Portfolio ↗

Quiz

2667 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2667 Architecture Fundamentals81 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking86 API & Integration Architecture78 Reliability & Resilience88 Observability81 Performance & Capacity Engineering90 Security Architecture95 Cost Architecture & FinOps92 Business Architecture93 Architecture Communication91 Enterprise Architecture91 Legacy Modernization92 AI-Era Architecture86 Software Architecture & Engineering84 Architecture Patterns84 Architecture Decision-Making91 The Architect's Meta-Skills92 Delivery & Release Engineering93 Platform Engineering & Developer Experience92 Testing & Quality Architecture90 Data Platform Architecture88 Streaming & Real-Time Data93 Data Governance & Semantics81 Frontend & Experience Architecture91 Edge, Mobile & IoT88 Regulatory & Data Protection Architecture90 Assurance, Audit & Model Risk88
Difficulty Any beginner intermediate advanced

6 questions in Secure API Design.

  1. Secure API Design intermediate

    A developer platform's API is used by thousands of external integrators. What security properties must be defaults rather than options?

    2 min answer postmanapi-securitydefaultsscopes
  2. Secure API Design advanced

    A marketplace API is used by sellers, buyers, internal services and third-party tools. Which security properties must be enforced at the API layer, and which must not be?

    2 min answer api-securityauthorizationrate-limitingenumeration
  3. Secure API Design advanced

    How would you make it structurally impossible for a developer to add an endpoint that returns another tenant's data?

    2 min answer multi-tenancyisolationauthorisationstructure
  4. Secure API Design advanced

    In March 2023 OpenAI disclosed that a bug in the redis-py async client let one request receive data left behind in a recycled connection, so some users saw other users' chat titles and some payment details. The authorisation code was not at fault. Which class of control was missing, and what would you change?

    3 min answer openaiconnection-poolmulti-tenancyrequest-scoped-identity
  5. Secure API Design advanced

    Review this design. Every one of 40 API endpoints checks that the caller owns the requested resource by fetching it and comparing an owner field in the controller. A penetration test found one endpoint missing the check. What would you change and what would you leave alone?

    3 min answer authorizationbolaidorapi security
  6. Secure API Design advanced

    You are reviewing a new public API before launch. What do you check, in priority order?

    2 min answer api-securityowaspreviewauthorization