← All questions
HardTechnical
Assume admins are tenant-scoped, red-admin has no blue membership, and the database worker can read all tenants. Review this pseudocode and write a finding plus regression tests.
1Give yourself 5 minutes
2Answer out loud, not in your head
3Then compare with the answer below
The problem
Assume admins are tenant-scoped, red-admin has no blue membership, and the database worker can read all tenants. Review this pseudocode and write a finding plus regression tests.
actor = require_session(request)
require(actor.role == 'admin')
rows = invoices.where(tenant_id=request.body.tenant_id)
return storage.write(rows).download_url
Reference answer
Then expect these follow-ups
What should happen if the user's export permission is revoked while a background job waits?
Hiring now
Security engineer roles are open right now
landed applies to roles like these for you, on each company’s own site, with answers written for the role.
Get 5x interviews10 free auto-applies. No card.
Senior Cisco Security Engineer
Insight · Remote
Security Engineer Intern
ServiceNow · Kirkland, Washington, United States
Senior Security Engineer
Curri · Remote
Next question
- Four aligned ranks report input waits 20,20,140,20 ms and compute 180 ms each. Their collective completes20 ms after the last rank enters. Should networking be the first change?
- At10:00 a tenant starts long prompts. At10:02 first-token p95 rises0.8→8 seconds, queue p95 reaches6 seconds, and token-gap p95 stays35 ms. No release occurred. Choose an initial mitigation and recovery checks without claiming a proven root cause.
- For user a, changes are(v1,upsert,Ada),(v3,delete,null),(v2,upsert,Amy). User b has(v1,upsert,Bo). Versions are unique and authoritative; arrival order is as listed. Write a current-state query and describe safe incremental behavior.
- A device reports stopped at 09:00, moving at event time09:06 but arriving09:11, and stopped again09:08. The rule requires ten uninterrupted event-time minutes, with the late movement accepted. Give eligibility and delivery identity.
- From the same client, PodIP:8080 succeeds. ServiceIP:80 and the Service DNS name on port 80 both fail. DNS resolves to the expected Service IP. The Service selects the ready Pod but targetPort is 9090. Diagnose the layer and next check.
- A team may scale only its approved Deployment from 2 to 8 replicas. A service backend can modify many namespaces. Two requests arrive with the same operation ID but different desired counts. Define authorization and concurrency behavior.