Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
60 results for “Row & Column-Level Security”
Predicate-Based Filtering
A policy that appends a filter to every query on a table based on who is asking, so one physical table serves many audiences safely.
Security Group
A stateful, instance-level firewall that allows specified traffic and denies everything else by default.
Security vs Usability
A trade-off that is usually resolved by varying the control with the value of the action, rather than by choosing a uniform level of friction.
Authentication
Establishing who a principal is, to a defined level of confidence.
Change Data Capture
Publishing a stream of a database's row-level changes by reading its replication log, without modifying the application that owns it.
Data Lineage
A record of where each dataset came from, what transformed it, and what depends on it — traced at table and ideally column level.
Grain Declaration
Stating exactly what one row of a fact table represents, before any column is chosen, because every later decision depends on it.
Abstraction Level Discipline
Keeping each diagram to a single level of zoom, and providing separate diagrams for each level rather than one diagram attempting all of them.
Consistency Level Selection
Choosing the consistency guarantee per operation rather than per system, matching the cost of coordination to the business consequence of staleness.
Content Security Policy
A response header declaring which sources of script, style and other resources the browser may load, which turns a script injection from a compromise into a blocked request.
Field-Level Encryption
Encrypting specific sensitive fields in the application before they reach the datastore, so the store never holds plaintext.
Hardware Security Module
A tamper-resistant device that generates and stores keys and performs cryptographic operations without the key material ever being extractable.
Log Level Discipline
Consistent semantics for log severity so that levels can be used for routing, alerting and cost control.
Object-Level Authorization
Checking that the caller is entitled to the specific record they requested, not merely that they may call the endpoint.
Service Level Agreement
A contractual commitment about service level, with a defined remedy — usually a service credit — when it is missed.
Service Level Indicator
The actual measurement of a service's behaviour that an objective is set against — a ratio of good events to valid events.
Service Level Objective
An internal target for a service level indicator, set below the level at which users notice, and used to decide whether to ship or to stabilise.
Shift-Left Security
Moving security checks earlier so findings arrive while the author still has context, on the condition that the signal-to-noise ratio justifies it.
Wide-Column Store
A store organised as partitions of sorted rows, designed for very high write throughput and predictable single-partition reads at large scale.
Ambassador Pattern
A helper process that handles outbound network communication on behalf of an application, adding retries, routing, security and telemetry without changing it.
Architectural Debt
Structural compromises that increase the cost of all future change, distinguished from code-level debt by being expensive and slow to repay.
Artifact Signing
Cryptographically signing build outputs so that deployment can verify what is being run was produced by the expected pipeline from the expected source.
Attack Surface
The complete set of points where an untrusted actor can interact with a system — and the quantity that reduction genuinely reduces risk.
Auditability
The ability to reconstruct who did what, to which resource, when, and from where — reliably enough to be relied upon after the fact.
Authorization
Deciding whether an authenticated principal may perform a specific action on a specific resource.
Blast Radius
The set of things that break, or become reachable, when one component fails or is compromised.
Blast Radius Reduction
The set of deliberate partitions — accounts, regions, zones, cells, tenants, deployment stages — that bound how far any single failure or compromise can reach.
A release must rename a heavily used database column and ships tonight. The team proposes doing the rename in the deployment. What is wrong, and what do you propose?
What is wrong A rename is not additive. During a rolling deployment both versions of the application run simultaneously: one expects the old name, one the new.
A team proposes storing the customer's address on every order row "so order history is accurate". Is that denormalisation or a modelling error?
The distinction that matters It is neither, quite — it is a temporal modelling requirement being solved by accident. Denormalisation duplicates a fact for perfo
Security requires default-deny egress across the estate. Engineering says it will cause constant outages. How do you deliver it?
Why security is right Inbound is default deny nearly everywhere. Outbound is usually wide open, on the reasoning that traffic originating inside is trusted. Tha
Security wants mandatory hardware keys for every login; the business says it will cost conversions. How do you resolve it architecturally rather than by picking a side?
What the interviewer is testing Whether you treat security as a fixed dial to be turned up, or as a risk proportionate design variable. Both stated positions ar
You must roll out MFA to 40,000 employees. Security wants hardware keys; the service desk fears the call volume. Design the rollout.
The framing that resolves the argument Not every identity carries the same risk, so not every identity needs the same factor. A uniform mandate is what creates
Your JWT-based auth means a fired employee keeps access for 15 minutes after their account is disabled. Security says that is unacceptable. What are the options?
Why the gap exists A signed JWT is validated locally from its signature. That is the whole benefit — no network call, no shared session store, resource servers
Your organisation is preparing for its first SOC 2 audit. The security team is asking engineers for screenshots of configurations. What would you change, and what is the architectural argument?
What is wrong with screenshots Three things, and each is worth naming separately. They evidence a moment , not a period. The auditor is assessing whether contro
Your services currently trust anything inside the VPC. A security review says move to zero trust. What changes, and what will it cost you?
What the interviewer is testing Whether "zero trust" is a concrete set of changes to you, or a slogan. What actually changes Workload identity. Every service ge
A critical CVE is announced in a widely-used library. Walk me through the first four hours.
Hour 1 — determine exposure Query the SBOMs across the estate , including transitive dependencies. This is the moment that justifies having them: without, this
A team is about to launch a public GraphQL API. What must be in place before it goes live?
Query cost control — the security requirement An arbitrary query language exposed publicly means a client can construct a query that consumes unbounded resource
Anomalous access to a customer database is detected. Walk me through the first day, and say what determines whether you can answer the regulator.
The first hours Declare an incident and assign command. Named commander who does not debug, operations lead, communications lead, scribe. Security incidents add
Row & Column-Level Security
Restricting slices of a table rather than the whole table, and where it is enforced.
Secure API Design
Object-level authorisation, input validation and safe error responses.
Abstraction Level Choice
How much to hide, and the leak that turns a helpful abstraction into a trap.
Edge Security & Attestation
Secure boot, hardware roots of trust, and proving what is running on a device.
Firewalls & Security Groups
Default-deny, stateful rules, and restricting egress as well as ingress.
Frontend Security
CSP, XSS, CSRF, token storage, and the trust boundary that ends at the browser.
Network Security
Segmentation, egress control and limiting lateral movement.
Security Architecture
General material on securing an architecture.
Security Design Review
Reviewing an architecture for security while changing it is still cheap.
Security Incident Response
Detection, scoping, containment and notification clocks.
Security Testing in the Pipeline
SAST, DAST, dependency and secret scanning, and what to do with the findings.
Security vs Usability
Varying control by the value of the action rather than uniformly.
Supply Chain Security
Dependencies, SBOMs, build provenance and artefact signing.
Architecture Styles
System-level organising shapes, and how they differ from problem-level patterns.
Auditability
Tamper-evident, attributed records that survive async boundaries.
Authentication
Establishing who a principal is, and how strong that claim needs to be.
Authorization
RBAC, ABAC and ReBAC, and centralising the decision but not the enforcement.