Search the practice set
126 questions, 454 terms and 400 topics in 20 areas.
60 results for “Security vs Usability”
Security vs Usability
A trade-off that is usually resolved by varying the control with the value of the action, rather than by choosing a uniform level of friction.
Containment vs Eradication
Stopping an attacker's ongoing access versus removing their foothold entirely — sequential phases with different urgency and different risks of doing them wrong.
Active-Active vs Active-Passive
Whether all regions serve traffic simultaneously, or one serves while another waits to take over — a choice about which failure mode you would rather have.
Build vs Buy
The choice between developing a capability in-house and acquiring it, decided on differentiation and total cost rather than on feature lists.
Cost vs Reliability Trade-off
The non-linear relationship between availability and spend, which makes each additional nine roughly an order of magnitude more expensive.
Delivery vs Maintainability
Choosing where to take deliberate shortcuts, based on which kinds of debt are cheap to repay and which compound.
Durability vs Availability
Two different storage guarantees — whether data survives, and whether it can be reached right now — routinely conflated because both are quoted in nines.
ETL vs ELT
Whether data is transformed before loading into the target or after it, which decides where the compute happens and how much raw history you keep.
Fail-Fast vs Fail-Safe
Whether a component should stop immediately on detecting a problem, or continue in a degraded but safe mode — a choice that depends entirely on which outcome is worse.
Hardware Security Module
A tamper-resistant device that generates and stores keys and performs cryptographic operations without the key material ever being extractable.
Horizontal vs Vertical Scaling
Adding more machines versus making one machine bigger — and the fact that vertical is underrated for stateful tiers.
Layer 4 vs Layer 7 Load Balancing
Balancing on connection metadata (IP and port) versus on the content of the request (path, host, headers).
Managed vs Self-Managed
Trading control, portability and unit cost against the operational burden of running the thing yourself.
Monolith vs Microservices
A trade of deployment independence against distributed-systems complexity, decided by team topology far more often than by technology.
OLTP vs OLAP
Two workload shapes with opposite requirements — many small indexed transactions versus few large scans and aggregations — which is why they belong in different stores.
Operational vs Analytical Store
The separation between the store serving the application's transactions and the one serving reporting and analysis, and the mechanism connecting them.
Provisioned vs Serverless Capacity
Paying for a fixed database size continuously, versus paying for capacity consumed with automatic scaling — a crossover decision driven by duty cycle.
Re-architect vs Rebuild
Restructuring an existing system incrementally versus writing a replacement from scratch — and the strong evidence that incremental wins.
SQL vs NoSQL
A choice driven by access patterns, consistency requirements and query flexibility — not by data volume, which is the reason usually given.
Security Group
A stateful, instance-level firewall that allows specified traffic and denies everything else by default.
Strong vs Eventual Consistency
A per-operation decision, not a per-system one: whether this specific read must reflect every completed write.
Synchronous vs Asynchronous Communication
Whether the caller waits for the callee's answer — decided by whether the caller's outcome depends on it, not by latency or taste.
Synchronous vs Asynchronous Replication
Whether a write is acknowledged only after a replica has it, trading write latency against the amount of data a failure can lose.
Zonal vs Regional Services
Whether a cloud resource lives in one availability zone or is inherently spread across several — a property that determines what a zone failure takes with it.
Artifact Signing
Cryptographically signing build outputs so that deployment can verify what is being run was produced by the expected pipeline from the expected source.
Attack Surface
The complete set of points where an untrusted actor can interact with a system — and the quantity that reduction genuinely reduces risk.
Auditability
The ability to reconstruct who did what, to which resource, when, and from where — reliably enough to be relied upon after the fact.
Security wants mandatory hardware keys for every login; the business says it will cost conversions. How do you resolve it architecturally rather than by picking a side?
What the interviewer is testing Whether you treat security as a fixed dial to be turned up, or as a risk proportionate design variable. Both stated positions ar
You must roll out MFA to 40,000 employees. Security wants hardware keys; the service desk fears the call volume. Design the rollout.
The framing that resolves the argument Not every identity carries the same risk, so not every identity needs the same factor. A uniform mandate is what creates
Your JWT-based auth means a fired employee keeps access for 15 minutes after their account is disabled. Security says that is unacceptable. What are the options?
Why the gap exists A signed JWT is validated locally from its signature. That is the whole benefit — no network call, no shared session store, resource servers
Your services currently trust anything inside the VPC. A security review says move to zero trust. What changes, and what will it cost you?
What the interviewer is testing Whether "zero trust" is a concrete set of changes to you, or a slogan. What actually changes Workload identity. Every service ge
A critical CVE is announced in a widely-used library. Walk me through the first four hours.
Hour 1 — determine exposure Query the SBOMs across the estate , including transitive dependencies. This is the moment that justifies having them: without, this
Anomalous access to a customer database is detected. Walk me through the first day, and say what determines whether you can answer the regulator.
The first hours Declare an incident and assign command. Named commander who does not debug, operations lead, communications lead, scribe. Security incidents add
Security vs Usability
Varying control by the value of the action rather than uniformly.
Build vs Buy
Differentiation versus table stakes, priced over five years.
Build vs Buy
Differentiation, five-year TCO, and the exit cost of each option.
Centralised vs Distributed
Shared platform leverage against team autonomy.
Cost vs Reliability
Each nine costing an order of magnitude, and pricing the failure instead.
Delivery vs Maintainability
Fast in the cheap places, careful in the expensive ones.
Firewalls & Security Groups
Default-deny, stateful rules, and restricting egress as well as ingress.
Functional vs Non-Functional
Behaviour versus quality of behaviour, and why only the second constrains structure.
Horizontal vs Vertical Scaling
Scale out for stateless, scale up first for stateful.
Layer 4 vs Layer 7
Connection-level versus request-level balancing, and what each unlocks.
Managed vs Self-Managed
Trading control and unit cost against operational attention.
Monolith vs Microservices
A team-topology decision far more often than a technology one.
Network Security
Segmentation, egress control and limiting lateral movement.
Orchestration vs Choreography
A coordinator that knows the flow, or services that react to events.
Performance vs Cost
Buying latency, and knowing what the last millisecond is worth.
Rebuild vs Re-architect
Why greenfield replacement fails, and the narrow cases where it does not.
Reliability vs Complexity
Mechanisms that add availability and add failure modes.
SQL vs NoSQL
Decided by access patterns and query flexibility, not by data volume.
Security Architecture
General material on securing an architecture.
Security Incident Response
Detection, scoping, containment and notification clocks.
Serverless vs Containers
Spiky and event-driven versus sustained throughput.
Single vs Multi-Region
Driven by RTO, RPO and residency rather than by ambition.
Strong vs Eventual Consistency
A per-operation decision, resolved by what a stale read would cost.
Supply Chain Security
Dependencies, SBOMs, build provenance and artefact signing.
Sync vs Async
Whether the caller's outcome depends on the callee's response.