Threat modelling interview questions
Questions about tracing data, identifying trust boundaries and deciding which threats matter in a design. Scenarios cover existing systems as well as new features, with follow-ups on practical controls and trade-offs.
This topic has 13 opening questions and 52 follow-ups in the interview. Choose this domain in setup to practise it by voice or text.
Someone asks you to "do a threat model" of a new feature. What do you actually do first, and what does the output look like?
A new feature lets a user export all their data as a CSV, which gets emailed to them. What could go wrong?
A mobile app keeps users logged in for months. What could go wrong, and for whom?
A team is about to build an internal admin dashboard that lets support staff look up customer accounts. They have asked you to threat model it. How do you start, and what do you produce?
Product wants to add a third-party live-chat widget. It is a JavaScript snippet in the logged-in app, and the vendor's servers will see whatever the customer types. Threat model that decision.
Product wants customers to register a webhook URL. When something happens in their account — a payment, a new user, a failed login — your platform POSTs a JSON payload to that URL. Threat model that feature.
Finance wants pay-by-link: an emailed link opens an invoice and its payment page without login. Anyone holding the link can open that page. Threat model it.
You are handed the design for an internal service that issues short-lived cloud credentials to CI jobs, so that pipelines stop using long-lived static keys. Where do you focus your review?
A partner integration needs API access to your customers' data on those customers' behalf. Where do you put the trust boundary, and what do you insist on?
Services publish domain events onto an internal bus and other services subscribe. A new team wants a consumer that hears "user deleted" and cleans up its own data. Threat model it.
Forty product teams ship weekly. You have two security engineers, including yourself. How does design review actually work, and what are you deliberately choosing not to cover?
A launch is two days away and you have found something you think is serious. The team disagrees. How do you decide whether to block, and how do you handle it if you are overruled?
The company is acquiring a smaller startup. In two weeks their systems start connecting to ours. What do you find out, and what do you insist on before day one?
Each question is beginner or advanced. The tier describes the starting question; it is a practice label, not a certification. Questions by Pratik Amin.