Bird
Raised Fist0

Security Fundamentals - AuthN, AuthZ, Encryption at Rest and in Transit

HLDmediumInterview freq: high
Choose your preparation mode4 modes available
ArchitectureTraceChallenge
▶
Request Trace
Step 1/7
AuthN Service

Validate user credentials

Receives login request, checks username/password

Protocol:HTTPS
BeforeClient App has user credentials ready to send
AfterCredentials validated or rejected by AuthN Service
Token Service

Issue authentication token

Generates JWT token and caches it in Redis

Protocol:RPC
BeforeUser credentials validated by AuthN Service
AfterToken generated and stored in Redis Token Cache
Redis Token Cache

Cache token for quick validation

Stores token with TTL for reuse

Protocol:Redis GET/SET
BeforeToken generated but not cached
AfterToken cached with expiration for fast lookup
AuthZ Service

Authorize token for resource access

Validates token and checks permissions via Policy Store

Protocol:RPC
BeforeToken presented by client for resource access
AfterAuthorization decision made based on policies
Policy Store

Retrieve authorization policies

Returns user permissions for requested resource

Protocol:DB Query
BeforeAuthZ Service requests policies for user
AfterPolicies returned to AuthZ Service
Audit Logging

Log authentication and authorization events

Records user login and access attempts

Protocol:HTTPS
BeforeAuthN and AuthZ decisions completed
AfterSecurity events durably logged
Encryption Key Management

Provide encryption keys

Supplies keys for encrypting data at rest and transit

Protocol:HTTPS
BeforeData ready for encryption or decryption
AfterEncryption keys delivered securely
🏗️
Architecture Diagram
Architecture Diagram
┌─────────────┐
│ Client App  │
└──────┬──────┘
       │ HTTPS (Login Req)
       ▼
┌───────────────┐
│ AuthN Service │
└──────┬────────┘
       │ RPC (Validate Creds)
       ▼
┌───────────────┐
│ Token Service │
└──────┬────────┘
       │ Redis GET/SET (Token Cache)
       ▼
┌───────────────┐
│ Redis Token   │
│ Cache         │
└──────┬────────┘
       │ RPC (Authorize Token)
       ▼
┌───────────────┐
│ AuthZ Service │
└──────┬────────┘
       │ DB Query (Policy Store)
       ▼
┌───────────────┐
│ Policy Store  │
└──────┬────────┘
       │ HTTPS (Audit Log Event)
       ▼
┌───────────────┐
│ Audit Logging │
└──────┬────────┘
       │ HTTPS (Req Encryption Key)
       ▼
┌───────────────────────────┐
│ Encryption Key Management │
└───────────────────────────┘
Design Rationale

This architecture illustrates a secure authentication and authorization flow with encryption support. The Client App sends credentials to the AuthN Service, which validates them and requests a token from the Token Service. Tokens are cached in Redis for fast validation. When accessing resources, the AuthZ Service validates tokens and queries the Policy Store for permissions. All authentication and authorization events are logged by Audit Logging for compliance. Encryption Key Management provides keys to secure data at rest and in transit. This vertical flow ensures clear separation of concerns, fast token validation via caching, and strong audit and encryption controls.

Primary Focus

✓

Practice

(1/5)
1. In a message queue system, at Step 4 the Delivery Worker reads a message from Kafka and checks the consumer's offset commit status. What happens if the offset commit is missing for that consumer group?
easy
A. The Delivery Worker skips the message and moves to the next offset
B. The Delivery Worker delivers the message and waits for the consumer to commit offset later
C. The Delivery Worker retries reading the message until offset commit appears
D. The Delivery Worker deletes the message from the partition to avoid duplicates

Solution

  1. Step 1: Understand offset commit role

    Offset commit tracks consumer progress; missing commit means consumer hasn't acknowledged message yet.

  2. Step 2: Delivery Worker behavior

    Delivery Worker must deliver the message and rely on consumer to commit offset asynchronously; skipping (A) or deleting (D) would cause message loss; retrying (C) is unnecessary as delivery is decoupled.

  3. Final Answer:

    Option B -> Option B

  4. Quick Check:

    Delivery Worker delivers message, offset commit is consumer's responsibility [check]
Hint: Delivery Worker delivers before offset commit [check]
Common Mistakes:
2. If Kafka becomes unavailable, what exactly breaks in the real-time analytics pipeline?
medium
A. Flink jobs continue processing from last checkpoint without data loss
B. Dashboard queries return stale data but ingestion continues normally
C. Event ingestion blocks causing upstream producers to backpressure and data loss risk
D. OLAP store automatically switches to batch ingestion mode without downtime

Solution

  1. Step 1: Understand Kafka's role in ingestion and buffering

    Kafka buffers incoming events; if unavailable, ingestion halts causing backpressure upstream.

  2. Step 2: Trace downstream impact

    Flink cannot consume new events, so dashboards show stale data; OLAP store remains unaffected initially.

  3. Final Answer:

    Option B -> Option B

  4. Quick Check:

    Kafka outage causes stale dashboard data due to halted ingestion [check]
Hint: Kafka outage stalls ingestion, dashboards show stale data [check]
Common Mistakes:
3. For a global load balancer needing fast failover and minimal client disruption, which architecture is best suited?
medium
A. Client-side DNS failover with low TTLs
B. Passive health detection relying on client error reports
C. Active health checks with centralized state and instant routing updates
D. Round-robin DNS without health checks

Solution

  1. Step 1: Evaluate failover speed and client impact

    Active health checks with centralized state enable immediate detection and routing updates, minimizing disruption.

  2. Step 2: Eliminate other architectures

    Client-side DNS failover is slow due to DNS caching; passive detection delays failover; round-robin DNS lacks health awareness.

  3. Final Answer:

    Option C -> Option C

  4. Quick Check:

    Centralized active health checks enable fast, seamless failover [check]
Hint: Centralized active health checks enable instant failover [check]
Common Mistakes:
4. For a system tracking SLO error budgets with high write volume and low latency requirements, which architecture is best suited to ensure accurate, near real-time error budget updates?
medium
A. Batch processing error logs every hour using Hadoop MapReduce
B. Polling a relational database every minute for error counts and updating budgets
C. Stream processing with Apache Flink to compute error budgets continuously
D. Using a time-series database with hourly rollups for error budget calculation

Solution

  1. Step 1: Analyze latency and accuracy requirements

    Near real-time updates require continuous stream processing rather than batch or polling.

  2. Step 2: Evaluate each architecture against these requirements

    Batch processing (A) and hourly rollups (D) are too slow; polling (C) introduces latency and load spikes; stream processing (B) provides continuous, low-latency computation.

  3. Final Answer:

    Option C -> Option C

  4. Quick Check:

    Stream processing -> continuous, low-latency error budget updates [check]
Hint: Stream processing fits low latency and high write volume best [OK]
Common Mistakes:
5. At 10x scale, which component in a Redis Cluster using consistent hashing is most likely to become the first bottleneck, and why?
hard
A. The client-side slot cache, because it grows linearly with cluster size and increases latency
B. The network bandwidth between nodes, due to increased replication traffic
C. The cluster management node, because it handles all slot reassignments centrally
D. The individual Redis nodes, because maintaining many virtual nodes increases CPU overhead

Solution

  1. Step 1: Identify cluster management role

    Cluster management node coordinates slot assignments and node membership changes.

  2. Step 2: Analyze scaling impact

    At 10x scale, centralized management node becomes bottleneck due to coordination overhead (The cluster management node, because it handles all slot reassignments centrally).

  3. Step 3: Eliminate other options

    Network bandwidth (A) and Redis nodes (D) scale better; client slot cache (C) is local and does not cause cluster-wide bottleneck.

  4. Final Answer:

    Option C -> Option C

  5. Quick Check:

    Centralized cluster manager -> coordination bottleneck at large scale [check]
Hint: Central cluster manager bottlenecks slot coordination at scale [OK]
Common Mistakes:
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard