on Architecture intermediate

    An organisation pursues a certification. What should change in the architecture, and what should not?

    2 min answer druvacertificationcontrolsscope
  3. Certification Impact on Architecture advanced

    An organisation pursues a security certification. How should that change the architecture, and how should it not?

    2 min answer certificationcontrolsscopearchitecture
  4. Certification Impact on Architecture advanced

    How does pursuing a certification change how you design, beyond adding controls?

    2 min answer certificationscopeboundariesevidence
  5. Certification Impact on Architecture intermediate

    Your organisation is starting SOC 2. Someone proposes scoping it to the whole estate "to be safe". What is your advice?

    2 min answer certificationscopecompliancearchitecture
  6. Change Advisory vs Automated Gates beginner Multiple choice

    A change advisory board meets weekly and approves about 60 changes in a 40-minute meeting. Attendance is good and the minutes are complete. What assurance does the meeting actually provide?

    3 min answer change managementcabapprovalthroughput
  7. Change Advisory vs Automated Gates advanced

    A change advisory board reviews all production changes. Engineering wants automated gates. What is the actual trade?

    1 min answer change-managementcabautomationrisk
  8. Change Advisory vs Automated Gates advanced

    A payments and ride-hailing platform of Grab's shape replaced its weekly change advisory board with automated gates fourteen months ago. At 23:40 a configuration change reaches production through the emergency path and skips the canary stage. By 23:46 card authorisations are failing in two markets; recovery takes 51 minutes. The review finds that 38% of production changes in the previous quarter used the emergency path, median approval 90 seconds by whoever was on call. What failed?

    3 min answer change-controlbreak-glassdeployment-gatescoverage
  9. Change Advisory vs Automated Gates advanced

    An organisation's change advisory board is slow and, by its own incident data, is not preventing failures. What should replace it, and what genuinely requires human review?

    2 min answer change-managementgatesautomationdora
  10. Change Advisory vs Automated Gates advanced

    How would you replace a change advisory board without weakening control?

    2 min answer change-managementautomationgatesevidence
  11. Change Advisory vs Automated Gates advanced

    Reddit's 14 March 2023 outage ran 314 minutes after a Kubernetes 1.23 to 1.24 upgrade removed the node-role.kubernetes.io/master label that Calico route reflector selectors depended on, and Kubernetes has no supported downgrade. Sequence the next cluster upgrade so a gate can actually block it.

    3 min answer redditkubernetesupgradeautomated-gates
  12. Continuous Controls Monitoring intermediate Multiple choice

    An annual audit tests a control by sampling 25 changes from the 10,000 made that year. Suppose 5% of changes actually violate the control. Roughly what is the probability that the sample contains at least one violation?

    2 min answer samplingassurancedetectioncontinuous-controls