Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
60 results for “Privacy by Design”
Privacy by Design
Building privacy protections into a system's structure from the start, rather than adding controls to a design that already collects and keeps everything.
Data Minimisation
Collecting and retaining only what a stated purpose requires, which reduces both regulatory exposure and breach impact at the same time.
Design Review Trigger
The stated conditions under which a change requires security review, so that review capacity goes to what warrants it and everything else proceeds.
Differential Privacy Budget
The cumulative privacy loss permitted across all queries against a dataset, which must be tracked and exhausted rather than applied per query.
Domain-Driven Design
Modelling software around the business domain, with boundaries drawn where the language of the business changes.
Testability as a Design Property
How cheaply a system's behaviour can be observed and controlled, which is decided by architecture and largely fixed before any test is written.
Tool Schema Design
Defining the tools available to a model — names, descriptions, parameters and errors — in a way that makes correct selection likely.
Product wants to add "customers who bought this also bought" using purchase history. What does privacy by design require here?
The first question is lawful basis, not architecture Purchase history was collected to fulfil orders. Using it for recommendations is a new purpose , and purpos
Product wants to add a recommendation feature using browsing history. Legal asks for a data protection impact assessment. What does architecture need to supply?
What the assessment actually needs from architecture Legal cannot assess a feature description. They need the data facts, which only the design supplies: A data
A core mainframe system with no API supports nightly batch file exchange only. The business needs near-real-time order status. Design the integration.
Establish the real constraint "No API" usually means no API the mainframe team will build on your timeline . Find out what exists: message queue interfaces, dat
A design review presents a new event-driven platform. What cost questions do you ask before approving it?
What the interviewer is testing Whether cost is part of your architecture review or an afterthought handled by finance later, and whether you know the specific
A payments API must guarantee that a network retry never charges a customer twice. Design the mechanism end to end.
Why this is unavoidable A client that times out on a POST cannot know whether the request succeeded. Not retrying risks a lost payment; retrying risks a duplica
A platform of 40 services has logs only, and incidents take hours to diagnose. Design the observability strategy and its rollout order.
Why logs alone fail at this size Logs answer "what happened in this service". They cannot answer "where did this request spend its time across twelve services",
A product catalogue page does 40,000 reads per second against a database that can serve 5,000. Walk me through the caching design, including what happens at 3 AM when the cache is empty.
What the interviewer is testing Whether you can design a cache including its failure modes, rather than saying "put Redis in front of it". The base design Cache
A regulated client requires that no traffic between their data centre and your SaaS platform traverses the public internet. Design the connectivity and justify the cost.
Two distinct requirements hiding in one sentence Traffic must not traverse the public internet — a routing requirement. The client must be able to demonstrate i
A team shows you a design with eight services. Without knowing the domain, what questions tell you whether the boundaries are right?
What the interviewer is testing Whether you can evaluate a structure from its properties rather than needing to be a domain expert in every system you review. T
A twenty-year-old core system supports most of the business. It is on unsupported technology, three people understand it, and the last replacement attempt was abandoned after two years. Design the programme.
Learn from the abandoned attempt first The most important input is why the last one failed, and the reasons are usually structural rather than technical: a big
An estate has database passwords in environment variables across 200 services. Design the migration to a secrets manager.
Sequence it by risk, not by convenience Phase 0 — stop the bleeding. Secret scanning in CI and on the existing repositories, blocking new commits containing cre
Architecture decisions in your organisation are either ignored or bottlenecked in a review board. Design something better.
Why both failure modes have the same cause A review board is a synchronous, low bandwidth, high latency channel: teams wait, decisions are made by people distan
Classify DynamoDB, Spanner and Cassandra under PACELC, and say which half of the classification you would actually design around.
The classifications Store Partition Else Why DynamoDB (default reads) PA EL Serves from any replica; eventually consistent reads avoid a quorum round trip Cassa
Design a URL shortener handling 100 million new links per month and 10 billion redirects. Where is the real difficulty?
What the interviewer is testing The classic warm up. What is being assessed is not whether you can shorten a URL — it is whether you do capacity arithmetic befo
Design a webhook delivery system for a platform with 10,000 customers. What are the hard parts?
Delivery, and its failure modes Persist the event first, deliver asynchronously. Delivery in the request path couples your latency and availability to every cus
Design an order submission API that is safe when the client cannot tell whether its request succeeded. What exactly do you store, and when?
What the interviewer is testing Whether you know that "make it idempotent" is a design with specific failure modes, not a checkbox. The core design The client g
Design rate limiting for a multi-tenant API where a single customer's traffic spike currently degrades service for everyone.
Name the problem precisely This is the noisy neighbour problem. Rate limiting is one control for it, and on its own it is incomplete — a customer within their l
Design the audit logging for a system handling financial transactions. What is logged, where does it go, and what makes it hold up?
What is logged Significant actions only , defined explicitly rather than logging everything — an audit trail nobody can search is not usable evidence: Authentic
Design the network layout for a three-tier application in one cloud region. What are the decisions you cannot easily change later?
What the interviewer is testing Whether you know which network decisions are cheap and which are effectively permanent. This is a knowledge question with a clea
Design the timeout configuration for a request that passes through gateway, orders, pricing and inventory. What numbers, and what rule generates them?
The rule that generates the numbers One budget at the edge, decreasing inward, with room for a retry at exactly one layer. Start from what the caller will actua
In a design review, a respected senior engineer proposes an approach you believe is wrong. The room defers to them. How do you handle it?
What the interviewer is testing Whether you can be effective without authority, which is most of the architect's job. It is also testing whether you assume you
Incidents at your company are chaotic: unclear ownership, no communication, and postmortems that produce nothing. Design the improvement.
Roles, so that coordination exists The failure is everyone investigating and nobody coordinating. Ten people debugging is slower than three debugging and one di
Leadership asks for "five nines" across the platform. Engineering says it is impossible. Design the response.
Reframe the request "Five nines" is almost never what the business actually wants. 26 seconds of downtime per month is a number chosen for its rhetorical weight
Maersk rebuilt roughly 4,000 servers and 45,000 PCs in about ten days after NotPetya in 2017, and recovered its directory only because one data centre had been offline during the attack. What does this say about DR design?
The case, as publicly reported In June 2017 the NotPetya malware — destructive rather than financially motivated — propagated through Maersk's network, encrypti
Mobile conversion is 40% below desktop. Product blames the design; analytics shows users leaving before the page is usable. How do you investigate?
Get field data before touching anything A laboratory run on a developer machine measures one configuration, usually the fastest one anyone uses. Real traffic in
Placing an order must reserve stock, charge the card and create a shipment across three services. Design it, and justify why not a distributed transaction.
First: question the boundary A transaction spanning three services often means one invariant has been split across three owners. Before designing a protocol, ch
Three teams have independently chosen three different message brokers. Design the selection and governance process going forward.
Understand why it happened before correcting it Three independent choices usually mean there was no easy default, no forum for the decision, or a central proces
You are handed a design brief for a system spanning four departments. What do you do before designing anything?
Map who decides, who is affected and who can stop it Three distinct groups, frequently conflated: Decision makers — who signs off scope, budget and the trade of
You are reviewing a design for an internal tool with 200 users. It proposes Kubernetes, microservices, Kafka, a service mesh and CQRS. How do you handle the review?
What the interviewer is testing Judgement, and whether you can push back without alienating a team. Anyone can spot over engineering; the question is what you d
You must make a breaking change to an API used by 200 internal services and 40 external partners. Design the change and the migration.
First, verify it must break Many "breaking" changes are avoidable. Adding a field is safe if clients ignore unknown fields — which should be a documented expect
You must roll out MFA to 40,000 employees. Security wants hardware keys; the service desk fears the call volume. Design the rollout.
The framing that resolves the argument Not every identity carries the same risk, so not every identity needs the same factor. A uniform mandate is what creates
Your DR plan assumes a 60-second DNS TTL gives 60-second failover. Traffic to the failed region continues for 20 minutes. Explain and design something better.
Why the assumption fails TTLs are honoured inconsistently at every layer. Recursive resolvers sometimes enforce their own minimums regardless of what you publis
Your design system is used by three of eleven applications. The other eight built their own components. What do you do?
Find out where the eight bounced Interview them, and look at what they built rather than what they say. Four causes recur: It did not have what they needed. A c
A CDC pipeline feeding your warehouse falls three hours behind during a source system's batch job, and the source's transaction log retention is 24 hours. What is the risk and what do you change?
The immediate risk Lag consumes the retention window. At three hours behind against a 24 hour retention, you have 21 hours of margin. If the consumer stops enti
A GDPR erasure request arrives for a customer. Where does their data actually live, and what makes this expensive to retrofit?
Where the data lives Longer than people expect, and enumerating it is most of the work: Primary database · read replicas · caches · search indexes · analytical
A new platform must serve a public partner API, three internal front-ends with different data needs, and high-volume service-to-service traffic. Choose the API styles and defend the choice.
Resist "pick one" These are three different problems with three different consumers. Standardising on one style optimises for architectural tidiness at the expe
A regulator asks how you ensure marketing consent withdrawal is honoured everywhere. What does the architecture need to show?
The answer they want is mechanism plus evidence Not "we have a consent database". They want to see how a withdrawal reaches every system that could act on it, a
Privacy by Design
Data minimisation, default protection and purpose binding as structural decisions.
Ethics in Architecture
Privacy, accessibility, sustainability and the consequences of a design.
CDC Pipeline Design
Building on a change stream: snapshot plus delta, tombstones, and merge into the target.
Control Design vs Operation
A control that is well designed and never runs fails exactly like one that is absent.
Design Authority
How an ARB should decide, what it should not review, and how it avoids becoming a queue.
Design Patterns
Reusable solutions at code level, and when they become ceremony.
Design Systems
Components as a versioned internal product, with adoption and deprecation like any API.
Domain-Driven Design
Ubiquitous language, bounded contexts and context mapping.
Human-in-the-Loop Design
Meaningful review rather than a rubber stamp, and designing against automation bias.
Performance Test Design
Workload models, warm-up, think time, and the distribution the average hides.
Privacy Engineering
Minimisation, purpose limitation, and erasure that is implementable.
Privacy-Enhancing Technologies
Differential privacy, secure enclaves and federated computation, and what each buys.
REST Design
Resources, uniform methods, status codes and statelessness.
Secure API Design
Object-level authorisation, input validation and safe error responses.
Security Design Review
Reviewing an architecture for security while changing it is still cheap.
VPC Design
Address planning, peering and the ranges you can never resize.