Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
60 results for “Security Design Review”
Design Review Trigger
The stated conditions under which a change requires security review, so that review capacity goes to what warrants it and everything else proceeds.
OWASP Top Ten
A periodically updated consensus list of the most critical web application security risks, useful as a design-review checklist.
Threat Modelling
A structured exercise that identifies what can go wrong with a design, before it is built, by walking the system's trust boundaries.
Architecture Review Board
A forum that reviews significant designs against standards, risks and strategy before commitment.
Privacy by Design
Building privacy protections into a system's structure from the start, rather than adding controls to a design that already collects and keeps everything.
Review Readiness Criteria
A stated bar a design must meet before review, so the session is spent on judgement rather than on discovering that the work is not ready.
Review Scope Discipline
Stating what an architecture board does not review, which is what determines whether it stays useful or becomes a queue.
Well-Architected Review
A structured self-assessment of a workload against defined pillars — operational excellence, security, reliability, performance, cost, and sustainability.
Conformance Automation
Encoding architectural standards as automated checks, so review effort is spent on novel design decisions rather than on verifying known rules.
Failure Thinking
Making "what happens when this fails?" a standing question applied to every component and every dependency in a design.
Presenting to Engineers
Presenting a design at the level of mechanism, including the alternatives rejected and the parts you are still unsure about.
STRIDE
A mnemonic for six threat categories — spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege — walked across each component and data flow.
Technical Proposal
A written argument for a course of action, circulated for review before the work starts, structured so that disagreement surfaces early and cheaply.
Advisory Review Model
Running architecture review as a consulting service that improves designs rather than as an approval gate that permits them.
Content Security Policy
A response header declaring which sources of script, style and other resources the browser may load, which turns a script injection from a compromise into a blocked request.
Domain-Driven Design
Modelling software around the business domain, with boundaries drawn where the language of the business changes.
Hardware Security Module
A tamper-resistant device that generates and stores keys and performs cryptographic operations without the key material ever being extractable.
A design review presents a new event-driven platform. What cost questions do you ask before approving it?
What the interviewer is testing Whether cost is part of your architecture review or an afterthought handled by finance later, and whether you know the specific
Architecture decisions in your organisation are either ignored or bottlenecked in a review board. Design something better.
Why both failure modes have the same cause A review board is a synchronous, low bandwidth, high latency channel: teams wait, decisions are made by people distan
In a design review, a respected senior engineer proposes an approach you believe is wrong. The room defers to them. How do you handle it?
What the interviewer is testing Whether you can be effective without authority, which is most of the architect's job. It is also testing whether you assume you
You are reviewing a design for an internal tool with 200 users. It proposes Kubernetes, microservices, Kafka, a service mesh and CQRS. How do you handle the review?
What the interviewer is testing Judgement, and whether you can push back without alienating a team. Anyone can spot over engineering; the question is what you d
You must roll out MFA to 40,000 employees. Security wants hardware keys; the service desk fears the call volume. Design the rollout.
The framing that resolves the argument Not every identity carries the same risk, so not every identity needs the same factor. A uniform mandate is what creates
Your services currently trust anything inside the VPC. A security review says move to zero trust. What changes, and what will it cost you?
What the interviewer is testing Whether "zero trust" is a concrete set of changes to you, or a slogan. What actually changes Workload identity. Every service ge
You are reviewing a new public API before launch. What do you check, in priority order?
1. Object level authorization — check this first, on every endpoint The most common serious API vulnerability. For each endpoint accepting an identifier, verify
A team shows you a design with eight services. Without knowing the domain, what questions tell you whether the boundaries are right?
What the interviewer is testing Whether you can evaluate a structure from its properties rather than needing to be a domain expert in every system you review. T
Design a webhook delivery system for a platform with 10,000 customers. What are the hard parts?
Delivery, and its failure modes Persist the event first, deliver asynchronously. Delivery in the request path couples your latency and availability to every cus
A core mainframe system with no API supports nightly batch file exchange only. The business needs near-real-time order status. Design the integration.
Establish the real constraint "No API" usually means no API the mainframe team will build on your timeline . Find out what exists: message queue interfaces, dat
A payments API must guarantee that a network retry never charges a customer twice. Design the mechanism end to end.
Why this is unavoidable A client that times out on a POST cannot know whether the request succeeded. Not retrying risks a lost payment; retrying risks a duplica
A platform of 40 services has logs only, and incidents take hours to diagnose. Design the observability strategy and its rollout order.
Why logs alone fail at this size Logs answer "what happened in this service". They cannot answer "where did this request spend its time across twelve services",
A product catalogue page does 40,000 reads per second against a database that can serve 5,000. Walk me through the caching design, including what happens at 3 AM when the cache is empty.
What the interviewer is testing Whether you can design a cache including its failure modes, rather than saying "put Redis in front of it". The base design Cache
A regulated client requires that no traffic between their data centre and your SaaS platform traverses the public internet. Design the connectivity and justify the cost.
Two distinct requirements hiding in one sentence Traffic must not traverse the public internet — a routing requirement. The client must be able to demonstrate i
A twenty-year-old core system supports most of the business. It is on unsupported technology, three people understand it, and the last replacement attempt was abandoned after two years. Design the programme.
Learn from the abandoned attempt first The most important input is why the last one failed, and the reasons are usually structural rather than technical: a big
After a full review the CTO chooses an approach you argued against. You believe it will cause serious problems in eighteen months. What do you do?
Separate the two questions Was the decision made properly? Were the options genuinely considered, was your argument understood, was the trade off stated? If yes
An estate has database passwords in environment variables across 200 services. Design the migration to a secrets manager.
Sequence it by risk, not by convenience Phase 0 — stop the bleeding. Secret scanning in CI and on the existing repositories, blocking new commits containing cre
Classify DynamoDB, Spanner and Cassandra under PACELC, and say which half of the classification you would actually design around.
The classifications Store Partition Else Why DynamoDB (default reads) PA EL Serves from any replica; eventually consistent reads avoid a quorum round trip Cassa
Design a URL shortener handling 100 million new links per month and 10 billion redirects. Where is the real difficulty?
What the interviewer is testing The classic warm up. What is being assessed is not whether you can shorten a URL — it is whether you do capacity arithmetic befo
Design an order submission API that is safe when the client cannot tell whether its request succeeded. What exactly do you store, and when?
What the interviewer is testing Whether you know that "make it idempotent" is a design with specific failure modes, not a checkbox. The core design The client g
Design rate limiting for a multi-tenant API where a single customer's traffic spike currently degrades service for everyone.
Name the problem precisely This is the noisy neighbour problem. Rate limiting is one control for it, and on its own it is incomplete — a customer within their l
Design the audit logging for a system handling financial transactions. What is logged, where does it go, and what makes it hold up?
What is logged Significant actions only , defined explicitly rather than logging everything — an audit trail nobody can search is not usable evidence: Authentic
Design the network layout for a three-tier application in one cloud region. What are the decisions you cannot easily change later?
What the interviewer is testing Whether you know which network decisions are cheap and which are effectively permanent. This is a knowledge question with a clea
Design the timeout configuration for a request that passes through gateway, orders, pricing and inventory. What numbers, and what rule generates them?
The rule that generates the numbers One budget at the edge, decreasing inward, with room for a retry at exactly one layer. Start from what the caller will actua
Incidents at your company are chaotic: unclear ownership, no communication, and postmortems that produce nothing. Design the improvement.
Roles, so that coordination exists The failure is everyone investigating and nobody coordinating. Ten people debugging is slower than three debugging and one di
Security Design Review
Reviewing an architecture for security while changing it is still cheap.
Design Authority
How an ARB should decide, what it should not review, and how it avoids becoming a queue.
Human-in-the-Loop Design
Meaningful review rather than a rubber stamp, and designing against automation bias.
Secure API Design
Object-level authorisation, input validation and safe error responses.
FinOps Practice
Inform, optimise, operate — and cost as a design-review criterion.
Identity & Access Management
Workload identity, roles, permission boundaries and usage-based review.
OWASP Risks
The recurring web and API risk classes, several of which are design flaws.
Architecture Review Boards
Thresholds, early engagement and a real route to accept deviation.
CDC Pipeline Design
Building on a change stream: snapshot plus delta, tombstones, and merge into the target.
Code Review
Where architectural rules are enforced by people rather than by tools.
Control Design vs Operation
A control that is well designed and never runs fails exactly like one that is absent.
Design Patterns
Reusable solutions at code level, and when they become ceremony.
Design Systems
Components as a versioned internal product, with adoption and deprecation like any API.
Domain-Driven Design
Ubiquitous language, bounded contexts and context mapping.
Edge Security & Attestation
Secure boot, hardware roots of trust, and proving what is running on a device.
Firewalls & Security Groups
Default-deny, stateful rules, and restricting egress as well as ingress.
Frontend Security
CSP, XSS, CSRF, token storage, and the trust boundary that ends at the browser.