System Design (High-Level Design) Module 13
Architecture styles at scale interview questions
Interview questions on architecture styles at scale: short warm-ups, then what each harder question tests, the first step of a good answer and its follow-ups.
Warm-up questions
Short questions with short answers, each answered in full.
-
Fresher to mid
What is a modular monolith, and how is it different from microservices?
Answered in the lesson Monolith, modular monolith or microservices?
-
Fresher to mid
What is the difference between client-side and server-side service discovery?
In server-side discovery the caller sends every request to one stable address, such as a load balancer or a Kubernetes Service's virtual IP, and the platform forwards it to a healthy instance, so the caller needs no discovery code. In client-side discovery the caller asks a registry, such as Consul, for the list of healthy instances, caches it and picks one itself. That allows smarter choices, such as preferring instances in the caller's zone, but puts a discovery library into every service and every language. In both, a registry or a control plane tracks instances through health checks or heartbeats, and callers must cope with instances that died after the list was fetched.
From the lesson Service discovery, sidecars and service meshes
-
Fresher to mid
What is a cold start in serverless computing, and when does it happen?
A cold start is the extra time an invocation takes when no warm execution environment is ready: the platform must create one, load the code and run the setup code outside the handler before the handler can answer. Where each environment serves one request at a time, it happens whenever a request arrives while every existing environment is busy, or none exists yet. AWS documents that cold starts typically occur in under 1 % of invocations and take from under 100 ms to over a second, so they hardly move the median but land in the slowest requests: in a model with 1 % cold starts, the p99 rose from 128 ms to 230 ms. Lighter setup code shortens them, and environments kept ready in advance avoid them, for a charge.
From the lesson Serverless and edge computing: when they fit
-
Fresher to mid
What is the difference between event notification and event-carried state transfer?
Answered in the lesson Event-driven design, event sourcing and CQRS
-
Fresher to mid
What is the strangler fig pattern, and why is it usually safer than a big-bang rewrite?
The strangler fig pattern replaces a live system piece by piece. A facade is put in front of the legacy system, one slice of functionality is rebuilt in the new system, the facade sends that slice's traffic to it, and the old code for the slice is removed once nothing uses it; the cycle repeats until the legacy system can be switched off. It is safer than a big-bang rewrite because every step is small and can be undone by routing the slice back, the new system meets real traffic early instead of on one launch day, and users get improvements before the end. A rewrite must rediscover everything the old system does, often while new features keep arriving, and then switches everything at once with no way back.
From the lesson Migrating live systems: strangler fig and ACL
Questions with model answers
What each question tests, the first step of a good answer and the follow-ups to expect.
-
Mid to senior
A 40-engineer company runs one monolith. Deploys wait days for a slot, and one module's memory leak restarts the whole application every few hours. The CTO proposes splitting it into 30 microservices this quarter. What do you recommend, and which parts would you split first?
- What it tests
- Separating real signals for a split from fashion, sequencing an extraction one module at a time, and knowing what many services cost a team of this size.
- First step
- Separate the two complaints. Slow deploys are a coordination problem and the memory leak is a reliability problem, and neither needs 30 services. Ask which teams the shared deploy blocks most and which module leaks, because those are the candidates for the first one or two extractions.
- Follow-ups
-
- How do you contain the memory leak this week, before any split?
- Which module goes first, and how does its data move?
- How would you know, six months later, that the split was worth it?
From the lesson Monolith, modular monolith or microservices?
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
- Pro pass · 1 week₹79$2.99
- 30 days₹179$5.99
- 1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
After an instance crashes, about a third of the calls to its service fail for 20 seconds, although the registry runs health checks. Where do the 20 seconds come from, and how would you bring the failures close to zero?
- What it tests
- Reasoning about heartbeat, TTL and cache timings, safe retries on another instance, and clean shutdowns that drain before they stop.
- First step
- Draw the timeline of one crash: the last heartbeat, the moment the registry's TTL runs out, and the moment each caller refreshes its cached list. Mark when callers stop choosing the dead instance, then ask which timer each part of the window comes from.
- Follow-ups
-
- Why not set every timer to one second?
- How do clean shutdowns differ from crashes?
- The registry itself is unreachable for a minute. What should callers do?
From the lesson Service discovery, sidecars and service meshes
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Senior to staff
A company runs 40 services in three languages on Kubernetes. Security wants encryption and service identity on every internal call within a quarter, and the platform team has four engineers. Would you adopt a service mesh, in which mode, and what would you watch closely?
- What it tests
- Weighing a mesh against libraries, sidecars against node proxies, resource cost with numbers, rollout risk and a small team's capacity to run a control plane.
- First step
- Separate the requirement from the features. Mutual TLS and identity on every call is a Layer 4 need that a node proxy can meet; per-route retries and traffic splits are Layer 7 extras. Then price the options for 40 services, in CPU and memory, against what four people can operate.
- Follow-ups
-
- What would a sidecar per pod cost here, roughly?
- How do you roll the mesh out without an outage?
- What happens to calls between services when the control plane is down?
From the lesson Service discovery, sidecars and service meshes
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
After a team enabled a service mesh, a 30-second outage of the stock service turned into a 20-minute incident in which stock received about 30 times its normal traffic. Explain how that happened, and redesign the retry and timeout settings.
- What it tests
- Recognising retries that multiply across layers and hops, retry budgets, deadline propagation, and which layer should own which retries.
- First step
- Count the attempts. A mesh can retry failed requests on its own, and the services' own clients may retry too, at every hop of the chain. Work out how the attempts combine from one hop to the next, and what that does to a service three hops deep while it is failing.
- Follow-ups
-
- Why did the incident last long after the original cause was gone?
- Which layer should retry what?
- How do deadlines change the picture?
From the lesson Service discovery, sidecars and service meshes
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
A function-based API passed its load test, but at launch the PostgreSQL database began refusing connections within a minute while its CPU stayed at 30 %. Explain what happened and how you would fix it, with numbers.
- What it tests
- Connections per execution environment, Little's law for environments and for queries, connection poolers and the limit that pooling cannot remove.
- First step
- Count connections, not queries. Each execution environment opens its own connection and keeps it, busy or idle. The environments needed are requests a second times seconds per request, so a launch spike multiplies them, while a database accepts only a limited number of connections, whatever its CPU is doing.
- Follow-ups
-
- How large should the pool be?
- Why did the load test pass?
- What if the queries alone need more connections than the database allows?
From the lesson Serverless and edge computing: when they fit
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
During a flash sale, traffic to an order function jumps from 300 to 8,000 requests a second, each taking 400 ms, and a third of the requests fail with status 429 for the first half-minute. Why, and what would you change before the next sale?
- What it tests
- Concurrency arithmetic, account limits and scaling rates, reserved concurrency, queues in front of slow work, and preparing capacity ahead of a known peak.
- First step
- Compute the environments: 8,000 a second times 0.4 s is 3,200 at once. Compare that with the account's concurrency limit and with how fast the platform can add new environments; either limit alone can explain half a minute of throttling.
- Follow-ups
-
- Which steps of an order must stay synchronous?
- How do you protect the payment service behind the function?
- How do you test the plan before the sale?
From the lesson Serverless and edge computing: when they fit
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Senior to staff
Product wants two numbers on every product page, served by edge code in 40 cities: "people viewing now" and "items left in stock". Design both, and explain why they need different designs.
- What it tests
- Telling approximate, loss-tolerant counters from exact ones, single-writer ownership, the eventual consistency of edge copies, and where the latency goes.
- First step
- Ask what an error costs for each number. A viewer count that is a few percent or a few seconds off harms nobody, so it can be counted near users and merged later. A stock count that is wrong oversells, so every decrement must go to one owner that orders them, and the edge only shows a recent copy.
- Follow-ups
-
- How stale may the stock number on the page be?
- The page showed 1 left, but there are none at checkout. What happens?
- How do you merge viewer counts from 40 cities?
From the lesson Serverless and edge computing: when they fit
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Senior to staff
Design the core of a wallet whose balance must never go negative and whose every change must be auditable for years. Would you use event sourcing? How do you handle two withdrawals at the same moment, and an account with 50,000 events?
- What it tests
- Choosing event sourcing for the right reasons, optimistic concurrency per stream, snapshots, schema evolution and the read side of a ledger.
- First step
- Start from the requirements: an audit trail of every change and the balance as of any past moment are exactly what an event store gives. Then name the hard parts before drawing anything: concurrent commands on one account, the replay cost of long streams, event schemas that change over the years, and how statements are read.
- Follow-ups
-
- How exactly do you stop two withdrawals from overdrawing the account?
- How is a monthly statement produced quickly?
- A customer asks you to delete their personal data. What do you do?
From the lesson Event-driven design, event sourcing and CQRS
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
After placing an order, users land on "My orders", where the new order is often missing for a second or two, and support tickets are piling up. The page reads a read model fed by events. Explain why, and give two fixes with their costs.
- What it tests
- Understanding read-model lag, read-your-writes with a version token, fallbacks to the write side, and the options in the user interface.
- First step
- Confirm that it is lag, not loss: compare the time each order event was written with the time the projection applied it. A read that arrives inside that gap misses the order, and the person who just ordered is the one who reads first.
- Follow-ups
-
- What does the version token carry, and who checks it?
- The projection stops for ten minutes. What do users see?
- Why not update the read model in the same transaction as the write?
From the lesson Event-driven design, event sourcing and CQRS
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
A team renamed a field of its OrderPlaced event from "amount" to "total" and deployed. A week later, rebuilding a read model from the event store fails on the old events. What went wrong, and how should event schemas evolve?
- What it tests
- Event schema evolution: tolerant readers, versioned events, upcasters, additive changes, and why stored events are not rewritten.
- First step
- See that the store now holds two shapes: every event before the deploy says "amount", every event after it says "total", and the new projection code knows only "total". Stored events are permanent, so the fix must read both shapes, not change the history.
- Follow-ups
-
- How do you get the rebuild working today?
- Which rules would have prevented this?
- When, if ever, is rewriting stored events acceptable?
From the lesson Event-driven design, event sourcing and CQRS
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Senior to staff
Design the cells of a B2B SaaS with 3,000 tenants and a peak of 50,000 requests a second, where one tenant brings 30 % of the traffic. How many cells, how does a request find its cell, and what happens to the big tenant?
- What it tests
- Sizing cells from tested limits with headroom, routing by tenant with pins, isolating a dominant tenant, and rolling releases out cell by cell.
- First step
- Size from what one cell may carry at peak, with headroom, not from the average: divide the traffic by it for a minimum count. Then look at the 30 % tenant before anything else, because 15,000 requests a second from one tenant changes the plan.
- Follow-ups
-
- What does the router store, and where?
- How do you roll a release out across the cells?
- Support needs one search across all tenants. How?
From the lesson Cells, deployment stamps and blast radius
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Senior to staff
One customer starts sending a malformed request that crashes any server that handles it, and its client retries forever. Compare the damage with one shared fleet of 100 servers, with 10 cells, and with shuffle sharding of 5 servers per customer, with numbers.
- What it tests
- Blast-radius arithmetic for fleets, cells and shuffle shards, the role of client retries, and how to contain the incident while it lasts.
- First step
- Follow the poison request. In a shared fleet each retry lands on another server and crashes it, so every customer suffers; in a cell it can reach only that cell's servers; with shuffle sharding it can reach only its own five. Then count the customers who lose all of their servers in each case.
- Follow-ups
-
- What do the other customers on the poisoned cell experience?
- How do you stop the incident while it is happening?
- What does shuffle sharding require from clients?
From the lesson Cells, deployment stamps and blast radius
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Senior to staff
A tenant must move from cell 3 to a new cell 9 with no downtime, while it keeps writing 2,000 times a second. Plan the move and its rollback.
- What it tests
- Online migration phases, change capture, a short write freeze, versioned routing maps, and keeping the old copy as the way back.
- First step
- Write down what must never happen: a write accepted by both cells, or lost by both without the client knowing. Then plan the phases of the move, and decide at which moment the new cell becomes the authoritative copy.
- Follow-ups
-
- How long is the write freeze, and what do clients see?
- Some routers still have the old map. What happens to their requests?
- How do you roll back after the flip?
From the lesson Cells, deployment stamps and blast radius
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Senior to staff
Plan how to move payments out of a ten-year-old monolith that takes 300 payments a second, with no downtime and a way back at every step. What moves first, and how do you know that each step worked?
- What it tests
- Sequencing a strangler migration, data synchronisation, shadow comparisons, dry runs for writes, reconciliation and rollback points.
- First step
- Start with a facade that changes nothing, so that every later step is only a routing change. Then move what is safest to verify, the reads of payment status, and give every step a measurable exit criterion and a written way back before it starts.
- Follow-ups
-
- How do you test the new write path without charging anyone twice?
- Which step has no way back, and when do you take it?
- How long should each phase run?
From the lesson Migrating live systems: strangler fig and ACL
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Senior to staff
You want to verify a new ledger service with real traffic before it takes over. Reads are easy to shadow. How do you check writes such as "record a payment" without recording anything twice?
- What it tests
- Dry-run modes, comparing decisions instead of effects, idempotency, reconciliation, and the order in which writes move.
- First step
- Separate what a write decides from what it does to the world. Ask which of the two you need to compare, and how the new service can see real traffic without its effects reaching anyone.
- Follow-ups
-
- The new service needs its own state to decide correctly. Where does it come from?
- How do you compare results that are produced asynchronously?
- What does the final switch of writes look like?
From the lesson Migrating live systems: strangler fig and ACL
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
Shadow comparison shows that the new pricing service disagrees with the legacy one on 0.3 % of requests. How do you triage the differences, and when is the new service ready to serve users?
- What it tests
- Grouping mismatches by cause, separating noise from bugs, deciding which side is right, and a statistical exit criterion.
- First step
- Group the mismatches by the fields that differ and by input pattern before reading single cases: 0.3 % usually turns out to be a few distinct causes, and some of them are noise rather than bugs.
- Follow-ups
-
- The legacy answer turns out to be the wrong one. Now what?
- How many clean comparisons do you need before routing users?
- Which differences may you accept on purpose?
From the lesson Migrating live systems: strangler fig and ACL
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
All System Design (High-Level Design) interview questions · The System Design (High-Level Design) track