Cover multi-tenant specifics: tenant isolation, federated identities across orgs
0 / 10 completed
1 / 10
The interviewer asks: "Walk me through implementing OAuth 2.0 Authorization Code Flow with PKCE for a single-page application." Which answer demonstrates both security awareness and implementation depth?
Option B is strongest: it explains why PKCE is needed for SPAs (no client secret), walks through each step with correct technical vocabulary (code_verifier → SHA-256 → code_challenge), names the attack PKCE prevents (code interception), specifies token lifetimes and storage security (httpOnly cookie prevents XSS), and adds CSRF protection (state parameter) and signature validation. Option D is dangerously wrong — Implicit Flow was deprecated in OAuth 2.1 because it exposes tokens in URLs. Option C is correct but shallow. Key pattern for OAuth questions: name why this flow is appropriate → walk each step precisely → cover the security properties of each step → name what attacks it prevents.
2 / 10
The interviewer asks: "RBAC vs. ABAC — walk me through when you would choose each, with a concrete example." Choose the answer that best demonstrates practical design experience.
Option C is strongest: it gives concrete examples for each model, shows the ABAC policy syntax, articulates the trade-off (power vs. auditability), gives a pragmatic hybrid recommendation, and names real implementation tools (OPA, Cedar). Option D demonstrates awareness of ReBAC/Zanzibar which is advanced and correct but it doesn't answer the RBAC vs. ABAC question directly — it sidesteps to a third model. Option A is correct but too abstract. Design comparison question structure: concrete use case for each option → tradeoff → practical recommendation → implementation tool.
3 / 10
The interviewer asks: "A service account key was committed to GitHub and is now public. Walk me through your response." Which answer demonstrates a complete incident response approach for an IAM incident?
Option D is strongest for several reasons: it distinguishes revoke from rotate (a common interview trap), sequences the steps correctly (revoke first, then investigate — not the other way around), identifies the risk of lateral movement (key may have had permissions to create new credentials), emphasises evidence preservation, and covers both immediate and long-term remediation including the pre-commit hook. Option B's first step (delete the service account) is wrong — you might need the account for audit purposes and should revoke the key, not delete the account. Option A is correct but leaves out lateral movement, blast radius assessment, and evidence preservation. Incident response structure: contain → investigate → assess → notify → remediate → prevent recurrence → post-mortem.
4 / 10
The interviewer asks: "Design an IAM system for a multi-tenant SaaS product where each tenant can configure their own SSO." Choose the answer that best covers the design dimensions.
Option A is strongest: it covers all critical design dimensions — per-tenant IdP federation with both SAML and OIDC support, tenant isolation mechanism (tenant_id in tokens), configuration storage (encrypted), the emergency access fallback (often missed), JIT provisioning, and the separation of tenant vs. platform admin privilege domains. Option D describes the correct flow but is shallow and misses JIT provisioning, emergency fallback, and isolation guarantee details. Option B outsources the decision to a vendor but a design question expects you to describe how it works, not just which vendor. Option C describes subdomain routing but stops at routing — doesn't address the isolation, provisioning, or security properties. Multi-tenant IAM design checklist: federation model (SAML/OIDC) → tenant isolation mechanism → configuration storage → emergency access → provisioning strategy → privilege domain separation.
5 / 10
The interviewer asks: "How would you migrate from a custom in-house authentication system to a managed IdP without user disruption?" Which answer best demonstrates migration engineering experience?
Option B is strongest: it describes the lazy migration pattern (industry-standard for zero-disruption auth migration), covers the critical password handling constraint (no raw password export), specifies a gradual rollout strategy with monitoring signals, plans the legacy system deprecation timeline, and identifies the 2FA re-enrollment edge case that's commonly missed. Option D's maintenance window approach causes user-visible downtime and the "send everyone a reset email" forces disruption for 100% of users. Option C describes a reasonable high-level approach but doesn't specify the lazy migration mechanism or gradual rollout percentage. Option A is dangerously wrong — "hash the passwords to the new system's format" is not possible; you cannot re-hash existing bcrypt hashes without the plaintext. Auth migration structure: parallel run → lazy migration with credential capture → gradual rollout → deprecation timeline → edge cases (2FA, SSO users).
6 / 10
Alice: 'I've added a new IAM role for the reporting service. It grants read access to all S3 buckets in the `production` environment. Seems straightforward.'
Which of the following responses best addresses Bob's concerns about least privilege and potential security risks?
The key here is understanding least privilege. Granting read access to *all* S3 buckets in production is a significant risk if the reporting service doesn't actually need access to everything. Option 0 correctly identifies this over-permissive nature and highlights the potential consequences. Options B and C are too simplistic, while option D demonstrates a strong understanding of security best practices.
7 / 10
Mark (DevOps) sends this message in a Slack channel: 'Just triggered an MFA challenge for user Sarah. Looks like someone was trying to log in from a new device – standard procedure.'
What does Mark's statement primarily indicate about the IAM system's security controls?
Mark's statement is crucial because it demonstrates that Multi-Factor Authentication (MFA) is in place. The 'new device' trigger indicates that the system is monitoring login attempts and enforcing MFA when anomalous behavior is detected. Options A, C, and D misinterpret the significance of Mark's message – it's about *enforcement* through MFA, not just logging or device tracking.
8 / 10
David is updating a PR to add support for SAML SSO integration. He writes the following in the PR description:
'This change allows users to log in using their existing corporate accounts. We've implemented standard SAML configurations and are using a dedicated service account for authentication.'
Which of the following statements would be MOST valuable to add to improve the description?
While David's description provides a high-level overview, it lacks crucial details regarding security. Option 0 correctly identifies this gap. SAML integrations often have specific security requirements (like key rotation and access logging) that should be explicitly addressed. Option A highlights the lack of detail, while B is too simplistic and C focuses on a less critical aspect.
9 / 10
Emily is updating her team's daily stand-up:
'Yesterday, I was working on refining the IAM policies for our new microservice. I'm focusing on implementing granular role-based access control (RBAC) to ensure only authorized personnel can access sensitive data.'
Which of the following questions would be MOST relevant to ask Emily during this standup?
Emily's statement indicates she's implementing RBAC. Asking about the implementation details (Option 1) is a natural and productive follow-up question. Options A, C, and D shift the focus away from the core topic of RBAC – specifically how it's being *implemented* within the microservice.
10 / 10
Frank: 'We need to migrate our on-premise Active Directory user accounts to Azure AD. We want to minimize disruption and avoid a complete outage during the transition.'
Which strategy would BEST align with Frank's goal of minimizing disruption?
A phased migration is crucial for minimizing disruption. Starting with pilot groups allows Frank's team to identify and resolve potential issues before rolling out the changes to all users. Option 0 presents a risky strategy that could cause significant downtime. Options C and D are overly simplistic and don't account for the complexities of a real-world migration.
What does "IAM / Identity Engineer — Interview Questions — Best-Answer Practice" cover?
Practice answering IAM / Identity Engineer interview questions in professional English. 5 exercises on OAuth 2.0 flows, RBAC vs ABAC design, multi-tenant IAM, token security, and IdP migration.
How many questions are in this interview set?
This set has 10 exercises, each with a full explanation.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do these exercises include model answers?
Yes. Each interview question gives you several possible responses and asks you to pick the one that communicates most clearly and completely — the explanation then breaks down exactly why that answer works, including the specific vocabulary a strong candidate would use.
What if I choose an answer that isn't the strongest one?
You'll see which option was correct and read a full explanation of why it's stronger than the alternatives, plus the key vocabulary and phrasing worth reusing in a real interview.
Can I retry the questions?
Yes — use the "Try again" button on the results screen to reset and go through the set again.
Is this the same as a real technical or behavioural interview?
No — it's focused practice for the language side of interviewing: recognising which phrasing sounds precise and confident versus vague, and knowing the vocabulary interviewers expect for this role. It won't replace mock interviews, but it builds the vocabulary you'll need in one.
Where can I find interview prep for other roles?
Browse the full Interview exercises hub for 170+ modules covering behavioural, technical, and system design rounds across dozens of IT roles, or check the "Next up" link below to continue.
Do I need an account, and is my progress saved?
No account is needed. Progress is tracked only for your current visit — reloading or leaving the page resets the counter.
Who writes these interview questions?
Every question is written by the CoderSlingo team based on real technical interview patterns for this role, then reviewed for accuracy and clarity.