Portfolio ↗

Quiz

2741 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2741 Architecture Fundamentals81 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking86 API & Integration Architecture78 Reliability & Resilience99 Observability92 Performance & Capacity Engineering90 Security Architecture95 Cost Architecture & FinOps92 Business Architecture93 Architecture Communication91 Enterprise Architecture91 Legacy Modernization92 AI-Era Architecture96 Software Architecture & Engineering84 Architecture Patterns84 Architecture Decision-Making91 The Architect's Meta-Skills92 Delivery & Release Engineering93 Platform Engineering & Developer Experience92 Testing & Quality Architecture102 Data Platform Architecture98 Streaming & Real-Time Data93 Data Governance & Semantics91 Frontend & Experience Architecture91 Edge, Mobile & IoT88 Regulatory & Data Protection Architecture90 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

98 questions in Assurance, Audit & Model Risk.

  1. Security Design Review intermediate

    A security design review consistently produces findings that are expensive to act on. What is wrong with the process?

    2 min answer workosdesign-reviewtimingthreat-model
  2. Security Design Review advanced

    A security team of six supports two hundred engineers. Design reviews are a bottleneck. What do you do?

    1 min answer security-reviewscalingtriagepaved-road
  3. Security Design Review intermediate

    Security reviews happen the week before launch. Findings are usually rejected as too late to fix. How do you change this?

    2 min answer securityprocessinfluence
  4. Security Design Review intermediate

    Your security design review template asks for data flows, trust boundaries, authentication and encryption. A team submits a support assistant that reads customer ticket text and calls three internal APIs with a service account, one of which issues refunds. The template produces no findings. What would you add to it, and what would you leave alone?

    3 min answer security-design-reviewprompt-injectionconfused-deputyagents
  5. Segregation of Duties advanced

    A financial platform must demonstrate segregation of duties. What is the concrete test, and where does it usually fail?

    2 min answer brexrampsegregationcredentials
  6. Segregation of Duties advanced

    A team owns its service end to end, including deploying to production. How is segregation of duties satisfied?

    1 min answer segregation-of-dutiesdevopspipelineapproval
  7. Segregation of Duties intermediate

    An audit finds 40 engineers with permanent production database read access. The team says they need it for support. Resolve it.

    2 min answer accesscontrolsinsider-risk
  8. Segregation of Duties advanced

    On 27 July 2012 a Knight Capital technician deployed new order-routing code to seven of eight production servers. The eighth kept older code that a repurposed flag then activated on 1 August, and the firm booked a pre-tax loss of about $440 million in roughly 45 minutes. The SEC noted it had no written deployment procedures and no peer review of deployments. Which control would have prevented it, and which would only have reduced the damage?

    2 min answer knight capitaldeploymentsegregation of dutiesverification
  9. Segregation of Duties advanced

    On 5 April 2022 an Atlassian maintenance script deleted 883 customer sites belonging to 775 customers in about 23 minutes. Restoration ran until 18 April, up to 14 days for some customers, although no customer lost more than about five minutes of data. What failed, and which design decisions made that gap between deleting and restoring possible?

    2 min answer atlassianblast-radiussoft-deleterestore
  10. Three Lines Model intermediate

    An organisation adopts the three-lines model and it produces friction without assurance. What went wrong?

    2 min answer ripplingthree-linesgovernanceaccountability
  11. Three Lines Model intermediate

    How does the three lines model apply to a technology organisation, and where does it go wrong?

    2 min answer three-linesassuranceownershipindependence
  12. Three Lines Model intermediate

    How does the three-lines model apply to a modern engineering organisation, and what goes wrong when the second line is staffed by people who cannot read the systems?

    2 min answer governanceriskassuranceengineering