System design

1.The prompt is 'people post short notes and their friends see them.' Before you draw boxes, what do you pin down?

2.A note is read far more often than it is written. Where do you spend the first optimization?

3.You estimate 50 million daily readers and a timeline request every minute while the app is open. A colleague multiplies 50 million by 1440 and calls that the request rate. What did they assume?

4.The timeline can be built when the note is written, by pushing it onto each friend's list, or when the friend opens the app, by pulling recent notes. A celebrity has 20 million followers. What does push do on that write?

5.A client retries a payment because the response timed out. The first attempt had already charged the card. What must the second attempt find?

6.You take the payment inside the same database transaction as the order row, and the card network is slow. What are you holding?

7.Inventory is decremented in the service and the order is written in another service. The inventory call succeeds and the order call fails. A user sees no order and the stock is gone. What did you lack?

8.A cache sits in front of profile reads. A user changes their display name. For a minute, some screens show the old name. The product says that is unacceptable. What do you change?

9.The cache is a single machine. Profile reads are fine until that machine dies, and then the database receives the full read rate. What was the cache hiding?

10.Keys are user ids, and one celebrity key is read a million times a minute. You add cache shards by hashing the key. Why is that celebrity still a problem?

11.Search results are cached for five minutes. A seller fixes a wrong price. Buyers still add the old price. Who is allowed to be stale, and who is not?

12.A feed query is 'SELECT * FROM notes WHERE author IN (friends) ORDER BY time DESC LIMIT 20'. A user follows 5,000 accounts. What gets expensive?

13.Pagination uses OFFSET 100000. The database still walks the first 100,000 rows to skip them. What do you pass instead?

14.You shard users by hashing the user id into 64 databases. A request needs one user's notes. A second request needs 'everyone in this city.' Which one is the shard key good for?

15.You add a 65th database and change the hash from modulo 64 to modulo 65. Almost every user lands on a new database. What mapping avoids that move?

16.Two app servers accept likes at the same time for the same note. Each reads the count, adds one, and writes it back. The count goes up by one. What did you lose?

17.Likes are stored as one row per user per note, with a unique key. The same user double-submits. What does the unique key give you?

18.You replicate the database to two other machines. A write returns when the primary has it, before either replica does. The primary dies. What can a promoted replica be missing?

19.Reads are sent to replicas so the primary can spend itself on writes. A user posts and immediately refreshes. The refresh hits a replica that is a second behind. What do they see?

20.A queue sits between the web server and the thumbnail worker. The web request returns 'processing.' The worker dies after taking the job and before finishing. What must the queue assume?

21.The thumbnail worker writes the image and then marks the job done. It crashes between those two steps. The retry writes the image again. Users briefly see two different URLs for the same upload. What order avoids the flicker?

22.Rate limit: 100 requests per user per minute. You store a counter keyed by user and by the current minute. A request at the end of the minute and one at the start of the next both pass, and a client sends 100 in each. In two seconds straddling the boundary they sent 200. Is the limit what you think?

23.The limit counter lives on one of 20 app servers, in memory. A user spreads requests across the servers. What does each server enforce?

24.A search box queries the primary database with LIKE '%park%'. The table is large and the leading wildcard ignores the ordinary index. What belongs in a search index instead?

25.You update the database and then update the search index. The process dies after the database commit. Search still shows the old name. What makes the index catch up?

26.Notifications are sent by a worker that reads 'users who should hear about this note.' The worker crashes at user 400 of 1,000 and starts over. Users 1 through 400 get a second ping. What do you store?

27.A chat message must show up for the other person quickly. You poll the server every 10 seconds. The product wants it to feel immediate. What are you avoiding by pushing instead?

28.Two messages are sent a millisecond apart. One client shows them swapped. Each server stamped them with its own clock, and the clocks disagree. What should order them?

29.Files are uploaded straight to the API server, which writes them to disk and then to object storage. The server disk fills and the upload fails for everyone. What path avoids that disk?

30.Image URLs are guessed: /img/1.jpg, /img/2.jpg. Private photos are in the same bucket. What is public that should not be?

31.A signed image URL expires in ten minutes. A user leaves the tab open and the image breaks. The page had copied the URL into the HTML and never asked again. What should the client do when the image fails?

32.Sessions are a random id stored in server memory. You add a second app server. Users bounce between them and get logged out. What has to move?

33.A signed token includes the user id and an expiry, and the signature uses a server secret. Someone changes the user id in the token and keeps the old signature. Why does the server reject it?

34.You ban a user. Their token does not expire for seven days. They keep calling the API. A signature check alone will not stop them. What else do you look up?

35.Passwords are stored by encrypting them with a key the app holds, so you can decrypt and email the password back. Why is that the wrong store?

36.Login is limited to five failures per account per hour. An attacker rotates through thousands of accounts with one password each. The per-account limit never trips. What else do you count?

37.A feature flag turns on a new checkout for 5% of users. The hash is on the user id, so the same user stays in or out. You hash the request id instead. What flickers?

38.The new checkout writes a column the old code does not know. You deploy the code that reads the column before the migration that adds it. What fails?

39.A migration locks the orders table to rewrite every row. Orders cannot be placed for the length of the rewrite. How do you change a large table without that lock?

40.Health checks hit GET / and expect 200. The homepage is a static file. The database is down and checkout is broken. The balancer keeps sending traffic. What did the check measure?

41.You run three copies of the API. You deploy by stopping all three, then starting the new build. What does a user hit during that window?

42.The new build fails its readiness check and the balancer leaves it out. The old copies keep serving. What did that check save you?

43.Logs include the full card number because a developer printed the request body. The log store is searchable by the whole company. What do you stop writing?

44.You trace a request with an id generated at the edge and passed to the database call and the queue message. A worker starts a new id. What do you lose when the thumbnail fails?

45.p99 latency is 2 seconds and the average is 80 milliseconds. A dashboard shows only the average, and it looks fine. Who is the p99?

46.You set a timeout of 30 seconds on a call to a recommendations service, and you have 200 web workers. Recommendations stall. What happens to the workers?

47.The circuit opens and you stop calling recommendations. You have no fallback. The whole page 500s. What should the page do instead?

48.A cron job charges subscriptions at 01:00 by scanning every subscription. The job runs twice because two schedulers fire. Some people are charged twice. What makes the second run harmless?

49.The billing job takes three hours and the process is killed at two hours. On restart it scans from the beginning. How does it resume?

50.You store money as a binary float. 0.1 plus 0.2 is not 0.3 in that format. Invoices disagree with the bank by a cent. What do you store?

51.An order total is computed in the browser and sent to the server, which charges that number. The user edits the request. What do you recompute?

52.Stock is 1. Two people click buy at the same time. Both reads see 1. Both write an order. You sold two of a thing you had one of. What has to be atomic?

53.You hold the stock decrement and the payment in one distributed transaction across two services. The coordinator dies. Both services wait. What did you trade for that lock?

54.A warehouse table is the source for both the website and a nightly report. The website needs the last second. The report needs yesterday to stay still while finance reads it. One table is being asked for both. What do you split?

55.Deletes set a deleted_at time. The app forgets the filter on one query and support sees withdrawn posts. The row is still in the table. Why keep it at all?

56.You back up the database nightly. You have never restored a backup. A disk fails. What do you not know?

57.The backup runs against the primary and the primary's latency spikes while the backup reads. What should the backup read instead?

58.A region dies. Users in that region cannot connect, and you have no second region. The design doc says 'multi-region' because there are two availability zones in the one region. What is the difference?

59.DNS for the API points at one load balancer address. You are moving regions and you set the DNS TTL to a day. After the cut, some users still use the old address. Why?

60.Websockets are held on a particular API machine. You deploy that machine and the sockets drop. Clients reconnect immediately, all of them. What do you spread?

61.You put a CDN in front of public profile photos. A user replaces their photo. The CDN keeps the old bytes until the TTL. The URL did not change. What has to change for the new bytes to show?

62.An API returns 200 with a body that says error: true. Clients and monitors treat 200 as success. Alerts stay green while users see failures. What should the status be?

63.You version the API in the URL. Old clients call /v1. You want to remove a field. v1 responses still include it, and v2 does not. When can you delete the v1 code?

64.GraphQL lets a client ask for nested friends of friends in one query. One request asks for ten levels. The database fans out. What do you cap?

65.You cache a GraphQL POST by its URL only. Every body is a different query and the cache never hits, or worse, two different bodies share a URL and you return the wrong one. What is the cache key?

66.A background rebuild of the home page cache takes a lock that blocks readers. Readers wait 20 seconds every hour. How do you rebuild without that wait?

67.Cache entries expire at the same instant because they were filled together during a deploy. The next minute every key misses. What do you stagger?

68.You store sessions in the cache you also use for HTML fragments. The cache evicts the least recently used entry when it is full. A traffic spike evicts sessions. Users are logged out. What should not share that space?

69.An email worker uses the same database user as the web app, and that user can delete orders. The worker only needs to read a template and mark a message sent. What privilege is extra?

70.Secrets are in the git repo because the deploy reads the repo. A contractor clones it. What did they clone besides the code?

71.You design a URL shortener. The short code is the row's auto-increment id, printed in base 62. Someone asks for codes that are hard to guess, because sequential codes walk every link. What conflicts?

72.The shortener redirects with 301, which browsers and proxies cache aggressively. The owner changes the destination. Some clients never come back to you. Why is 302 or 307 the usual choice?

73.Every redirect is a database read on the hot path. The same popular code is read thousands of times a second. You cache it. The owner deletes the link. Clicks still succeed until the cache expires. For a taken-down link, what do you do to the cache?

74.You are designing an upload pipeline. Virus scanning is slow. The file is visible to other users as soon as the bytes land, and the scan finishes later. A bad file is already shared. When should it become visible?

75.A leaderboard is a sorted set of scores. You update a score by removing the old value and adding the new one as two calls. A crash between them drops the player. What is the update?

76.The leaderboard key is the score alone. Two players with score 10 collide and one overwrites the other. What belongs in the member?

77.A game server keeps the match in memory and writes the result at the end. The process dies at the last point. The match is gone and the result was never written. What did you fail to persist?

78.You send a weekly email from a query that takes 15 minutes. You run that query in the web server's request that clicked 'send.' The request times out and the email may have gone to half the list. What runs the query?

79.The worker and the web app deploy from the same build, and a bad deploy kills both. The queue fills with unsent mail and nothing drains it. How do you keep a bad web deploy from stopping mail?

80.You are asked for a roughly right design in 35 minutes. You spend 20 minutes on the logo service and have not said where orders live. What should you have ordered?

81.The interviewer says 'assume a million concurrent users' halfway through, after you designed for a thousand. Your single database was the whole plan. What do you revisit first?

82.You draw twelve services for a product with one developer and a hundred users. What is the cost of those lines?

83.A table has a foreign key to users. You shard users and orders onto different clusters and drop the foreign key. What did the database stop checking?

84.You pick a queue because you used one at a previous job. The task is a request the user is waiting on, and the work takes 20 milliseconds. What did the queue add?

85.The product asks for search 'like the big site' with typos, synonyms, and ranking. You have a weekend and a LIKE query would answer the current catalog of 2,000 items. What do you ship first?

86.An audit log is written by the same request that deletes a record, after the delete commits. The process crashes before the log write. The record is gone and the audit is silent. What order can you defend?

87.You keep 90 days of audit rows in the same table as today's, and every login checks that table with a count. The check gets slower every month. What are you scanning?

88.A mobile client saves writes while offline and replays them later. Two devices edited the same note offline. Last-write-wins keeps whichever replay arrives last. The other edit disappears. When is that unacceptable?

89.You identify devices by a header the client sets. A modified client sends another user's device id and pulls their offline queue. What must the server check?

90.A report queries production with a join that locks more rows than you thought. Checkout waits on those locks. How do you run the report?

91.You add an index to a large table by building it in a way that locks writes. Orders pause. The database can build the index without blocking writes, more slowly. Which do you pick during the day?

92.A unique index on email is added while two existing rows share an email. The migration fails halfway through other changes that were in the same script. What do you run first?

93.You store the user's roles in a token at login. An admin removes the user's admin role. The token still says admin until it expires. For a role change that must stick now, what do you consult?

94.File names uploaded by users are used to build a path on disk: /uploads/ plus the name. A name of ../secrets pulls a file outside the folder. What do you store as the path?

95.An export endpoint writes a CSV of every customer to the web server's disk and then redirects the admin to that file's URL. The URL is guessable and the disk fills. What is the export?

96.You debounce a button in the browser so a double click sends one request. A user disables that and the raw client sends two. Is the debounce the protection?

97.A webhook from a payment provider hits your server. You trust it because it came from the internet to the right path. A stranger posts a fake 'paid' message. What do you verify?

98.The provider retries the webhook until you return 200. Your handler credits the account and then crashes before the 200. The retry credits the account again. Where is the unique key?

99.You are drawing the final picture. The interviewer asks what happens when the cache is empty and the database is slow. You have no answer because the diagram only shows the happy arrow. What belongs on the diagram?

100.You suggest a new database because its website lists the features you might need someday. The team knows the one you already run. What is the cost of the new one on day one?

101.The interviewer asks for the number you would page a human about at 3 a.m. You say CPU. The site can be unable to take orders while CPU looks calm, because every worker is waiting on a lock. What do you page on?

102.A write-ahead log is on the same disk as the only copy of the data files. The disk dies. What did the log fail to protect?

103.You compress responses at the app. A proxy in front also compresses. Clients sometimes receive a body that will not decode. What happened?

104.A batch import of a million rows is one transaction. It holds locks for the whole import, and a failure rolls back the hour. What do you commit instead?

105.You close the design by saying the system is highly available. You have one database, one region, and a cache that fails open onto that database. What sentence is honest?