Search the practice set
126 questions, 454 terms and 400 topics in 20 areas.
60 results for “Firewalls & Security Groups”
Hardware Security Module
A tamper-resistant device that generates and stores keys and performs cryptographic operations without the key material ever being extractable.
Security Group
A stateful, instance-level firewall that allows specified traffic and denies everything else by default.
Security vs Usability
A trade-off that is usually resolved by varying the control with the value of the action, rather than by choosing a uniform level of friction.
Artifact Signing
Cryptographically signing build outputs so that deployment can verify what is being run was produced by the expected pipeline from the expected source.
Attack Surface
The complete set of points where an untrusted actor can interact with a system — and the quantity that reduction genuinely reduces risk.
Auditability
The ability to reconstruct who did what, to which resource, when, and from where — reliably enough to be relied upon after the fact.
Authentication
Establishing who a principal is, to a defined level of confidence.
Authorization
Deciding whether an authenticated principal may perform a specific action on a specific resource.
Blast Radius
The set of things that break, or become reachable, when one component fails or is compromised.
Blast Radius Reduction
The set of deliberate partitions — accounts, regions, zones, cells, tenants, deployment stages — that bound how far any single failure or compromise can reach.
Cache Penetration
Repeated lookups for keys that do not exist, which miss the cache every time by definition and pass straight through to the store.
Compliance Framework
A published set of control requirements an organisation is assessed against, which turns security posture into evidence somebody else will check.
Containment vs Eradication
Stopping an attacker's ongoing access versus removing their foothold entirely — sequential phases with different urgency and different risks of doing them wrong.
Data Residency
A requirement that specific data be stored and sometimes processed only within a defined geography.
Data-Flow Diagram
A diagram of how data moves between processes, stores and external entities, with trust boundaries drawn on it.
Dwell Time
The period between an attacker gaining access and being detected — the metric that determines how much damage an intrusion can do.
Egress Filtering
Restricting which destinations a workload may connect to outbound — the control that limits data exfiltration and SSRF impact, and the one most often omitted.
Encryption at Rest and in Transit
Protecting stored data from disclosure if the medium is obtained, and network data from disclosure if the path is observed — two different controls against two different threats.
Identity and Access Management
The system of record for principals, credentials and permissions, and the policy engine that decides what each principal may do.
Image Registry
The store from which container images are pulled, and an under-appreciated availability and security dependency of every deployment and every autoscale event.
JSON Web Token
A signed, self-contained token carrying claims, which a service can validate locally without calling the issuer.
Least Privilege
Granting each identity only the permissions it needs, for only as long as it needs them.
Monzo's Microservice Estate
Monzo runs a bank on well over a thousand microservices, and the interesting engineering is in the platform and network isolation that makes that number survivable.
Non-Functional Requirement
A requirement about how well the system must behave rather than what it must do — latency, availability, throughput, security, cost.
OAuth 2.0
An authorisation framework that lets an application obtain scoped, delegated access to a resource without handling the user's credentials.
OWASP Top Ten
A periodically updated consensus list of the most critical web application security risks, useful as a design-review checklist.
OpenID Connect
An identity layer over OAuth 2.0 that adds a signed ID token asserting who the user is and how they authenticated.
Personally Identifiable Information
Data relating to an identifiable person — a category far broader than name and address, and the trigger for most regulatory obligation.
Privacy by Design
Building privacy protections into a system's structure from the start, rather than adding controls to a design that already collects and keeps everything.
Prompt Injection
An attack in which text from an untrusted source is interpreted by the model as instructions rather than as data.
STRIDE
A mnemonic for six threat categories — spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege — walked across each component and data flow.
Security wants mandatory hardware keys for every login; the business says it will cost conversions. How do you resolve it architecturally rather than by picking a side?
What the interviewer is testing Whether you treat security as a fixed dial to be turned up, or as a risk proportionate design variable. Both stated positions ar
You must roll out MFA to 40,000 employees. Security wants hardware keys; the service desk fears the call volume. Design the rollout.
The framing that resolves the argument Not every identity carries the same risk, so not every identity needs the same factor. A uniform mandate is what creates
Your JWT-based auth means a fired employee keeps access for 15 minutes after their account is disabled. Security says that is unacceptable. What are the options?
Why the gap exists A signed JWT is validated locally from its signature. That is the whole benefit — no network call, no shared session store, resource servers
Your services currently trust anything inside the VPC. A security review says move to zero trust. What changes, and what will it cost you?
What the interviewer is testing Whether "zero trust" is a concrete set of changes to you, or a slogan. What actually changes Workload identity. Every service ge
A critical CVE is announced in a widely-used library. Walk me through the first four hours.
Hour 1 — determine exposure Query the SBOMs across the estate , including transitive dependencies. This is the moment that justifies having them: without, this
Anomalous access to a customer database is detected. Walk me through the first day, and say what determines whether you can answer the regulator.
The first hours Declare an incident and assign command. Named commander who does not debug, operations lead, communications lead, scribe. Security incidents add
Consumer lag on a Kafka topic grows during peak and does not recover overnight. You add consumers and nothing improves. Why?
The mechanism Each partition is assigned to exactly one consumer within a group. With ten partitions and ten consumers, an eleventh consumer joins the group, is
Equifax was breached in 2017 through a vulnerability with a patch available two months earlier. Beyond "patch faster", what architectural and governance failures does that imply?
The case, as publicly reported Apache Struts vulnerability CVE 2017 5638 was disclosed in March 2017 with a patch available. An internet facing dispute portal a
Firewalls & Security Groups
Default-deny, stateful rules, and restricting egress as well as ingress.
Network Security
Segmentation, egress control and limiting lateral movement.
Security Architecture
General material on securing an architecture.
Security Incident Response
Detection, scoping, containment and notification clocks.
Security vs Usability
Varying control by the value of the action rather than uniformly.
Supply Chain Security
Dependencies, SBOMs, build provenance and artefact signing.
Auditability
Tamper-evident, attributed records that survive async boundaries.
Authentication
Establishing who a principal is, and how strong that claim needs to be.
Authorization
RBAC, ABAC and ReBAC, and centralising the decision but not the enforcement.
Cloud Governance
Preventive policy, tagging, quotas and cost and security guardrails.
Compliance Frameworks
SOC 2, ISO 27001, PCI DSS — scope as an architectural lever.
Data Classification
Knowing which fields are regulated, because every control depends on it.
Encryption
At rest, in transit, and at the application layer — three different threats.
Identity & Access Management
Workload identity, roles, permission boundaries and usage-based review.
Key Management
Rotation, separation of duty, envelope encryption and crypto-shredding.
OAuth 2.0 & OIDC
Delegated authorisation, and the identity layer that makes login safe.
OWASP Risks
The recurring web and API risk classes, several of which are design flaws.
Privacy Engineering
Minimisation, purpose limitation, and erasure that is implementable.
Quality Attributes
Availability, latency, throughput, security, cost — expressed as testable scenarios.