151
What is authentication in system architecture?
Authentication verifies the identity of a user, service, or application. It answers the question: who is making this request?
.NET Architecture & System Design Interview
Security Architecture, Multi-Tenancy & Disaster Recovery
Questions 151-175: Security Architecture, Multi-Tenancy & Disaster Recovery.
25 Questions Filter by level
Interview questions
Open a question for the full answer, code and interview guidance.
152
What is authorization?
Authorization determines what an authenticated identity is allowed to do. It is evaluated after identity is established and can depend on roles, claims, policies, resource ownership, tenant boundaries, or business rules.
153
What is the principle of least privilege?
Least privilege means giving users, services, processes, and infrastructure only the permissions they need for their required tasks and no broader access than necessary.
154
What is defense in depth?
Defense in depth uses multiple independent security controls so failure of one control does not automatically expose the entire system.
155
What is Zero Trust architecture?
Zero Trust is a security approach that avoids assuming a request is trustworthy merely because it originates from an internal network. Access decisions are based on verified identity, device or workload context, policy, and least privilege.
156
What is TLS and why is it important?
TLS protects data in transit by providing encryption and server authentication, and it can also support client authentication. HTTPS is HTTP carried over TLS.
157
What is mutual TLS (mTLS)?
Mutual TLS authenticates both sides of a TLS connection with certificates. The server presents its certificate as usual, and the client also presents a certificate that the server validates.
158
What is encryption at rest?
Encryption at rest protects stored data when it resides on disks, database files, backups, object storage, or other persistent media.
159
What is secrets management?
Secrets management is the controlled storage, distribution, rotation, and auditing of sensitive values such as API keys, database passwords, certificates, and signing credentials.
160
Why should secrets not be stored in appsettings.json for production?
Configuration files can be copied, logged, packaged, or committed accidentally. Storing production credentials directly in appsettings.json increases the chance that secrets are exposed with application files or source control.
161
What is token-based authentication?
Token-based authentication uses a security token representing an authenticated identity and associated authorization information or references. A client presents the token to an API, which validates it before serving protected resources.
162
What is a JWT?
JWT, or JSON Web Token, is a compact token format containing encoded claims and protected by a digital signature or message authentication mechanism. JWTs are commonly used as access tokens, although OAuth does not require access tokens to be JWTs.
163
What is OAuth 2.0 used for?
OAuth 2.0 is an authorization framework that allows clients to obtain limited access to protected resources. It defines roles and flows for issuing and using access tokens.
164
What is OpenID Connect?
OpenID Connect is an identity layer built on OAuth 2.0. It enables clients to authenticate users and obtain standardized identity information, including an ID token.
165
What is API rate limiting from a security perspective?
Rate limiting restricts request volume and can reduce abuse, brute-force attempts, accidental loops, and resource exhaustion. Limits may be applied per IP, user, API key, tenant, route, or another identity.
166
What is a Web Application Firewall (WAF)?
A Web Application Firewall inspects and filters HTTP traffic before it reaches an application. It can block or challenge traffic matching known malicious patterns, protocol violations, or configured rules.
167
What is input validation in API design?
Input validation verifies that incoming data satisfies the expected shape, range, format, and business constraints before it is used.
168
How do parameterized queries help prevent SQL injection?
Parameterized queries separate SQL command structure from user-supplied values. The database treats parameter values as data rather than executable SQL syntax.
169
What is multi-tenancy?
Multi-tenancy is an architecture in which one software system serves multiple customer organizations, called tenants, while maintaining appropriate separation of their data and configuration.
170
What are common database models for multi-tenant SaaS?
Common models include a shared database with shared tables and TenantId, a shared database with separate schemas, and a separate database per tenant. Hybrid approaches are also possible.
171
How do you prevent cross-tenant data leakage?
Tenant identity should be derived from a trusted authenticated context and enforced consistently in authorization and data access. Queries, commands, caches, background jobs, and exported files must all preserve the tenant boundary.
172
What is tenant-aware caching?
Tenant-aware caching ensures cached entries belonging to one tenant cannot be returned to another. Cache keys commonly include the tenant identifier along with the resource identifier.
173
What is disaster recovery?
Disaster recovery is the set of plans, systems, and procedures used to restore service and data after a major failure such as regional infrastructure loss, destructive operator error, or severe data corruption.
174
What are RTO and RPO?
RTO, Recovery Time Objective, is the target maximum time to restore an acceptable service after a disruption. RPO, Recovery Point Objective, is the target maximum amount of data loss measured in time.
175
What is the difference between backup, replication, and high availability?
Backup creates recoverable copies of data for restoration after loss or corruption. Replication maintains additional copies that follow changes from a source. High availability is the broader capability to keep a service operating through failures, often using redundancy and automated failover.