Security in a Staff interview
Our Staff security questions combine two controls or two grants and ask what the combination allows that neither does alone. They test whether a design still holds when a credential is already stolen, a tenant is already leaving, or an auditor asks for evidence after the fact.
An axis of our Staff backend and Staff fullstack targets.
The check comes with every pass and covers all the competencies of the target you choose: 10 for Staff backend (about 20 minutes) and 12 for Staff fullstack (about 24 minutes). It reports each one as Ready, Borderline or a Gap for this level. It never predicts a pass.
Patterns our questions are designed to test at Staff
These are the distinctions the questions on this axis are written to separate — our judgement from writing them and having them reviewed, not a measurement of candidates. We have run no study, so nothing here is a statistic and none of it is phrased as one.
- 1.
Two ordinary grants, one escalation
On Google Cloud, Service Account User granted on a project lets a developer who can create VMs attach any service account in that project, and code on the VM runs as that account. If one of them holds Owner on a folder above the project, the developer can delete another project in that folder. Two agents, one reading a private repository and one posting to a public blog, form a path from private to public that neither grant names. Our Staff questions ask what a set of permissions allows together, which a review of one grant at a time cannot see.
- 2.
Revocation that lands after the incident
Tokens for an Azure managed identity are cached for around 24 hours and cannot be refreshed early, and Azure RBAC accepts a token issued before the identity was deleted until it expires, so removing the role of a compromised build machine leaves the attacker's token working for hours. In one of our questions the build machines have a subnet and a storage-account network rule of their own, and removing that rule is what ends their access within the fifteen minutes the company's security standard allows. Our Staff questions ask how long a revocation takes to reach a credential already issued.
- 3.
Erasure designed after the data was written
To make one departing tenant's data unrecoverable in a pooled database whose backups are kept for a year, each tenant's rows can be encrypted under a key of their own, so that deleting the key makes them unreadable in every backup, provided no copy of that key or of the plaintext survives elsewhere. Deleting rows leaves the backups readable, and deleting the shared key destroys every tenant. A key introduced today covers only rows written under it, so backups taken before the change hold the tenant's data until they age out a year later. Our Staff questions ask what a guarantee covers on the day it is introduced.
- 4.
Evidence that was never kept
In Google Cloud, Data Access audit logs are off by default for most services, and once enabled they go to the
_Defaultbucket, kept for 30 days unless its retention is changed; IAM policy changes are Admin Activity entries in_Required, kept for 400 days. With those defaults, a request about reads six weeks back finds nothing while the policy changes from the same week are still there. CloudTrail's log file integrity validation hashes each log file and chains each digest to the previous one, because a hash alone cannot show that a deleted file ever existed. Our Staff questions ask what an investigation will need, before the incident that needs it.
What a strong answer sounds like: A strong answer follows a request through every control it meets, says which one decides the outcome and, where it matters, how long that takes to take effect or how long the evidence is kept.
How the check measures it
3 questions drawn on this axis alone — 1 medium and 2 hard for a Staff target, because the bar is the level. Hard counts for one and a half times a medium, which is what makes the verdict relative:
| Medium right | Hard right | Verdict |
|---|---|---|
| 1 of 1 | 2 of 2 | Ready |
| 0 of 1 | 2 of 2 | Ready |
| 1 of 1 | 1 of 2 | Borderline |
| 0 of 1 | 1 of 2 | Gap |
| 1 of 1 | 0 of 2 | Gap |
| 0 of 1 | 0 of 2 | Gap |
Three questions is coarse and the report says so beside every verdict. It is enough to separate this axis from the others in your target, which is what the check is for — there is no total, no percentage and no single number anywhere in the report.
What there is to practise
Questions here most often also test cloud architecture, technical judgment: decisions and trade-offs, ai agents & tooling and networking. Few questions on this axis test it alone, which is why the check reports every competency separately rather than averaging them.
One of them, in full
A question from the free demo, not written for this page. A demo quiz opens with it; the answer, the explanation and the source come when you submit — no account needed.
Answer it on the demoOne axis is not the loop
This axis is one of 10 in our Staff backend target and one of 12 in Staff fullstack, and being strong here says nothing about the others. The check covers all of them in one sitting and reports each separately, so what comes back is a profile rather than a score.