Security Architecture and Engineering
Architecture questions test whether you can place security requirements into a design before code exists. Know the classic design principles: least privilege, separation of duties, economy of mechanism, fail-safe defaults, complete mediation, open design, least common mechanism, psychological acceptability, and trust boundaries. A reference monitor must be tamper-proof, always invoked and verifiable; the TCB is the set of components that enforce security, and it should stay small.
Threat modeling is the core skill. STRIDE classifies threats as Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege - each maps to a countermeasure. PASTA is risk-centric and business-driven; DREAD is a scoring heuristic. Draw data-flow diagrams, mark trust boundaries, enumerate threats, then rank and mitigate. Reduce attack surface and minimise privilege wherever a new interface appears.
Cloud models and the shared responsibility line are frequently examined. In IaaS the provider secures the physical and virtualisation layer while the customer secures OS, patching, identity and data; in PaaS the provider owns the runtime and OS; in SaaS the provider owns almost everything except identity, configuration and data classification. The customer never outsources accountability.
Other engineering topics: virtualisation and container isolation (hypervisor versus shared kernel, image provenance, orchestration secrets), secure enclaves and trusted platform modules for key storage, high availability and single points of failure, and secure SDLC gates such as design review and threat modelling before build.
Traps: "open design" does not mean insecure - security should not rest on secrecy of the mechanism, only on keys. STRIDE's "Repudiation" is answered by logging and signatures, not by encryption. In cloud questions, the customer remains responsible for access management and data protection in every service model.
Worked example: for a new API, run STRIDE at the design gate: throttle for denial of service, short-lived scoped tokens for elevation, immutable audit logs for repudiation, and field-level encryption for information disclosure.