Scenario
Scenario
You are responsible for an internal REST API that serves customer account data to several backend services. The API is currently protected by static API keys passed over HTTPS, and those keys are shared across multiple workloads. A recent review found that one key was copied into a debug log and may have been exposed. You need to tighten access without breaking service-to-service traffic.
Question
How would you redesign the authentication and authorization flow for these API calls so that only approved workloads can access the data? What would you do to detect, contain, and recover from a suspected key leak or service compromise?
Practicing as: Software Engineer interview at Opera SolutionsHi, I'll play your Opera Solutions interviewer for the Software Engineer role. Candidates describe these interviews as mostly positive and moderately difficult, so expect me to be friendly and conversational. Take your time with the question above and answer like we're in the room.
You are practicing as a guest. Sign up free to get your answer graded with AI feedback. Your draft stays right here.
