Scenario questions

A team splits its monolith into a 'UserDB service', a 'Validation service' and a 'Notification service' because those were the layers in the old code. Every new feature now needs changes in all three. What went wrong?

Leadership wants a full rewrite of a 12-year-old order system as microservices, to be switched on in 18 months. What is the lower-risk alternative?

Orders, Billing and Shipping each have their own deployment but all read and write one 'shop' database schema. Billing wants to rename a column. What is the core problem?

Placing an order must reserve stock (Inventory), charge a card (Payment) and create a shipment (Shipping). Each service has its own database. Payment fails after stock was reserved. What should happen?

A service saves an order to its database and then publishes OrderPlaced to the broker. Occasionally the process crashes between the two steps, and downstream services never hear about the order. Which fix addresses the root cause?

A product page must show product details (Catalog), live stock (Inventory) and average rating (Reviews). Each is owned by a different service, and the page now makes 3 calls and is slow. What is the best long-term approach?

Which is a good reason to choose event sourcing for a service?

A mobile app calls nine different services directly, each with its own authentication logic, and the app breaks every time a service moves. What would help most?

Checkout calls Pricing, Tax, Loyalty, Fraud and Inventory in sequence over HTTP. When Loyalty is down, checkout fails even though loyalty points are optional. Which change best improves this?

A dependency starts failing. 500 clients all retry every 100 ms, with no growth in the delay. The dependency gets worse. Which combination of changes would help?

A breaker is configured to open after 5 consecutive failures. A dependency fails 40% of calls at random, so each call is an independent failure with 40% probability. What do you expect?

A service uses one shared thread pool for calls to Reports (slow, non-critical) and Payments (critical). A slow Reports call makes the checkout page time out. Which pattern targets this directly?

The gateway retries 3 times, the Orders service retries 3 times to Payments, and Payments retries 3 times to the bank. The bank has a short outage. Roughly how many calls can one user request send to the bank?

Which operation is the riskiest to retry automatically?

A user's checkout took 9 seconds. Logs from each of the 8 services look normal in isolation. What gives you the fastest route to the slow hop?

A company with four services and a three-person team is considering a full service mesh to get mTLS and retries. What is the most reasonable advice?

A travel company is planning its first services. One proposal lists 'Search Page', 'Checkout Screen' and 'Email Sender'. Another lists 'Pricing', 'Booking' and 'Guest Messaging'. Which proposal gives more stable boundaries, and why?

Your capability map has eight top-level capabilities and forty sub-capabilities. A three-person team is about to build the first version. How many services should they start with?

A product page calls pricing, stock, catalog and reviews synchronously. Each has 99.9% availability. The team wants the page to stay up during sales even if one of them is struggling. Which design does that best?

A self-contained shipping-quote service keeps a local copy of product weights from catalog events. A bug corrupted half the copied rows. What should the design have included?

Four services share one PostgreSQL database. A column rename in the orders table broke the invoicing and analytics services, which nobody on the orders team knew read that table. What is the underlying problem?

You are splitting a shared database. The billing service still reads the customers table directly. What is a sensible next step?

A search index is refreshed by a job that polls 'SELECT * FROM products WHERE updated_at > :last' every 10 seconds. It misses some updates and loads the database. What is the more reliable approach?

Your team wants to give three other teams access to raw row-change events from your orders table through CDC. What is the main risk?

An order details endpoint calls the order, customer and shipping services one after the other. Each call takes about 80 ms. None of the calls depend on each other's results. How do you improve it?

An admin screen must list orders filtered by customer country and sorted by shipping date, across millions of orders. Customer, order and shipping data live in three services. What fits best?

The mobile team waits weeks for changes to the shared public API, and the payloads are far larger than the app needs. The web team is happy with the API. What would you suggest?

A company has an iOS BFF and an Android BFF. A bug report shows that a discount rule is applied on iOS but not on Android. What went wrong?

A payment consumer occasionally charges a customer twice. Logs show the same PaymentRequested message was delivered twice after a consumer restart. What is the best fix?

A consumer checks 'has this message ID been processed?', and if not, sends a confirmation email and then records the ID. Duplicate emails still go out occasionally. Why?

One malformed message makes the consumer throw on every attempt. The broker keeps redelivering it, and thousands of valid messages are stuck behind it. What should be in place?

A team set up a dead letter queue a year ago. Today someone finds 40,000 messages in it, some months old. What was missing?

Exporting a year of transactions takes 45 to 90 seconds. The load balancer times out requests after 30 seconds, so users get errors even when the export finishes. What fits best?

After moving report generation to an asynchronous job API, the status endpoint gets thousands of requests per second from clients polling in a tight loop. What helps most?

Every internal service calls the central session store on every request to check who the user is. During peak traffic the session store becomes the bottleneck. What is the usual alternative?

The gateway validates user tokens, and internal services accept any request that reaches them without checking anything. An attacker compromises one internal service. What can they do?

A downstream service starts responding very slowly instead of failing. Within minutes, the calling service runs out of threads and stops responding too. The HTTP client in the caller was left with default settings. What is the most likely missing piece?

The gateway gives up after 2 seconds. Behind it, service A waits up to 5 seconds for service B, which waits up to 10 seconds for the database. What happens during a slowdown?

One customer's script sends 50 times its normal traffic to your public API, and latency rises for every other customer. What is the most direct protection?

Each of 10 gateway instances enforces 100 requests per minute per API key in its own memory. A customer complains that their effective limit seems to vary. Why?

During an incident across 30 containers, engineers SSH into hosts one by one, and some logs are already gone because containers were restarted. What should have been in place?

A team logs the full request and response body of every call to help with debugging. What is the main problem?

A dashboard shows average latency of 120 ms for checkout, and it looks fine. Users still complain that checkout is sometimes very slow. What is the dashboard missing?

After someone added a user_id label to the request latency metric, the metrics system slowed down and then ran out of memory. Why?

Every service's liveness probe checks that the shared database responds. The database has a 20-second failover. What happens?

Each deploy causes a burst of errors for about 30 seconds while new instances load their caches. The readiness endpoint returns 200 as soon as the HTTP server starts. What should change?

The team builds a separate container image for staging and production because the database URLs and API keys are written into config files in the image. What would you change?

A service starts normally in production even though an environment variable for the payment provider URL is missing, and it quietly uses a sandbox URL from a default. What should the service have done?