Top 5 Audit logging Interview Questions
Browse 5 real-world technical and behavioral interview questions about Audit logging. Review scenarios, edge cases, and architectural best practices.
Your observability bill is now bigger than your compute bill. What do you cut first, and what must you never lose?
Attribute observability cost by signal, service and pricing dimension. Then cut by value per byte: debug and duplicate logs at source, logs that should be counters, hot retention nobody queries. Protect audit and security logs, error events and SLO signals from sampling, and never cut by a flat percentage.
A customer's API token turns up in a public repository. What do you do in the next hour, and what in your token design decides how bad this is?
The damage is fixed before the leak by three earlier decisions: whether the token can be revoked and how fast that takes effect, how narrowly it was scoped, and whether your audit trail can attribute actions to that specific credential rather than only to the tenant.
A maintenance script updates your permissions table and every user in one tenant can suddenly edit everything. What should have stopped that, and how would you have found out?
Permission data is as privileged as the code that reads it, so a bulk write to it needs the same review, staged rollout and reversibility as a deploy. Derive grants from a source of truth rather than stamping them, assert tenant invariants continuously, and know how long a cached decision keeps the mistake alive.
A GDPR erasure request arrives for a patient whose data sits in an append-only clinical audit log. What do you do?
You do not delete first. Erasure is a qualified right that yields where other law requires retention, so you triage each dataset by its lawful basis, erase what has no basis to be kept, suppress and restrict what must be retained, and put the residual judgement to legal and records management.
How would you know if a clinician had opened the record of a patient they were not caring for?
Role-based access permits this by design, so the control cannot be authorisation alone. You need a recorded relationship between clinician and patient, a break-glass path that costs something to use, read events in the audit log, and someone whose job is to review the exceptions.