Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
60 results for “Security Testing in the Pipeline”
Shift-Left Security
Moving security checks earlier so findings arrive while the author still has context, on the condition that the signal-to-noise ratio justifies it.
Artifact Signing
Cryptographically signing build outputs so that deployment can verify what is being run was produced by the expected pipeline from the expected source.
Contract Verification Gate
A provider's pipeline stage that replays every consumer's recorded expectations and fails the build if any would break.
Content Security Policy
A response header declaring which sources of script, style and other resources the browser may load, which turns a script injection from a compromise into a blocked request.
Contract Testing
Verifying that a provider satisfies the expectations each of its consumers actually relies on, without running all the services together.
Deployment Pipeline
The automated path from commit to production, structured so that each stage increases confidence and the whole is fast enough to be run on every change.
Failure Injection Testing
Deliberately introducing faults into a system under test to verify that timeouts, retries, fallbacks and circuit breakers behave as designed.
Hardware Security Module
A tamper-resistant device that generates and stores keys and performs cryptographic operations without the key material ever being extractable.
Idempotent Pipeline
A pipeline whose task can be re-run for the same input window any number of times and produce the same result.
Load Testing
Driving a system with realistic traffic at a target volume to verify it meets its performance targets before real users do.
Pipeline Anomaly Detection
Monitoring row counts, distributions, freshness and schema for unexplained change, because data pipelines fail silently far more often than they error.
Pipeline Fan-Out
Splitting independent verification work to run in parallel, bounded by what genuinely has no ordering dependency on anything else.
Pipeline Orchestration
Coordinating the execution of data tasks by dependency rather than by clock, with retries, backfill and observability built in.
Pipeline Stage Contract
What each pipeline stage promises the next — an artifact of a stated shape plus a specific claim about it that has been verified.
Replay Pipeline
A single processing path that produces both live and historical results by re-running the same code over retained input, replacing the two-path Lambda arrangement.
Retrieval Pipeline Stages
The stages that turn a user question into grounded context — query processing, retrieval, reranking and assembly — each independently tunable.
Security Group
A stateful, instance-level firewall that allows specified traffic and denies everything else by default.
Security vs Usability
A trade-off that is usually resolved by varying the control with the value of the action, rather than by choosing a uniform level of friction.
Testing Strategy Shape
The distribution of tests across levels, chosen so that feedback is fast where it can be and confidence is real where it must be.
Testing Trophy
A distribution weighted towards integration tests rather than unit tests, appropriate where most of the risk lives at boundaries rather than in logic.
A CDC pipeline feeding your warehouse falls three hours behind during a source system's batch job, and the source's transaction log retention is 24 hours. What is the risk and what do you change?
The immediate risk Lag consumes the retention window. At three hours behind against a 24 hour retention, you have 21 hours of margin. If the consumer stops enti
A nightly pipeline failed halfway and the retry produced duplicate rows. Walk me through fixing this properly.
The immediate problem The task appends rather than replacing its window , so a partial run followed by a retry writes some rows twice. The data is now wrong in
A serverless API works in testing and fails under load with connection errors. The database is at 5% CPU. Explain and fix.
The mechanism Serverless functions scale by creating independent execution environments , each with its own process and its own connection pool. Two hundred con
A team's pipeline takes 80 minutes from commit to a deployable artifact and engineers have stopped watching it. How do you approach fixing it?
Measure per stage before changing anything Get the duration of every stage over the last few hundred runs, with the distribution rather than the mean. The shape
Security requires default-deny egress across the estate. Engineering says it will cause constant outages. How do you deliver it?
Why security is right Inbound is default deny nearly everywhere. Outbound is usually wide open, on the reasoning that traffic originating inside is trusted. Tha
Security wants mandatory hardware keys for every login; the business says it will cost conversions. How do you resolve it architecturally rather than by picking a side?
What the interviewer is testing Whether you treat security as a fixed dial to be turned up, or as a risk proportionate design variable. Both stated positions ar
Three teams keep breaking each other's services with API changes. Someone proposes contract testing. How do you introduce it without a six-month programme?
Start with one pair, not with the estate Pick the pair of services that has broken each other most recently. Instrument that one relationship end to end: the co
You are handing a streaming pipeline to an operations team who have never run one. What must exist before they accept it?
The signals they will be paged on Consumer lag in time , not in messages — ten thousand messages means nothing without the rate. And alert on the derivative : g
You must roll out MFA to 40,000 employees. Security wants hardware keys; the service desk fears the call volume. Design the rollout.
The framing that resolves the argument Not every identity carries the same risk, so not every identity needs the same factor. A uniform mandate is what creates
Security Testing in the Pipeline
SAST, DAST, dependency and secret scanning, and what to do with the findings.
Non-Functional Test Strategy
Testing availability, latency, security and recovery rather than only behaviour.
Accessibility Testing
Automated checks, their ceiling, and the manual testing that has to sit above it.
CDC Pipeline Design
Building on a change stream: snapshot plus delta, tombstones, and merge into the target.
Contract Testing
Verifying what consumers actually rely on, without a shared environment.
Contract Testing at Scale
Keeping dozens of services compatible without an environment that runs all of them.
DR Testing
Restore drills, timed against the stated RTO, into a clean environment.
Edge Security & Attestation
Secure boot, hardware roots of trust, and proving what is running on a device.
Firewalls & Security Groups
Default-deny, stateful rules, and restricting egress as well as ingress.
Frontend Security
CSP, XSS, CSRF, token storage, and the trust boundary that ends at the browser.
Load Testing
Realistic data, realistic mix, and a ramp rather than a step.
Mutation Testing
Measuring whether tests would actually notice a defect, not just cover a line.
Network Security
Segmentation, egress control and limiting lateral movement.
Pipeline Architecture
Stages, fan-out, caching, and the difference between a pipeline and a long script.
Pipeline Secrets
Short-lived credentials, workload identity, and why the CI system is a prime target.
Resilience Testing
Exercising retries, breakers and fallbacks that are otherwise never run.
Row & Column-Level Security
Restricting slices of a table rather than the whole table, and where it is enforced.
Security Architecture
General material on securing an architecture.
Security Design Review
Reviewing an architecture for security while changing it is still cheap.
Security Incident Response
Detection, scoping, containment and notification clocks.
Security vs Usability
Varying control by the value of the action rather than uniformly.
Soak Testing
Long runs that surface leaks and slow degradation.
Stress Testing
Pushing past target to learn what breaks first and how it fails.
Supply Chain Security
Dependencies, SBOMs, build provenance and artefact signing.
Testing & Quality Architecture
General material on designing a testing strategy as an architectural concern.
Testing Strategies
The pyramid, and the contract tests distributed systems add to it.
Testing in Production
Synthetic transactions, dark launches and shadow traffic, done deliberately and safely.