Portfolio ↗

Quiz

2948 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2948 Architecture Fundamentals91 Distributed Systems101 Data Architecture90 Cloud Architecture87 Networking96 API & Integration Architecture87 Reliability & Resilience99 Observability92 Performance & Capacity Engineering100 Security Architecture105 Cost Architecture & FinOps102 Business Architecture103 Architecture Communication102 Enterprise Architecture100 Legacy Modernization102 AI-Era Architecture106 Software Architecture & Engineering93 Architecture Patterns94 Architecture Decision-Making101 The Architect's Meta-Skills102 Delivery & Release Engineering103 Platform Engineering & Developer Experience102 Testing & Quality Architecture102 Data Platform Architecture98 Streaming & Real-Time Data103 Data Governance & Semantics91 Frontend & Experience Architecture101 Edge, Mobile & IoT98 Regulatory & Data Protection Architecture99 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

5 questions in Communicating Threat Models.

  1. Communicating Threat Models advanced

    A security review hands engineering 47 findings on a five-by-five likelihood-impact matrix: 9 high, 12 medium, 26 low, each with a numeric score and a risk-accepted column that three rows already use. Nine weeks later two findings are fixed. Review this pack. What would you remove, what would you change, and what would you keep even though it looks odd?

    3 min answer threat modelfindingsrisk matrixprioritisation
  2. Communicating Threat Models intermediate

    A security review produces findings that engineering teams dispute or ignore. How should the findings be communicated to be acted on?

    2 min answer freshworkssecurityfindingscommunication
  3. Communicating Threat Models advanced

    A security team stops scoring findings on a five-by-five likelihood-impact matrix and instead writes each one as a reachable attack path with the single change that closes it. Remediation throughput triples in a quarter. What has the organisation given up, and when does that bill arrive?

    2 min answer threat-modelrisk-registersecurity-communicationaudit
  4. Communicating Threat Models intermediate

    A threat model is technically thorough and the engineering team does not act on it. What is wrong with how it is communicated?

    2 min answer threat-modelcommunicationactionabilityshopify
  5. Communicating Threat Models advanced

    How do you run a threat model that results in code changes rather than a report?

    2 min answer threat-modellingactionableprioritisationownership