Portfolio ↗

Quiz

2741 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2741 Architecture Fundamentals81 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking86 API & Integration Architecture78 Reliability & Resilience99 Observability92 Performance & Capacity Engineering90 Security Architecture95 Cost Architecture & FinOps92 Business Architecture93 Architecture Communication91 Enterprise Architecture91 Legacy Modernization92 AI-Era Architecture96 Software Architecture & Engineering84 Architecture Patterns84 Architecture Decision-Making91 The Architect's Meta-Skills92 Delivery & Release Engineering93 Platform Engineering & Developer Experience92 Testing & Quality Architecture102 Data Platform Architecture98 Streaming & Real-Time Data93 Data Governance & Semantics91 Frontend & Experience Architecture91 Edge, Mobile & IoT88 Regulatory & Data Protection Architecture90 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

98 questions in Assurance, Audit & Model Risk.

  1. Continuous Controls Monitoring advanced

    An organisation is audited annually against controls that are tested by sampling. How should continuous controls monitoring be architected, and what changes about the assurance itself?

    2 min answer complianceautomationevidenceaudit
  2. Continuous Controls Monitoring advanced

    An organisation's controls are assessed annually and it wants continuous assurance. What changes architecturally?

    2 min answer zerodhaccmevidenceautomation
  3. Continuous Controls Monitoring advanced

    Design continuous controls monitoring for a large cloud estate. What does it monitor and how does it avoid becoming noise?

    1 min answer ccmdriftalertingcoverage
  4. Continuous Controls Monitoring advanced

    Quarterly access reviews take two weeks of manager time and everyone approves everything. How do you make this a real control?

    2 min answer accesscontrolsautomationassurance
  5. Continuous Controls Monitoring advanced

    You implement continuous controls monitoring. It immediately reports 1,800 exceptions. Is this an improvement?

    2 min answer assuranceautomationrisk
  6. Control Design vs Operation beginner Multiple choice

    A quarterly access review is documented, approved and assigned an owner. The evidence shows it was performed in January and in September, and not in the other two quarters. The auditor calls the control ineffective. The owner argues the control is well designed. Who is right?

    2 min answer controlsdesign effectivenessoperating effectivenessevidence
  7. Control Design vs Operation advanced

    An audit finds a control that is well designed and was not operating for four months. Why does that distinction matter and what causes it?

    1 min answer controlsoperating-effectivenessmonitoringevidence
  8. Control Design vs Operation beginner

    On 31 January 2017 GitLab lost about six hours of database data after an engineer removed the wrong directory during replication troubleshooting. The company had five backup and replication mechanisms. None of them produced a usable recent restore. What does that say about the difference between a control being designed and a control operating?

    2 min answer gitlabbackupscontrolsrestore-testing
  9. Design Authority advanced

    An enterprise software vendor of SAP's shape runs a central design authority: a board of nine meeting fortnightly, 40 product teams, a median of 19 days from submission to decision. Leadership wants it replaced with federated decision-making without losing the ability to say what the company's architecture is. Give the sequence.

    3 min answer design-authorityadrfederationconformance
  10. Design Authority advanced

    An interviewer says — you run architecture governance at a travel marketplace with four consumer brands acquired over a decade, each with its own stack and its own engineering leadership. The executive team wants one design authority. Where do you take this?

    3 min answer expediadesign-authoritygovernanceacquisitions
  11. Design Authority advanced

    How would you structure a design review function that improves decisions without becoming a bottleneck?

    2 min answer design-reviewadvisorystandardsturnaround
  12. Design Authority advanced

    Review this design authority. Every change above £50,000 or touching customer data goes to a board of seven that meets fortnightly. Lead time to a decision averages three weeks. Last year it reviewed 94 submissions and rejected two. Teams have started splitting work to stay under the threshold. What would you change, and what would you keep?

    2 min answer arbgovernancereviewbottleneck