| Q276 | Architecture review | Review data, actors, APIs, storage, third parties, logging, failure states, and rollback before implementation hardens. |
| Q277 | Incident response | Contain active risk, preserve evidence, communicate clearly, recover safely, then add regression guardrails. |
| Q278 | Privacy | Collect the least data that answers the product question; define consent, retention, vendor sharing, and controls. |
| Q279-Q280 | Interview and capstone | Use a repeatable answer frame: assets, actors, boundaries, enforcement, browser controls, tests, rollout. |