Scenario questions

A team splits its monolith into a 'UserDB service', a 'Validation service' and a 'Notification service' because those were the layers in the old code. Every new feature now needs changes in all three. What went wrong?

Leadership wants a full rewrite of a 12-year-old order system as microservices, to be switched on in 18 months. What is the lower-risk alternative?

Orders, Billing and Shipping each have their own deployment but all read and write one 'shop' database schema. Billing wants to rename a column. What is the core problem?

Placing an order must reserve stock (Inventory), charge a card (Payment) and create a shipment (Shipping). Each service has its own database. Payment fails after stock was reserved. What should happen?

A service saves an order to its database and then publishes OrderPlaced to the broker. Occasionally the process crashes between the two steps, and downstream services never hear about the order. Which fix addresses the root cause?

A product page must show product details (Catalog), live stock (Inventory) and average rating (Reviews). Each is owned by a different service, and the page now makes 3 calls and is slow. What is the best long-term approach?

Which is a good reason to choose event sourcing for a service?

A mobile app calls nine different services directly, each with its own authentication logic, and the app breaks every time a service moves. What would help most?

Checkout calls Pricing, Tax, Loyalty, Fraud and Inventory in sequence over HTTP. When Loyalty is down, checkout fails even though loyalty points are optional. Which change best improves this?

A dependency starts failing. 500 clients all retry every 100 ms, with no growth in the delay. The dependency gets worse. Which combination of changes would help?

A breaker is configured to open after 5 consecutive failures. A dependency fails 40% of calls at random, so each call is an independent failure with 40% probability. What do you expect?

A service uses one shared thread pool for calls to Reports (slow, non-critical) and Payments (critical). A slow Reports call makes the checkout page time out. Which pattern targets this directly?

The gateway retries 3 times, the Orders service retries 3 times to Payments, and Payments retries 3 times to the bank. The bank has a short outage. Roughly how many calls can one user request send to the bank?

Which operation is the riskiest to retry automatically?

A user's checkout took 9 seconds. Logs from each of the 8 services look normal in isolation. What gives you the fastest route to the slow hop?

A company with four services and a three-person team is considering a full service mesh to get mTLS and retries. What is the most reasonable advice?

A travel company is planning its first services. One proposal lists 'Search Page', 'Checkout Screen' and 'Email Sender'. Another lists 'Pricing', 'Booking' and 'Guest Messaging'. Which proposal gives more stable boundaries, and why?

Your capability map has eight top-level capabilities and forty sub-capabilities. A three-person team is about to build the first version. How many services should they start with?

A product page calls pricing, stock, catalog and reviews synchronously. Each has 99.9% availability. The team wants the page to stay up during sales even if one of them is struggling. Which design does that best?

A self-contained shipping-quote service keeps a local copy of product weights from catalog events. A bug corrupted half the copied rows. What should the design have included?

Four services share one PostgreSQL database. A column rename in the orders table broke the invoicing and analytics services, which nobody on the orders team knew read that table. What is the underlying problem?

You are splitting a shared database. The billing service still reads the customers table directly. What is a sensible next step?

A search index is refreshed by a job that polls 'SELECT * FROM products WHERE updated_at > :last' every 10 seconds. It misses some updates and loads the database. What is the more reliable approach?

Your team wants to give three other teams access to raw row-change events from your orders table through CDC. What is the main risk?

An order details endpoint calls the order, customer and shipping services one after the other. Each call takes about 80 ms. None of the calls depend on each other's results. How do you improve it?

An admin screen must list orders filtered by customer country and sorted by shipping date, across millions of orders. Customer, order and shipping data live in three services. What fits best?

The mobile team waits weeks for changes to the shared public API, and the payloads are far larger than the app needs. The web team is happy with the API. What would you suggest?

A company has an iOS BFF and an Android BFF. A bug report shows that a discount rule is applied on iOS but not on Android. What went wrong?

A payment consumer occasionally charges a customer twice. Logs show the same PaymentRequested message was delivered twice after a consumer restart. What is the best fix?

A consumer checks 'has this message ID been processed?', and if not, sends a confirmation email and then records the ID. Duplicate emails still go out occasionally. Why?

One malformed message makes the consumer throw on every attempt. The broker keeps redelivering it, and thousands of valid messages are stuck behind it. What should be in place?

A team set up a dead letter queue a year ago. Today someone finds 40,000 messages in it, some months old. What was missing?

Exporting a year of transactions takes 45 to 90 seconds. The load balancer times out requests after 30 seconds, so users get errors even when the export finishes. What fits best?

After moving report generation to an asynchronous job API, the status endpoint gets thousands of requests per second from clients polling in a tight loop. What helps most?

Every internal service calls the central session store on every request to check who the user is. During peak traffic the session store becomes the bottleneck. What is the usual alternative?

The gateway validates user tokens, and internal services accept any request that reaches them without checking anything. An attacker compromises one internal service. What can they do?

A downstream service starts responding very slowly instead of failing. Within minutes, the calling service runs out of threads and stops responding too. The HTTP client in the caller was left with default settings. What is the most likely missing piece?

The gateway gives up after 2 seconds. Behind it, service A waits up to 5 seconds for service B, which waits up to 10 seconds for the database. What happens during a slowdown?

One customer's script sends 50 times its normal traffic to your public API, and latency rises for every other customer. What is the most direct protection?

Each of 10 gateway instances enforces 100 requests per minute per API key in its own memory. A customer complains that their effective limit seems to vary. Why?

During an incident across 30 containers, engineers SSH into hosts one by one, and some logs are already gone because containers were restarted. What should have been in place?

A team logs the full request and response body of every call to help with debugging. What is the main problem?

A dashboard shows average latency of 120 ms for checkout, and it looks fine. Users still complain that checkout is sometimes very slow. What is the dashboard missing?

After someone added a user_id label to the request latency metric, the metrics system slowed down and then ran out of memory. Why?

Every service's liveness probe checks that the shared database responds. The database has a 20-second failover. What happens?

Each deploy causes a burst of errors for about 30 seconds while new instances load their caches. The readiness endpoint returns 200 as soon as the HTTP server starts. What should change?

The team builds a separate container image for staging and production because the database URLs and API keys are written into config files in the image. What would you change?

A service starts normally in production even though an environment variable for the payment provider URL is missing, and it quietly uses a sandbox URL from a default. What should the service have done?

An order saga has reserved stock (Inventory) and charged the card (Payment). Then Shipping finds no courier and its step fails. What should happen next?

A saga fails at its last step. Inventory releases the stock and Order cancels the order, but the customer still sees a $50 charge for a cancelled order. Logs show no errors. What is the most likely cause?

During a saga's compensation, the broker redelivers the RefundPayment message after a consumer restart. The customer is refunded twice, and the warehouse's stock count is now one too high. What fixes this?

A saga's refund compensation times out because the payment provider is briefly unavailable. The orchestrator marks the saga as failed and stops. The order stays pending and the stock stays reserved. What should the design do instead?

Your saga uses choreography: each service reacts to the previous service's event. One refund keeps failing and ends in a dead-letter queue, while the other services finish undoing their steps. Support asks which orders are stuck halfway. Why is that hard to answer?

To avoid losing events, a team changes its Order service to publish OrderPlaced first and commit the order afterwards. Now Shipping occasionally ships orders that are not in the orders table. Why?

A service uses a transactional outbox. A relay publishes each outbox row and then marks it as sent. Sometimes the relay crashes between those two steps. What happens, and what does the consumer need?

The message broker is unreachable for ten minutes. Service A commits each order and then publishes its event directly. Service B writes each order and its event to an outbox table in one transaction. What happens to the events from those ten minutes?

After moving to CQRS, checkouts are fast again. But during a sale, customers complain that the order they just placed is missing from "My orders", and support tickets pile up. The projector is healthy, just busy. What should the team do?

A revenue read model has counted cancelled orders as sales for a year. The projection is fixed today. Service A stores current order rows and throws events away once delivered. Service B is event sourced. Who can correct last year's figures?

An event-sourced service renamed the "total" field of OrderPlaced to "amount" six months ago. A replay to rebuild a projection now fails on the oldest events. What is the right fix?

Five teams share one database. Reporting's month-end query used to slow every service down, so it now runs on a read replica, and the slowdowns have stopped. Schema changes still take three weeks and sometimes break another team's queries. Why did the replica not help with those?

After splitting a shared database, the Orders service calls the Customers and Inventory APIs on every request instead of joining their tables. Schema changes now ship in days and no longer break other teams. What should the team expect next?

Orders keeps a local copy of stock levels, fed by Inventory's change events. One afternoon the broker stalls for three hours. Nothing goes down, but Orders sells dozens of items that had already sold out. What is the best change?

To keep costs down, a team traces 1 in 1,000 requests, chosen when each request arrives. During an incident, 1% of checkouts are very slow, but the tracing backend holds almost no slow traces. What change keeps the slow ones without tracing everything?

All services ship their logs to one search tool. An engineer finds a slow checkout in the gateway log but cannot tell which lines in the Payment and Fraud logs belong to the same request. What is missing?

A dependency starts taking 4 seconds for 0.5% of checkouts. The p99 latency alert does not fire. Why, and what would catch it?

Recommendations normally handles 40 calls per second at about 0.25 seconds each. You are giving it its own bulkhead. About how many threads does it need at minimum?

Checkout and Recommendations share a pool of 20 threads. To protect checkout, the team sets a 500 ms timeout on Recommendations, which works. Then a promotion raises Recommendations traffic to 45 calls per second while it is slow, and checkouts start failing again. Why?

Recommendations has its own pool of 6 threads. It slows down, the pool fills, and new recommendation calls are rejected immediately. What should the product page do with those rejections?

An API can serve 100 requests per second, and its normal users send about 50 between them. One partner is limited to 80 requests per second. When that partner spikes, other users still see errors. Why?

A partner's integration gets 429 Too Many Requests and retries each one immediately. It now sends about 900 requests per second, of which 30 get through. What should the integration do?

A token bucket allows each client 30 requests per second with a burst of 400. After a quiet period, one client suddenly sends 250 requests per second, and the API is overloaded for the first second of every spike before things settle. What should change?

The backend renames 'deliveryDate' to 'estimatedDelivery' in the order API and the new app release reads the new name. A week later, crash reports spike from users who have not updated. What should the team have done?

The backend adds a new order status, 'RETURN_REQUESTED'. Older Android apps crash when they open an order with that status. What is the most direct fix on the client side?

Six teams each own backend services for their business area, but all of them change one React codebase that ships in a single weekly release. Features finished on Monday wait for the release train. What does this point to?

After moving to micro-frontends, the product page loads three different versions of the same UI framework and has doubled in size. What is the best response?

Four teams contribute screens to one mobile app. Each has built its own sign-in refresh logic, analytics wrapper and error screen, and they behave slightly differently. What fixes this?

The web app shell team now has a backlog of requests: a loyalty banner, a checkout promotion and a search shortcut, all to be built inside the shell. Feature teams wait weeks. What has gone wrong?

Marketing wants to rearrange the mobile home screen every week for campaigns. Each change currently needs an app release, and a third of users are on versions more than two months old. What approach fits?

The server-driven home screen starts sending a new 'video-card' component. On app versions released before it existed, the section shows as an empty gap. What is missing?

Field inspectors fill in forms in basements with no signal. The app sends each form straight to the API and shows an error when the request fails, so inspectors retype work later. What design fits?

An offline-capable notes app uses last write wins for everything. Two colleagues edit the same checklist offline, and when both sync one person's changes vanish without a trace. What is the better approach?

Teams take about a week to get a new service into production. Each one sets up its own pipeline, logging and dashboards, and an audit finds a third of services have no health check. What would help most?

Two years after a service template was introduced, new services created from it start with an old framework version and a deprecated logging setup. What went wrong?

During an incident, engineers find that 40 Java services log in five different formats and three of them do not pass trace headers on, so traces stop halfway. What fixes this for good?

The chassis library now contains the Customer and Order classes so services can share them. Every change to Order forces all 30 services to upgrade together. What is the problem?

A new checkout flow needs changes in the web app, the mobile app, the checkout BFF and the payments service, owned by four teams with different release schedules. How can it go live safely?

The codebase has over 600 feature flags. Many have been fully on for a year, and nobody knows what turning them off would do. How should teams manage flags?

After introducing a service mesh with three retries per call, a brief database slowdown turns into a flood of requests. The services also have their own retry library with three retries. What happened?

A company runs 15 services in Go, Java, Python and Node, and must encrypt and authenticate every call between services. Building that into four chassis libraries is proving slow. What fits?

The Orders team removes a field they believe is unused. Two days later, the mobile BFF breaks in production because it read that field. The shared end-to-end test environment had been broken for a week. What would have caught this?

A consumer's contract test records the provider's entire 80-field response. Every harmless addition the provider makes fails the contract, and the provider team starts ignoring failures. What should change?

A mobile product page calls six services directly: product, price, stock, reviews, recommendations and delivery. Each is a separate host, and on a mobile network the page takes over three seconds. What helps most?

Each of the eight services behind a product page takes over a second on about 1 call in 100. The gateway calls all eight in parallel. Roughly how often is the page slower than a second?

The Reviews service behind a product page becomes slow. The team adds a 500 ms timeout on every call in the composer, and now every product page returns an error. What should they have done as well?

A consumer retries a failed message three times straight away, then moves it to the dead letter queue. During a three-minute slowdown of a downstream API, hundreds of valid messages end up in the DLQ. What should change?

An ordered queue's consumer retries every failure eight times with exponential backoff, up to a minute between tries. Messages that fail schema validation are retried too, and each one holds the queue for three minutes. Lag climbs to half an hour. What fixes it without losing the backoff?

After a consumer bug is fixed, the team redrives 2,000 messages from the dead letter queue. Some of those messages had timed out after the warehouse had already booked the delivery, and those customers now get two parcels. What was missing?

An online shop has a web team, a mobile team, an API team and a database team. Adding a gift message to checkout needs work from all four, and takes six weeks of handovers. What structure would help most?

A stream-aligned team owns its React app, Swift and Kotlin apps, a GraphQL BFF, Java services, Kafka topics and its own Kubernetes setup. It is slow and burnt out. What is the most useful change?

Developers hand each release to an operations team. When the service slows down at night, operations restarts it, files a ticket, and developers look at it a week later. What change gives the fastest feedback?

Teams were given on-call for their services, but they cannot change alert thresholds, see production logs or deploy outside a weekly window. Morale is collapsing. What went wrong?

Architects drew six capability-based services. A year later the system still has one shared frontend and one shared database, built by the frontend team and the database team, which were never changed. Why?

A company new to its market reorganises into twelve capability teams on day one, based on a first guess at the domain. Six months later, half the features cross three teams. What should it have done?

Product teams must file a ticket with the platform team to get a new database, a DNS entry or a pipeline. The queue is three weeks long. What should the platform change?

A new platform team spends a year building a complete internal developer portal with every feature it could imagine. Few product teams use it, and most keep their own scripts. What should it have done instead?

Teams keep failing accessibility audits. A central accessibility team fixes the issues before each release, but the same problems come back in every new screen. What is a better approach?

An enabling team for performance has been 'helping' the same product team for 18 months. It now writes most of that team's caching code. What has happened?

Five product teams each tried to build their own fraud detection. All five versions are weak, and the company has two data scientists with fraud expertise. What structure fits?

An organisation creates separate teams for 'the hard parts': caching, the order state machine, the pricing rules and the notification templates. Most features now need three teams again. What went wrong?

The checkout team and the payments team have held daily joint stand-ups and shared a backlog for two years. Neither can ship without the other. What does this suggest?

The platform team says it offers the CI system 'as a service', but every product team needs a meeting with it to set up a pipeline. What is missing?

A company moves from layer teams to capability teams that each own web, mobile, BFF, service and data. Handovers drop sharply, but lead time gets worse, not better. What is the most likely cause?

Capability teams with a good platform used to ship most features alone. A new product strategy means 70% of features now change both Checkout and Payments, and lead times have doubled. What should the organisation consider?

A team added a new API field and kept the old one, planning to delete the old field "in three months". Three months later, version data shows 30% of users still on app versions that read only the old field. What should decide when it is removed?

The domain team wants to restructure the order response, but five app versions are still in use and each reads a slightly different shape. Which approach lets the domain service change without breaking any of them?

A new checkout ships to everyone at once. Within minutes, one checkout in five fails. Rolling back means a redeploy of four services that takes about four hours. What would have limited the damage most?

One of four instances has leaked its database connections. Its process is running and its liveness endpoint, which only checks the process, returns 200, but every real request it gets fails. What takes it out of the load balancer's rotation without restarting it?

Readiness probes run every 10 seconds and act after 3 failures. The service mesh is set to eject an instance after 5 errors in a row. One instance starts failing every request. Which statement is right?

The mesh retries every failed request up to three times. Error rates look fine, yet one instance has been broken for hours, and after a 20-second database failover requests kept failing for much longer than 20 seconds. What is going on?