Portfolio ↗

Quiz

2908 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2908 Architecture Fundamentals91 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking86 API & Integration Architecture87 Reliability & Resilience99 Observability92 Performance & Capacity Engineering100 Security Architecture95 Cost Architecture & FinOps102 Business Architecture103 Architecture Communication102 Enterprise Architecture100 Legacy Modernization92 AI-Era Architecture96 Software Architecture & Engineering93 Architecture Patterns94 Architecture Decision-Making101 The Architect's Meta-Skills102 Delivery & Release Engineering103 Platform Engineering & Developer Experience102 Testing & Quality Architecture102 Data Platform Architecture98 Streaming & Real-Time Data103 Data Governance & Semantics91 Frontend & Experience Architecture101 Edge, Mobile & IoT98 Regulatory & Data Protection Architecture99 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

6 questions in Third-Party Risk.

  1. Third-Party Risk advanced

    A consumer finance platform depends on many third parties whose failures are its regulatory problem. What must the architecture provide?

    2 min answer slicethird-partyisolationevidence
  2. Third-Party Risk beginner

    A supplier provides an ISO 27001 certificate in response to your security assessment. What does the certificate actually tell you, and what does it not?

    3 min answer certificationthird-party-riskassurancescope
  3. Third-Party Risk advanced

    A supplier's compromise gives an attacker access to your systems. What should the architecture have done?

    1 min answer third-party-risksupply-chainleast-privilegemonitoring
  4. Third-Party Risk advanced

    A support team enables an AI summarisation feature in its helpdesk tool. Three weeks later a customer asks for your list of subprocessors and a security review finds that ticket contents, including customer personal data, have been sent to a model provider in another jurisdiction with a 30-day retention default. What failed?

    3 min answer subprocessorsaidata-transferegress-control
  5. Third-Party Risk advanced

    In April 2022 a maintenance script at Atlassian permanently deleted 883 sites belonging to 775 customers inside 23 minutes, and the last customer was not restored until 18 April. Backups were fine and almost no data was lost. What made recovery the hard part, and what should that change in how you evaluate a vendor?

    2 min answer atlassianmulti-tenantrestorerto
  6. Third-Party Risk intermediate

    Your KYC verification vendor is down for six hours. Customer onboarding stops. The board asks why a vendor outage became your outage.

    2 min answer vendorsresiliencedegradation