Portfolio ↗

Quiz

2908 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2908 Architecture Fundamentals91 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking86 API & Integration Architecture87 Reliability & Resilience99 Observability92 Performance & Capacity Engineering100 Security Architecture95 Cost Architecture & FinOps102 Business Architecture103 Architecture Communication102 Enterprise Architecture100 Legacy Modernization92 AI-Era Architecture96 Software Architecture & Engineering93 Architecture Patterns94 Architecture Decision-Making101 The Architect's Meta-Skills102 Delivery & Release Engineering103 Platform Engineering & Developer Experience102 Testing & Quality Architecture102 Data Platform Architecture98 Streaming & Real-Time Data103 Data Governance & Semantics91 Frontend & Experience Architecture101 Edge, Mobile & IoT98 Regulatory & Data Protection Architecture99 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

5 questions in Supply-Chain Provenance.

  1. Supply-Chain Provenance intermediate

    A prospective government customer asks your team to attest that your software is developed in a secure environment and that you maintain provenance data for the source code you ship. Your pipeline builds on shared runners, release tags are pushed by whoever is on duty, and nothing is attested today. Walk me through how you would answer them.

    3 min answer provenancessdfattestationslsa
  2. Supply-Chain Provenance advanced

    An auditor asks you to prove that the container running in production is the one that passed security scanning three weeks ago. What must be true?

    2 min answer supply-chainauditprovenance
  3. Supply-Chain Provenance advanced

    The xz-utils backdoor disclosed on 29 March 2024 (CVE-2024-3094) was present in the release tarballs for versions 5.6.0 and 5.6.1 but not in the equivalent state of the public git repository: the malicious build-to-host.m4 macro shipped only in the distributed archive and activated a payload hidden in test fixtures during the build. Which assumption in a normal supply-chain pipeline does this defeat, and what would have caught it?

    3 min answer xzsupply-chainprovenancereproducible-builds
  4. Supply-Chain Provenance advanced

    What does provenance add beyond signing, and what makes it usable rather than ceremonial?

    2 min answer provenanceattestationverificationinventory
  5. Supply-Chain Provenance intermediate

    Your pipeline now generates an SBOM for every build. A critical vulnerability is announced in a transitive dependency. Can you answer the question that matters?

    2 min answer sbomvulnerabilityresponse