Reliability design

1.You are asked to design reliability for a new event RSVP service. Before picking an architecture, which question changes the design most?

2.You are setting a service level objective (SLO) for a recipe app's search API. Which service level indicator (SLI) best reflects what users feel?

3.A clinic booking system's team asks you to help set its first service level objective (SLO). What should you ask first?

4.A photo backup app measures availability only from its server logs. Requests that fail at DNS or at the CDN never reach the servers. Which addition best closes the gap?

5.For a payroll export job that runs nightly and produces files for banks, which service level indicator fits best?

6.A chat app pools every endpoint into one 99.9 percent success target. Sending messages is 2 percent of requests, and typing indicators are 70 percent. What is the risk?

7.A news feed loads in two steps: the page shell first, then the feed items. Which latency indicator is most meaningful for users?

8.A ticket sale site's product owner asks for 100 percent availability. What is the best response?

9.An internal code review tool is used only by staff during working hours in one time zone. Which service level objective (SLO) design is reasonable?

10.A password reset flow gets a few hundred uses a day. Why add synthetic probes to its service level monitoring?

11.A service has a 99.9 percent availability objective over a 30 day window. About how much full downtime does its error budget allow?

12.A parking payment API serves 200 million requests in a 30 day window with a 99.95 percent success objective. One incident fails 60,000 requests. What share of the error budget did it use?

13.A team moves from a 99.9 to a 99.99 percent availability objective on a 30 day window. What does that mean for how failures are handled?

14.A food delivery service has used its whole quarterly error budget by week eight. What does a typical error budget policy say to do?

15.A team has used only 5 percent of its error budget every quarter for two years, and its releases are slow because of heavy manual sign-off. What does this suggest?

16.Why is a rolling 30 day window often preferred over a calendar month for error budget decisions?

17.A URL shortener gets 20 times more traffic at noon than at 3 a.m. Under a request-based success indicator, how does a 10 minute full outage at noon compare with one at 3 a.m.?

18.A booking service's success objective is 99.95 percent. Every checkout calls a payment partner that promises 99.9 percent. What is the right design response?

19.A service has a 99.9 percent objective over 30 days. Which page condition matches the common fast-burn rule of spending 2 percent of the budget in one hour?

20.In error budget alerting, what does a burn rate of 1 mean?

21.A service with a 99.9 percent objective over 30 days has a steady 0.5 percent error rate. Starting from a full budget, how long until it is gone?

22.Why do burn-rate alerts often pair a long window with a short one, such as 1 hour and 5 minutes, and fire only when both exceed the threshold?

23.A service's burn rate has sat between 1 and 2 for three days. What response usually fits?

24.A team pages whenever the remaining error budget drops below 20 percent. What is the weakness of this rule?

25.A request path calls five services in series, each 99.95 percent available, with independent failures. Roughly what is the path's availability?

26.Two independent replicas are each 99 percent available, and either one alone can serve all traffic with instant failover. What is the combined availability?

27.A team claims two database replicas at 99.9 percent each will give 99.9999 percent together. Why is the real figure usually much lower?

28.A primary and a standby are each 99.9 percent available, but failover succeeds only 90 percent of the time. What dominates the pair's unavailability?

29.A mobile banking home screen needs the balance service, which is essential, plus a news banner and offers, which are optional. Which design keeps the screen's availability closest to the balance service alone?

30.A storage service writes each object to three replicas in different zones and acknowledges the write after two succeed. Why two rather than three?

31.A service runs active-passive across two regions. The passive region has never taken real traffic. What availability should the design assume for failover?

32.A team asks whether running a staff wiki in a second active region, raising availability from 99.9 to 99.99 percent, is worth it. What should decide this?

33.Peak traffic is 30,000 requests per second, each server handles 500 at target utilization, and the service runs in three zones. It must survive losing a zone at peak. How many servers do you need?

34.An API handles 2,000 requests per second with an average latency of 250 ms. About how many requests are in flight at once on average?

35.A ride dispatch map peaks at 4,000 requests per second, and peak traffic is growing 8 percent per month, compounded. About what peak should the plan expect in 12 months?

36.A photo app serves 3,000 image downloads per second at peak, averaging 400 KB each. About how much egress bandwidth does it need at peak?

37.A sensor fleet of 50,000 devices each sends a 200 byte reading every 10 seconds. About how much raw data arrives per day?

38.Which load test best validates a ticket sale's readiness for an on-sale moment?

39.In a load test, throughput flattens at 6,000 requests per second while server CPU sits at 35 percent. What should you look for first?

40.A queue-backed service's latency is fine at 60 percent utilization but jumps sharply between 85 and 95 percent. Why?

41.A news site serves 20,000 requests per second with a 95 percent cache hit ratio. Its database comfortably handles 2,000 per second. What happens if the cache cluster restarts empty?

42.A sensor dashboard autoscales on CPU, and a new instance takes 4 minutes to launch and warm up. Traffic doubles within 60 seconds when a morning report goes out. What design fits?

43.A team wants to load test its grocery ordering service in production before a holiday. What makes this safe?

44.A load test passes at peak for 15 minutes, but production fails after 6 hours at normal load. Which kind of test would most likely have caught it?

45.A service runs in four regions, sharing load evenly. What is the highest utilization each region can run at peak and still absorb the loss of one region?

46.A checkout request has a 2 second budget at the edge and calls inventory, then pricing, then payment. Which timeout design is best?

47.A dependency's 99th percentile latency is 80 ms and its 99.9th is 300 ms. Calls past 1 second are almost always hangs, and callers can retry. Which timeout is most reasonable?

48.A client has a 10 second total timeout but no separate connect timeout. A downstream host dies silently and drops packets. What improves this most?

49.A search request fans out to 100 shards and waits for all of them. Each shard is slower than its 99th percentile 1 percent of the time. About what share of requests hit at least one slow shard?

50.A team adds hedged reads: if a read has not returned by its 95th percentile latency, a duplicate goes to another replica. Roughly how much extra read load does this add?

51.An invoicing worker pulls jobs from a queue with a 30 second visibility timeout. Some jobs take 45 seconds. What happens?

52.A client library retries failed calls. Which policy best keeps retries from multiplying load during an outage?

53.A client calls an order API. Which response should it retry?

54.A money transfer request times out after the client sends it, and the client retries. What design prevents a double transfer?

55.A transfer service stores idempotency keys to make client retries safe. Where should each key be recorded?

56.A mobile app syncs to a server that may be down for minutes at a time. Which retry schedule is best?

57.Under overload, a backend returns errors marked overloaded, do not retry. Why build this signal into the system?

58.A recipe app's circuit breaker on calls to a nutrition service is open. What should the half-open state do?

59.A service calls a database cluster of 12 shards through one circuit breaker that covers the whole cluster. One shard fails. What is the risk?

60.A circuit breaker opens when 50 percent of calls fail in a 10 second window. At night a dependency gets 2 calls per window, and one failure trips it. What fix helps?

61.An API slows as load rises past capacity, and soon every request times out. Which design keeps goodput up under overload?

62.Why do some services set their concurrency limit adaptively from measured latency instead of using a fixed number?

63.A video streaming platform tags each request with a criticality level at the edge. What does this enable?

64.In a multi-tenant translation API, one customer's batch job sends 20 times its usual traffic and slows every tenant. What is the best design fix?

65.A log ingestion pipeline's producers write faster than its indexers can keep up, and the buffer between them is unbounded. What design is better?

66.A grocery delivery slot booking service gets a huge surge when new slots open at 6 a.m. Which admission design gives users the best experience?

67.A fleet of 600,000 devices spreads its reconnects evenly over 5 minutes. About how many connections per second does the server see?

68.Every client of a weather alert app polls for updates at the top of each minute. What happens, and what is the fix?

69.After a brief network blip, a photo app's backend stays overloaded for hours even though the blip ended and traffic is normal. What is most likely?

70.A pricing service loads 50,000 product prices into cache at startup, all with the same one hour expiry. What happens each hour, and what fixes it?

71.A service fetches its routing config from a central config store every minute. What should it do when the config store is unreachable?

72.A login service falls back to a slow path that queries the main database whenever its token cache misses. Why is this risky?

73.You are designing a multi-tenant chat app. Why split it into independent cells, each serving a fixed set of tenants?

74.A service is split into 25 equal cells. A bad config is pushed to one cell. At most, what share of customers is affected?

75.In a cell-based design, what should the thin routing layer that maps tenants to cells avoid?

76.A name resolution service has 8 servers, and each customer is assigned a random pair of 2. One customer's traffic knocks out both of its servers. What share of other customers lose both of theirs too?

77.Shuffle sharding only limits blast radius if what else is true?

78.A queue service puts tenants into 4 fixed groups of workers. A noisy tenant overwhelms its group. What share of tenants suffer, and what would shuffle sharding change?

79.A service runs its web tier in three zones, but every zone calls one database primary in a single zone. Is the service zone-redundant?

80.A service must survive a zone loss without launching new instances, because the control plane may be impaired during the event. How should capacity be provisioned?

81.A team makes a shopping cart service active-active across two regions with asynchronous replication. What must the design handle?

82.A service fails over between regions by changing DNS records that have a one day time to live (TTL). What is the problem?

83.A load balancer system has a control plane for config changes and a data plane that forwards traffic. Which design is most reliable?

84.A code review tool deploys a new version to a 2 percent canary. Which comparison best decides whether to continue the rollout?

85.A canary gets 1 percent of 5,000 requests per second for 10 minutes. The baseline error rate is 0.1 percent. About how many errors should the canary show if nothing is wrong?

86.Why do safe rollouts wait through a bake time at each stage instead of moving on as soon as health checks pass?

87.A service runs in 30 cells across 5 regions. Which rollout order fits best?

88.Why tie a rollout to automatic rollback when service level indicators regress, instead of waiting for a human to decide?

89.A team canaries every code deploy but pushes feature flag and config changes to every server in seconds. What is the gap?

90.A pharmacy refill service must rename a database column without downtime, keeping every step safe to roll back. Which plan fits?

91.During a rolling deploy, old and new versions run side by side for 20 minutes. The new version writes a new message format to a shared queue. What must be true?

92.A team ships a new pricing engine behind a flag that can route a percentage of traffic to it. What makes this safer than a plain deploy?

93.Most of a team's outages come from changes. A manager proposes a three-month change freeze. What is the better long-term fix?

94.A service has a 99.95 percent objective over 30 days. How should its rollback path compare with its rollout path?

95.A clinic records system replicates its database asynchronously to another region with about 5 seconds of lag. If the primary region is lost, what recovery point objective (RPO) can it meet?

96.A payroll ledger must lose no committed writes if a whole region fails. What does that require?

97.A team backs up its database nightly and has never restored one. What should its disaster recovery plan add?

98.Backups for a school grades portal live in the same cloud account, under the same admin credentials, as production. What risk does this leave?

99.Your hotel booking flow's design says the loyalty points service is an optional dependency. How do you prove it?

100.A region evacuation test finds the standby region cannot start because it pulls container images from a registry in the failed region. What kind of problem is this?

101.During a disaster recovery drill, the identity service cannot start because it needs the secrets service, which needs the identity service for login. What should the design add?

102.A team's region failover drill passes every quarter, but always on a Sunday at 3 a.m. after a week of preparation. What does this leave untested?

103.Which experiment best checks that a checkout service's timeouts and fallbacks are set correctly?

104.A package tracking worker sometimes hangs while its process stays up, so its basic health check passes. How should the self-healing design detect this?

105.An auto-remediation system replaces disks that monitoring flags as failing. What guard makes it safe?

106.A team spends about 70 percent of its time on manual tickets for a growing flight check-in service. What is the best plan?

107.A server fleet drifts in config over months because engineers fix problems by hand on individual hosts. Which design helps the fleet heal itself?

108.Why do many self-healing systems use a control loop that compares desired state with actual state, rather than one-time scripts?

109.An auto-restart system quietly restarts a crashing service 200 times a day, and users see few errors. What should the design add?