Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
46 results for “Device Identity”
Hardware Backed Credential
A private key generated inside a secure element and unable to leave it, so device identity cannot be copied off the device.
Zero Touch Provisioning
A device obtaining its identity and configuration on first boot without a human configuring it, which is the only approach that scales past a few hundred units.
Device Group Rollout
Applying configuration or firmware to a fleet in ordered cohorts with health checks between them, because a bad change applied to everything at once has no remedy.
Identity and Access Management
The system of record for principals, credentials and permissions, and the policy engine that decides what each principal may do.
Workload Identity
Giving a running workload a cryptographically verifiable identity issued by the platform, so it obtains short-lived credentials without a stored secret.
Workload Identity Federation
A pipeline proving what it is with a short-lived signed token from its own platform, so no long-lived cloud credential is ever stored.
A/B Partition Update
Writing firmware to an inactive partition and switching on next boot, so a failed update falls back to the previous image rather than bricking the device.
Account Vending
Automated creation of new cloud accounts pre-configured with the organisation's networking, identity, logging, guardrails and cost allocation.
Authentication
Establishing who a principal is, to a defined level of confidence.
Client Runtime Constraint
The properties of the browser or device you do not control — CPU, network, version, extensions — which make the client a distributed system component rather than a rendering surface.
Clock Drift
Device clocks diverging from real time, which corrupts ordering, expires certificates early or late, and produces data that appears to arrive from the past.
Compute Tier Placement
Deciding which of on-device, on-premises, metro, regional or central compute a workload belongs to, from its latency, data volume and autonomy requirements.
Edge Aggregation
Summarising or filtering telemetry at the device or gateway so that only what is needed leaves, which is usually the difference between a viable and an unaffordable design.
Hardware Security Module
A tamper-resistant device that generates and stores keys and performs cryptographic operations without the key material ever being extractable.
Landing Zone
A pre-configured, governed cloud environment — accounts, networking, identity, logging, guardrails — into which workloads can be deployed safely.
Least Privilege
Granting each identity only the permissions it needs, for only as long as it needs them.
Mesh Control Plane
The component that configures and coordinates a service mesh's data plane proxies, distributing policy, identity and routing rules.
NAT Gateway
A managed device that lets instances in a private subnet make outbound connections without being reachable inbound.
OAuth 2.0
An authorisation framework that lets an application obtain scoped, delegated access to a resource without handling the user's credentials.
OpenID Connect
An identity layer over OAuth 2.0 that adds a signed ID token asserting who the user is and how they authenticated.
Permission Boundary
A policy limiting the maximum permissions an identity can have, used so that the ability to create roles does not become the ability to grant unlimited privilege.
Port Exhaustion
Running out of available source ports for outbound connections through a NAT device, causing new connections to fail while everything appears healthy.
Reported Versus Desired State
Holding two representations of a device — what it last said it was, and what it should be — with the gap between them driving reconciliation.
Service Catalogue Entry
The record that makes a service a first-class object in the platform — owner, dependencies, docs, runbooks and health in one place with a single identity.
Service Control Policy
An organisation-level guardrail that limits what any identity in an account may do, regardless of the permissions granted within that account.
Step-Up Authentication
Requiring stronger proof of identity at the moment a consequential action is attempted, rather than applying maximum friction to every session.
Zero Trust
A security model that grants no implicit trust from network position, and authenticates and authorises every request individually.
You inherit an IoT fleet of 80,000 devices whose client certificates all expire in fourteen months. What do you do?
Establish whether rotation is even possible The first question is whether the current firmware can obtain and install a new certificate remotely. If it cannot,
An OTA firmware update has bricked 3% of a 50,000-device fleet. What do you do, and what should have prevented it?
Halt immediately, then determine the correlation Stop the rollout before anything else. Then find what the 1,500 have in common: hardware revision, previous fir
An estate has database passwords in environment variables across 200 services. Design the migration to a secrets manager.
Sequence it by risk, not by convenience Phase 0 — stop the bleeding. Secret scanning in CI and on the existing repositories, blocking new commits containing cre
Your services currently trust anything inside the VPC. A security review says move to zero trust. What changes, and what will it cost you?
What the interviewer is testing Whether "zero trust" is a concrete set of changes to you, or a slogan. What actually changes Workload identity. Every service ge
Device Identity
Identifying a thing rather than a person, and rotating a credential you cannot type.
Device Provisioning
Getting identity and configuration onto hardware at manufacture or first boot.
Device Telemetry at Scale
Deciding what a device sends, how often, and what is aggregated before it leaves.
Identity & Access Management
Workload identity, roles, permission boundaries and usage-based review.
Client Feature Flags
Flag evaluation on a device you do not control, and the flicker and staleness it brings.
Edge Compute Topologies
Regional, metro, on-premises and on-device, and what each tier is genuinely for.
Edge Security & Attestation
Secure boot, hardware roots of trust, and proving what is running on a device.
Landing Zones
A governed foundation of accounts, network, identity and guardrails.
OAuth 2.0 & OIDC
Delegated authorisation, and the identity layer that makes login safe.
OTA Updates
Updating firmware over a flaky link, with rollback, and without bricking the device.
Pipeline Secrets
Short-lived credentials, workload identity, and why the CI system is a prime target.
Pseudonymisation
Separating identity from record, and the re-identification risk that remains.