Interview questions
Why security is different
1What is the narrowest-waist rule for access control?
A control only binds at the narrowest point that every access must pass through. Anything enforced above that point, such as a view or a grant, is merely documentation if there is a more direct path to the bytes.
Read moreThe boundary that matters mostViews as security boundaries
2What does it mean that disclosure is monotone?
You can add restrictions later, but you cannot undo something already disclosed. So controls must be in place before the read happens.
Read moreTwo rules this mechanism keeps using
Identity and authorization
3Why is a bearer token not inherently safer than a password?
It is a password with an expiry date: whoever holds it has the access. Its safety comes only from a short lifetime and a narrow scope.
Read moreBearer tokens: what they give up
4What problem does OAuth solve, and what does OpenID Connect add?
OAuth delegates access without sharing a credential. OpenID Connect adds an identity token, because an access token on its own does not prove who the user is.
5Why is workload identity better than a stored service secret?
The platform attests where the code is running and issues it a short-lived token, so no long-lived secret sits on disk waiting to be copied or stolen.
Read moreWorkload identity
6Why does role-based access control break down when access depends on many dimensions?
If access depends on d independent dimensions, you need about 2^d roles to cover the combinations: 11 dimensions means 2,048 roles.
Read moreRBAC: roles assume low rank
7What do you lose when you move from role-based to attribute-based access control?
The ability to answer "who can read this?" with a lookup. It becomes a satisfiability question over everyone's current attributes.
Read moreABAC: compress by rule
Where access is enforced
8How can row-level security make a query slower?
The security predicate becomes part of the query plan. If it does not follow the partition or clustering key, no files can be skipped, so a user entitled to 0.1% of rows can still cause a full scan.
Read moreRow- and column-level security
9Why is a view not a security boundary on its own?
Only if the engine is the sole path to the bytes, and the optimizer cannot leak data through the order in which it evaluates things. Otherwise the storage permission is the real boundary.
Read moreViews as security boundaries
10Why do permissions accumulate over time?
The cost of a grant is paid once, by the person who needs it; the cost of removing it falls later on someone else. So access gets granted and never revoked. Grants that expire, and periodic re-attestation, counter this.
11What is credential vending, and why use it?
The catalog issues each query short-lived credentials scoped to one table's storage path. That closes the hole of direct storage access and limits how much one leaked credential exposes.
Protecting the bytes
12Why does 'encrypted at rest' not prevent most breaches?
Full-disk encryption protects only against losing the physical medium. Anyone who comes in through the operating system, with a stolen credential or as an insider, gets the data decrypted transparently.
Read moreEncryption at rest
13Why is envelope encryption used?
A key-management service works at request rates, while bulk data moves at GB/s. So a local data key encrypts the bulk data, and the key service only wraps and unwraps that small key.
Read moreEnvelope encryption
14What does key rotation not do?
It does not undo a past compromise. And rotating only the wrapping key leaves the data keys, and the encrypted bytes on disk, unchanged.
15What is crypto-shredding?
Deleting data by destroying its key, which makes every copy unreadable, including copies you do not know about. It requires a key per person, and losing a key then means losing the data.
Read moreCrypto-shredding
16Why does hashing a phone number not anonymize it?
There are only about 10¹⁰ possible phone numbers, so every one can be hashed and looked up in seconds. The strength of the hash does not matter when the input has so little entropy.
Read moreHashing and salting identifiers
17Is pseudonymized data still personal data?
Yes. Under GDPR it remains personal data, because the means of re-identifying people still exist.
Read moreTokenization and pseudonymization
18Why must encryption be authenticated?
Without authentication, ciphertext can be modified in predictable ways without detection. Use authenticated encryption (AEAD), which encrypts and checks integrity together.
Read moreThe protection gaps
19Why is reusing a nonce a particular risk in data platforms?
Parallel writers and retried tasks are exactly what tends to reuse a nonce under the same key, which breaks stream and counter encryption modes. Derive nonces from a unique task-attempt ID, or use random 96-bit nonces with a bounded number of messages per key.
Read moreThe protection gaps
Privacy
20How can a system that is encrypted and access-controlled still leak personal data?
Privacy mechanisms exist for the case where every access is authorized and every byte is legitimately decrypted, yet the output still reveals individuals. The leak is a property of what the data means, not of who read it.
21What is a quasi-identifier, and why does removing names not anonymize data?
An attribute, such as postcode, birth date or sex, that identifies nobody on its own but forms a fingerprint in combination. When the number of possible combinations far exceeds the population, almost every row is unique.
22What does k-anonymity guarantee, and how is it achieved?
Every combination of quasi-identifiers appears at least k times, so linking the data to an outside source returns at least k candidates. It is achieved by generalizing values (an age band instead of an age) and suppressing outliers.
Read moreK-anonymity
23Name four ways k-anonymity fails.
Homogeneity (all k rows share the sensitive value); skew and semantic closeness of the sensitive values; composition across several releases; and high dimensionality, where generalization destroys the data.
Read moreFour ways k-anonymity fails
24What do l-diversity and t-closeness add to k-anonymity?
l-diversity requires at least l distinct sensitive values in each group; t-closeness requires each group's distribution to be close to the overall one. Each patches the previous attack, so the series never ends.
Read moreFour ways k-anonymity fails
25Why is an interface that only answers aggregate queries not safe?
Differencing: the sum over everyone minus the sum over everyone except one person gives that person's value. With arbitrary filters, the answers form a system of equations that can reconstruct the database. Minimum group sizes and query auditing both fail to stop it.
Read moreDifferencing and the query interface
26State the guarantee of differential privacy in plain words.
For any two datasets differing in one person, the probability of any output changes by at most a factor of e^ε. So whether you take part has a bounded effect on what anyone can learn, whatever else the adversary knows.
Read moreDifferential privacy
27How much noise does a differentially private count need, and why is it poor for small groups?
The noise scale is sensitivity ÷ ε, so about 1/ε for a count, whatever the data size. At ε = 0.5 the error is about 2: negligible on 100 million, about 40% on a count of 5.
28What does it mean that only bounds compose, not states?
"This table is k-anonymous" is a state of one table, and says nothing about two tables released together. "This process spends at most ε" is a bound, and bounds add up across releases.
Read moreIt composes, with arithmetic
29Why is a privacy budget unlike other resources?
It is used up by reading and never refills. With a total budget of 1.0 and 0.1 per query, you get 10 queries, ever. It needs rules for allocating it and for when data expires.
Read moreThe budget is finite and it depletes
30What is the difference between event-level and user-level differential privacy?
Event-level privacy protects a single event, so a user with 1,000 events gets a guarantee about 1,000 times weaker. User-level privacy requires bounding each user's total contribution to any answer.
Read moreHonest limits of DP
31Why is data minimization the strongest privacy control, and also the least applied?
Data never collected cannot leak, be subpoenaed or need deleting. But it runs against "collect everything" and schema-on-read, and nothing in the system enforces it, so it has to be legislated.
32Why is the right to be forgotten a reachability problem?
A person's data lives in raw and derived tables, caches, backups, extracts, reverse-ETL targets, logs and models. Erasure must follow the lineage graph, and can only be as complete as the lineage.
Read moreRight to be forgotten
33Why do data clean rooms not fully solve privacy?
Multi-party computation protects the inputs, not the outputs. An intersection of size one, or a probing list of inputs, reveals individuals, and the output controls are thresholds, which repeated queries defeat.
34Is synthetic data private?
Only if the generator is trained with differential privacy. A faithful generator memorizes rare records. Training with differential privacy makes it safe but destroys the tail of the distribution, so it suits testing better than analysis.
Read moreSynthetic data
Where controls break
35Name five kinds of adversary, and one control that stops each.
- An external attacker: authentication.
- A malicious insider: least privilege, egress control and detection.
- A careless insider: safe defaults and limits on blast radius.
- The platform operator: keys held by the client, or confidential computing.
- An authorized analyst: privacy mechanisms.
Read moreName the adversary first
36With an access-decision cache in place, what is your real revocation time?
The cache's lifetime, not the time to update the policy. A 15-minute cache lets a fired employee keep reading for up to 15 minutes.
Read moreThe identity gaps
38Why does encryption not solve data residency?
The concern is whether a foreign authority can legally compel access, not whether the bytes are readable. Every control is bounded by the jurisdiction of the place that enforces it.
Read moreResidency and sovereignty
39Why must detection be a separate control surface?
Prevention fails silently. Only detection makes controls testable, and its value is measured in time to detect.
Read moreDetection and accountability
40Should you compress then encrypt, or encrypt then compress?
Compress first: encrypted data looks random and cannot be compressed. A small leak remains even in the right order, because the length of the ciphertext reveals the compressed length, which attacks such as CRIME and BREACH exploit.
Read moreCompression and length