FreeExam

Pretrade Risk Controls and Kill Switches

Design order limits and halts, handle stale risk data, and verify safe cancellation and recovery.

These prompts are original practice. They are not questions from a named employer or a live hiring loop.

Atomic reservation

A desk has a $1.0m gross working-order limit. Existing orders reserve $700k. Two gateway workers receive concurrent $200k buy requests. Orders reserve full notional until a terminal venue outcome. The reservation ledger supports an atomic check-and-add.

  1. 1.How many new requests fit?

  2. 2.How much headroom remains after admitting one?

  3. 3.What could go wrong if each worker reads headroom before writing?

  4. 4.Which operation preserves the limit?

  5. 5.If a $150k resting order is confirmed canceled, what headroom remains after admitting one request?

  6. 6.What if a cancel is sent but has no outcome yet?

  7. 7.What if the gateway crashes after reserve but before known transmission?

  8. 8.Why associate the reservation with a request ID?

  9. 9.Which test directly exercises the race?

  10. 10.What should the rejection include for operators?

Price collars

A gateway rejects a buy above 3% over a verified reference. The reference is $40.00, ticks are $0.05, and the source must be at most 250 ms old. Prices exactly on the collar are allowed. New risk-increasing orders fail closed when the reference is unavailable.

  1. 11.What is the maximum valid buy limit on the initial reference?

  2. 12.Does a $41.25 buy pass with a fresh reference?

  3. 13.Does a $41.20 buy pass the collar on fresh data?

  4. 14.The reference is 300 ms old. What happens to a $40.00 risk-increasing buy?

  5. 15.What if the feed heartbeat is fresh but the instrument's quote is 300 ms old?

  6. 16.What if the replacement reference is $39.00?

  7. 17.With that $39.00 reference, what is the highest passing tick?

  8. 18.What should a reference fallback verify?

  9. 19.Should stale reference data block a pure cancel under a separate healthy cancel policy?

  10. 20.Which test checks a clock boundary?

Limits across scopes

An account limit allows $4m gross and has $3.2m reserved. The firm limit allows $10m and has $9.6m reserved including the account. A proposed order reserves $0.5m. No offsets are allowed.

  1. 21.Which limit blocks the order?

  2. 22.What is account headroom?

  3. 23.What is firm headroom?

  4. 24.What is the largest order that fits both, ignoring other limits?

  5. 25.What if an account reservation succeeds but the firm reservation fails?

  6. 26.What if two channels each calculate firm capacity from only their own orders?

  7. 27.Why include open orders in the calculation?

  8. 28.Should a sell always offset a buy in this gross limit?

  9. 29.What if one leg of a two-leg package rejects?

  10. 30.Which observation would reveal inconsistent scopes?

Halt lifecycle

The desk's halt stops new and exposure-increasing replace requests. Pure cancels and status queries are allowed. At trigger, orders A and B are live, and C has unknown state. A cancel is confirmed, B partially fills before its cancel is confirmed, and C is later confirmed live.

  1. 31.What must happen when the halt triggers?

  2. 32.How should A be handled after the cancel confirmation?

  3. 33.How should B's partial fill be treated?

  4. 34.What should happen to C after it is confirmed live?

  5. 35.Does the halt itself prove all market orders are gone?

  6. 36.What test shows the cancel path survived?

  7. 37.What if a replace can increase quantity?

  8. 38.What about status-only messages?

  9. 39.Why audit the halt's effective timestamp?

  10. 40.What must be true before resuming?

Stale risk snapshots

A gateway caches a versioned risk snapshot for up to 500 ms. A snapshot shows $300k remaining. At age 450 ms a $200k order is reserved locally. Age later reaches 550 ms without an update. Policy rejects new risk-increasing orders after expiry and keeps pure cancels available.

  1. 41.What headroom is locally available just after the first reserve?

  2. 42.At age 550 ms, can a new $50k risk-increasing order pass?

  3. 43.Can a healthy pure cancel still proceed?

  4. 44.What state does the first reservation have while venue outcome is unknown?

  5. 45.What if an older snapshot arrives after a newer one?

  6. 46.What should an updated snapshot specify to avoid double counting local reservations?

  7. 47.What if venue events advance during refresh?

  8. 48.How should expiry behave if the local clock jumps backward?

  9. 49.Which failure injection tests stale-snapshot handling on both order paths?

  10. 50.What metric gives early warning?

Session failover

Primary and standby share a durable order journal. Only the writer holding a valid fenced lease can transmit. Primary becomes unreachable. Its lease may still be valid. One order is in the journal as prepared, with no recorded venue response.

  1. 51.Can the standby transmit immediately?

  2. 52.What should be assumed about the prepared order?

  3. 53.Which external source can resolve the prepared order?

  4. 54.What if the venue says the order filled?

  5. 55.What if a replay includes the same execution twice?

  6. 56.What if the venue confirms the order never existed and policy allows resubmission?

  7. 57.What if both instances show the same lease token due to a defect?

  8. 58.How can a test prove the old writer is fenced?

  9. 59.Why verify the cancel channel during failover?

  10. 60.What must pass before increasing throughput?

Quantity and notional boundaries

A contract trades at a limit of $12.50 with multiplier 100. A desk caps quantity at 20 contracts and notional at $20,000. The order quantity is an integer and both caps are inclusive.

  1. 61.What notional does one contract reserve?

  2. 62.What is the maximum quantity allowed by both caps?

  3. 63.What notional does a 17-contract order reserve?

  4. 64.What if the multiplier is missing?

  5. 65.What happens if the order quantity is zero and the schema requires positive quantity?

  6. 66.How should arithmetic avoid a large input wrapping into a small notional?

  7. 67.What case checks the inclusive notional cap?

  8. 68.If price rises to $12.55, what max quantity fits?

  9. 69.Why validate currency conversion when limits are in base currency?

  10. 70.What should a rejection show?

Amendments and reservations

An order reserves 600 shares. A replace requests an increase to 900. The desk has 200 spare shares of capacity. The venue uses atomic replace semantics if accepted, with interim uncertainty until outcome.

  1. 71.How many additional shares would the increase require?

  2. 72.Can the increase pass before another reservation is released?

  3. 73.How much may the order increase with current headroom under the stated semantics?

  4. 74.What if a decrease to 400 is sent but acknowledgment is pending?

  5. 75.If the decrease is confirmed and no fills occurred, what capacity becomes free?

  6. 76.A pure cancel is rejected as too late because the order filled. What changes?

  7. 77.Why carry the original and replacement IDs in the audit record?

  8. 78.What if venue semantics temporarily allow both old and new orders to live?

  9. 79.What should a replace rejection do to the old order?

  10. 80.Which test exercises the most relevant race?

Mass-cancel capacity

The desk has 480 resting orders across affected sessions. Its safe cancel path can process 120 requests per second. Status queries share the connection, but can be rate-limited separately. Assume one cancel request per order, with no retries in the arithmetic.

  1. 81.What is the minimum time to submit all cancels at that rate?

  2. 82.Does that time establish when risk disappears?

  3. 83.If 120 requests fail locally before sending, how many additional attempts are needed at minimum?

  4. 84.How much submission time do those 120 attempts require at full rate?

  5. 85.What traffic should retain capacity under a halt?

  6. 86.What if the venue supports an approved mass-cancel operation?

  7. 87.What if the halt source is a failed entry service?

  8. 88.What metric shows the backlog is aging?

  9. 89.What tradeoff should guide cancel priority?

  10. 90.How should a cancel load test be run?

Restart criteria

An incident owner requires reconciled open orders, healthy risk data, working cancel path, and an authorized ramp. The first test uses 5% of normal traffic. A stop threshold is more than two unresolved orders in one minute.

  1. 91.Can the first test start if one old order remains unresolved under the stated reconciliation gate?

  2. 92.During the pilot, three new orders are unresolved in one minute. What follows?

  3. 93.If exactly two are unresolved, does this threshold alone require stopping?

  4. 94.What does a successful 5% test establish?

  5. 95.What should the next ramp step check?

  6. 96.What if the designated approver is unavailable?

  7. 97.What evidence should the incident log preserve?

  8. 98.What if one venue passes while another fails a shared gate?

  9. 99.What recovery drill tests the whole control chain?

  10. 100.Which policy change directly reduces uncertainty during recovery?

  11. 101.What should prevent automatic failback after a pilot stop?