Trading Systems Design

1.A trading service promises a 75 µs internal tick-to-send p99 at a stated burst rate. Where should measurement start and end?

2.An 80 µs hard budget allocates 13 µs to ingest, 18 to strategy, 16 to checks, and 9 to encoding and egress. What remains for all other waiting and work?

3.Three serial stages each report a p99 of 20 µs. A proposal treats 60 µs as a guaranteed end-to-end p99. What should the design review require?

4.A stage on the critical path may miss its assigned bound on at most 0.2% of events. Four other stages have the same allowance. Without assuming independence, what bound follows for the fraction that miss at least one stage bound?

5.A serial pipeline has sustained capacities of 900,000, 650,000, and 800,000 events per second. Each event traverses every stage once. What upper bound does this imply before overhead?

6.A team targets 480,000 events per second at 60% of aggregate tested capacity. Each identical worker sustains 200,000 events per second and work is perfectly balanced. What minimum worker count meets the target?

7.A receiver sees 500,000 events per second averaging 128 bytes of payload. Ignoring overhead and using decimal units, what payload rate reaches the process?

8.A capture pipeline retains 80 MB/s of payload for 15 minutes without compression. Using decimal units, how much storage is required for payload alone?

9.A gateway must check every order synchronously. A central analytics service also builds slow aggregate reports. Which boundary preserves the latency budget and the order invariant?

10.A strategy needs a shared configuration lookup on every update. The lookup currently uses a remote service with volatile tail latency. Which design keeps the settings consistent while reducing hot-path dependence?

11.A single worker owns each instrument book. One instrument contributes 70% of traffic and is already saturating its worker. Why may doubling the number of workers leave its tail unchanged?

12.A symbol's updates must apply in feed order, but pricing after each valid book snapshot can run independently for unrelated symbols. Which split preserves the invariant?

13.A latency test clocks 6 µs from strategy start to finish, while live ingress-to-order p99 is 110 µs. What additional evidence narrows the gap?

14.A team compares latency across builds. One load test stops sending events during stalls and the other replays a fixed external arrival schedule. Which is closer to a live feed that cannot slow down?

15.A hot-path audit record must be durable before the order is sent. A benchmark meets its budget only when recording is disabled. What should the review conclude?

16.A design assigns 25 µs to a local check and can use either a nearby shared service or a validated in-process ruleset. What additional consideration can favor the shared service despite its network hop?

17.A gateway and strategy share a process. A bug in one strategy may terminate the whole gateway. What trade-off should be made explicit before splitting them?

18.A design uses one locked object for positions, market data, and metrics. Tail latency worsens under report generation. Which change addresses the observed coupling?

19.A two-socket host decodes feeds on one socket and writes buffers allocated on the other. Which experiment can test a suspected locality cost?

20.A pipeline saves 6 µs by batching serialization, but a partial batch can wait 18 µs before flushing. What should the design compare?

21.A team is allocating a 20 µs strategy budget. An optional feature costs 12 µs and only affects dashboards. Where should it run?

22.A service handles 250,000 updates per second in steady state. Mean time in the service including queues is 40 µs. Under Little's law, what is the average number of updates in flight?

23.A single worker takes 4 µs of CPU per event with no overlap or overhead. What is its ideal maximum processing rate?

24.An order runs two independent calculations taking 18 µs and 27 µs, then joins results in 5 µs. With no scheduling overhead beyond the join, what is the ideal elapsed time?

25.A critical-path dependency slows to 45 µs. At most 30 µs is available before the request becomes stale. What contract should the caller and dependency share?

26.The same architecture must handle continuous liquid futures and an auction with sharp synchronized bursts. What is missing from a single average throughput requirement?

27.A benchmark reports p99 only for events that produced orders, and under load many eligible opportunities are dropped. What other outcome belongs with latency?

28.A stage has high throughput in a single-symbol microbenchmark but slows across 5,000 active symbols. What test better represents the system's working set?

29.A team's packet traces and application logs use different clocks. Which measurement is valid without aligning them?

30.A design has a tested 110 µs p99 against a 120 µs target when logging is healthy. Which test helps show how much budget is robust to operational interference?

31.A dashboard p99 is unchanged across deployments, but the share of orders above the 150 µs deadline doubles from 0.1% to 0.2%. What should the service owner track directly?

32.A trader wants an internal budget and an end-to-end acknowledgement budget. Which definition keeps responsibility clear?

33.A market-data service publishes ten derived indicators for every tick. Only one can trigger orders. Which design preserves useful throughput under growth?

34.A benchmark shows peak throughput of 2 million events per second, with acceptable p99 only up to 1.3 million. Which figure should define usable capacity for a latency-sensitive deployment?

35.A service emits book snapshots every 100 µs to reduce compute. A decision SLO allows at most 60 µs of input age. What is the design issue?

36.A design review can approve one of two proposals. One meets the median budget only. The other meets the stated p99 under replay and documents rejection and recovery behavior. Which evidence addresses the requirement?

37.A feed arrives at 1.2 million events per second for 5 ms. The consumer sustains 900,000 per second and starts with an empty queue. How many events are waiting at the end of the burst in a fluid approximation?

38.A queue holds 3,000 events when the burst ends. The worker serves 800,000 per second, and arrivals continue at 500,000 per second. How long does it take to drain?

39.A FIFO worker can handle 500,000 events per second. An arriving event has 80 events ahead of it, excluding any service already underway. What queue delay do those 80 events imply?

40.A 4,096-slot buffer starts 1,000 slots full. A 2 ms burst exceeds consumption by 1.5 million events per second. Ignoring all other changes, how many free slots remain?

41.A trading signal expires after 200 µs. During bursts its job queue can hold work for several milliseconds. What should admission control use?

42.A single queue carries cancels, new orders, and dashboard refreshes. A burst of refreshes delays cancels. What design protects timely cancellation?

43.A venue permits 2,000 messages per second. Policy reserves 500 for cancels and control traffic. What maximum rate should the new-order limiter allow before any other usage?

44.A receiver processes an external multicast feed whose sender cannot be backpressured by your service. The queue for incremental book updates overflows. What should the system do?

45.A UI consumes complete, versioned snapshots for display only. During overload, it falls several updates behind. Which work can it safely coalesce under a latest-view contract?

46.A publisher coalesces best-quote snapshots for a dashboard. A strategy now proposes consuming that same stream to detect every transition across a threshold. What should the design change?

47.A burst fills queues even though total CPU is only 45%. One market-data partition is at 100% utilization. What should be reviewed first?

48.A risk service retries every request immediately after a timeout. During overload these retries multiply the queue. What should the design adopt?

49.A gateway receives more new-order requests than it can validate before their deadlines. Which response makes overload visible to callers?

50.A strategy can recompute a quote from its latest valid book and need not evaluate every intermediate state. What is one safe optimization under those assumptions?

51.A system processes bursts for 20 ms before autoscaling can add workers several seconds later. What handles the immediate burst?

52.A queue has reached its memory cap. New optional metrics events are arriving along with required executions. What allocation rule protects recovery?

53.A test adds a 2 ms stop to a consumer while a feed arrives at 400,000 events per second. It starts with no backlog. How many events accumulate during the stop?

54.A consumer serves 600,000 events per second against sustained arrivals of 640,000. Can a larger finite queue keep it current indefinitely?

55.A design uses a high-water mark for overload mode and immediately exits overload at the same threshold. It oscillates near the boundary. What change can improve stability?

56.A process can hold 20,000 events in memory, but the current queue delay budget allows only 200 events at the tested service time. Which limit should trigger latency protection first?

57.A trade capture writer batches records in groups of 512 and flushes on a timer. What must its overload design specify for a required durability deadline?

58.A gateway shares a rate limit among strategies. One strategy can exhaust the budget and delay other strategies' risk-reducing orders. Which design is appropriate?

59.A consumer is still receiving heartbeats during a burst, but the oldest unprocessed update is 12 ms old. What should the trading readiness check use?

60.A market-data recovery reader and live handler share one worker pool. Recovering a large historical gap causes otherwise healthy instruments to fall behind. What should be changed?

61.A public feed distributes snapshots on demand. Many local consumers request them simultaneously after a brief outage. What reduces duplicate recovery work?

62.A system admits one request per token and refills a bucket at 10,000 tokens per second with capacity 500. The bucket is full. How many requests can be admitted instantly, ignoring refills during that instant?

63.A queue processes many jobs that time out before they reach the head. Why can skipping expired optional jobs help recovery?

64.A burst benchmark checks that no order messages are lost, but every market update is delayed beyond the decision freshness limit. Has the system met the requirement?

65.A team wants to compare two overload policies. One yields more fills but occasionally uses stale books. The other rejects more orders while state stays current. What evidence should the design review include?

66.A queue receives evenly distributed bursts at most times but the opening auction hits most partitions together. What should a capacity test reproduce?

67.A store limits clients to 50,000 writes per second. Five gateways each independently reserve 12,000 writes per second for peak use. What is the aggregate design gap?

68.A receiver assigns high priority to cancels. A cancel for an order that has yet to be sent jumps ahead of its new-order message. What design principle resolves the conflict?

69.A downstream consumer stops for 3 ms while a 100 MB/s payload continues arriving. Using decimal units, how much payload must a buffer absorb to avoid loss during the stop alone?

70.A service claims bounded overload because it caps the input queue, but each admitted job can spawn an unlimited number of downstream requests. What is missing?

71.A venue connection flaps and the gateway accumulates pending sends. What should happen to time-sensitive orders when the connection returns?

72.A system must document what happens when a burst lasts twice as long as planned. Which explanation is most complete?

73.A standby process is healthy, but it has not received the latest executions. What should gate order entry after takeover?

74.A leader loses connectivity to its coordinator while retaining its exchange session. A standby obtains a newer lease. What must enforce exclusivity?

75.A firm runs two gateways active-active for independent venues but both draw on one group risk limit. How can it retain local fast-path checks without oversubscribing the limit?

76.A replacement gateway will send only after it loads a snapshot at journal offset 900. The snapshot includes events through offset 900. What should it replay?

77.A checkpoint writes account positions, then crashes before persisting the corresponding execution offset. Why can restarting from the old offset be dangerous?

78.A client retries an order because its API request timed out. Which contract prevents the gateway from treating the same intent as a second order?

79.A gateway journals order intent and then sends to a venue. It crashes before recording a response. What should recovery assume?

80.A risk platform targets recovery within 20 seconds and tolerates at most 2 seconds of lost recorded history for optional telemetry. Which names map to these two targets?

81.A backup takes 3 seconds to detect failure, 4 seconds to fence the old writer, 6 seconds to reconcile, and 2 seconds to validate. These phases are serial. What is the modeled time until readiness?

82.A replica is 1.2 million events behind. It can replay 900,000 per second while 600,000 per second continue arriving. Ignoring other limits, how long does catch-up take?

83.A recovery reader applies history at exactly the same rate as live events arrive. A backlog already exists. What must change before it can catch up?

84.A replica loses connectivity just before a critical order record is written. Synchronous replication is required for new sends. What should the primary do?

85.A deployment snapshots market data separately from positions. What risk does recovery face when the snapshots have different effective times?

86.A backup has recovered the order ledger but a required reference-data version is missing. What condition should block readiness?

87.A gateway loses only its market-data feed. The order session and cancellation path still work. What degraded mode fits?

88.A feed gap affects one shard. Other shards are independent, and strategies can be isolated by shard. What failover scope minimizes unnecessary downtime?

89.A failover drill tests process restarts only. Which scenario tests split-brain protection directly?

90.After failover, the backup reports the correct net position and total working shares, but some venue order IDs changed during replacements. What must be compared before canceling specific orders?

91.Two active gateways normally process 280,000 events per second each. One standby must take both workloads after a shared network device fails. Its tested capacity is 500,000 at the required latency. What does the failover sizing show?

92.A primary resumes after an outage and has older journal state than the current active node. What should failback require?

93.A standby is in the same rack and power domain as its primary. What failure is the design weak against?

94.An active-active venue design can recover from one gateway loss, but both gateways use the same risk configuration distribution service. What should a failure review ask?

95.A system replays market events to rebuild pricing and runs the strategy in the same binary. What guard prevents replay from generating external trades?

96.A standby consumes the journal and calculates orders in shadow mode. How should those calculations be used?

97.A new event version adds optional data for analytics, and a standby on the prior version still needs to recover core order state. What makes a mixed-version rollout safe?

98.A risk-limit service uses consensus to allocate capacity, but the gateway is partitioned away from the majority. Which default fits a rule requiring confirmed capacity for new orders?

99.A team wants to measure failover success with the time the backup process starts. What endpoint better reflects service recovery?

100.A venue returns order status from one source and executions from another. They disagree about filled quantity during recovery. What should the design do?

101.A fault shuts down logging but leaves the order path working. The design requires a durable order audit trail. What is a valid degraded outcome?

102.A recovery run reaches the latest feed offset, but its rebuilt book differs from a trusted snapshot at the same sequence. What should happen?

103.A desk needs a manual stop that still works if its strategy process is stuck. Where should the control be enforced?

104.A gateway blocks new orders during failover, but already working venue orders remain live. What should operations track?

105.A standby may have a one-second replication lag for its local dashboard but the order journal is current. What should drive trading readiness?

106.A new gateway has a verified position snapshot but is uncertain whether a hedge was accepted just before failure. What should it avoid?

107.A desk rehearses recovery once, using idle traffic. Which exercise best tests the production design?

108.A reviewer asks for acceptance criteria for the complete design. Which answer covers the requested workload and failure behavior?