Module 09 · Security and protection · Drill

Security and protection drill

Scenario prompts that check whether security and protection is usable under pressure. Answer out loud, then compare.

3 prompts20 min

0 of 3 graded

Prompt 1
You inherit a Node.js API on a VM, started by systemd as root because it binds port 443 and reads /etc/app/secrets.json. A pen test shows a remote code execution in its template engine. Design the permission model so that the same bug tomorrow cannot read other services' data, modify the application, or persist on the host, and say how you would verify it.
Say your answer out loud first. Thirty seconds is enough.
Prompt 2
A fleet of 40 single-tenant Redis nodes on bare metal lost 25 percent of throughput the morning after a kernel update; the nodes serve about 300,000 small commands per second each and CPU profiles show the extra time in the kernel entry path. An engineer proposes booting with mitigations=off. Explain what happened and decide, with constraints.
Say your answer out loud first. Thirty seconds is enough.
Prompt 3
Design the sandbox for a platform that runs customer-submitted Python plugins, about 10,000 invocations per minute, each with a 200 ms cold-start budget and needing outbound HTTPS to one allowlisted API. Name each layer, the escape it stops, its cost, and where you place a VM boundary.
Say your answer out loud first. Thirty seconds is enough.