Cloud Architect interview questionsSystem Design Interview round

Purpose

Frames the round as a design against a real request and a real estate, so a candidate who prepared a generic high-availability diagram knows in the first minute that it will not be enough.

Purpose

Gives permission to negotiate the requirement. Whether the candidate uses it, and how early, is the first thing this section reads.

Purpose

The load-bearing question. Any candidate can draw two regions; the separator is whether the design is set component by component against numbers from the pack, and whether the candidate finds out what "no data loss" costs before promising it.

Signals to score

• Sets a recovery point and recovery time per component instead of accepting one target for the whole platform
• Works out what synchronous replication to Region B does to `create invoice`: six commits each waiting 24 to 31 ms, well past the 300 ms budget
• Says that a synchronous commit across regions ties Region A's availability to Region B's, so "no data loss" costs latency and uptime or is not true
• Turns the 2.5 second replica lag into a number the board can weigh — about 4,500 writes at peak, several hundred invoices
• Uses the payment processor's 30-day event history to recover card payments after a failover instead of chasing zero lag in the database
• Rejects backup and restore for the invoice database on the 3 h 40 min restore and on transaction logs that never leave Region A
• Chooses a warm standby with a cross-region replica that is promoted on failover, and says what already runs in Region B before the day
• Leaves the cache out of replication and says why
• Picks Region B over Region C and gives the EU plan clause as the reason, not latency
• Puts a monthly cost on the recommendation from the pack's own estimates

Follow-up questions

• The board said no data loss. What would it take to make that literally true, and what would it do to `create invoice`?
• The replica lags 2.5 seconds at peak. How much is that in invoices, and whose are they?
• Card payments settle through the processor. Does that change what "no data loss" has to mean for money?
• Region C is 12% cheaper and the analytics warehouse is already there. Why not use it?
• What in this estate would you not replicate at all?

Purpose

Tests whether the candidate designs recovery as a sequence of dependencies rather than as a second copy of the diagram. Candidates who have run a failover go straight to access and images; candidates who have drawn one go straight to the database.

Signals to score

• Finds that container images exist only in Region A's registry, and replicates them to Region B ahead of time
• Finds that the snapshot copies in Region B are encrypted with a key whose only key manager runs in Region A, and says they cannot be restored while Region A is gone
• Finds that engineers reach the accounts only through single sign-on configured in Region A, and proposes emergency access that does not depend on it, with how it is held and how its use is noticed
• Notes that transaction logs archive only to Region A, so the backup path in Region B recovers to last night, not to five minutes ago
• Checks that Region B has the capacity and quota to run full production, not only the standby's footprint
• Separates what must already be running in Region B from what can be created during failover, and times the second list against fifteen minutes
• Asks what else is regional that the pack does not mention — secrets, certificates, the infrastructure code's state — instead of stopping at three
• Says what kind of exercise would have found each dependency, and that only a real failover finds all of them

Follow-up questions

• Where does Region B pull its container images from on the day?
• The snapshot copies are already in Region B. Can you restore one?
• How does the first engineer on the call get into the account?
• Which of these would a walk-through on paper find, and which only a real failover?
• What else is regional that is not in the pack?

Purpose

Tests whether the candidate follows data past the architecture diagram into backups, logs and people, and whether they treat a boundary already crossed as today's problem rather than as a note for the recovery project.

Signals to score

• Rules out Region C for EU-plan data on the clause alone, before any argument about cost
• Finds that request bodies from failed API calls reach a US logging endpoint, and treats it as a problem now, not as part of the recovery design
• Includes snapshot copies and archived logs in the trace, since the clause names backups
• Asks what "processed" means in the contract — whether support staff outside the EU opening an invoice counts — and says who should answer that
• Proposes a fix at the boundary for logs — strip request bodies before they leave, or ship to an endpoint in the EU — and says which comes first
• Weighs splitting recovery by plan — EU-plan customers to Region B, the rest to Region C — against the roughly $2,500 a month it would save
• Asks where the keys that encrypt EU-plan data are held and whether that matters under the clause
• Names who hears about the logging finding, and before whom

Follow-up questions

• The logging vendor's endpoint is in the US. Is that a recovery design problem?
• Could EU-plan customers recover to Region B and everyone else to Region C?
• A support engineer outside the EU opens an EU-plan customer's invoice. Is the clause broken?
• What do you do about the logs this week, before any recovery work starts?
• Who do you tell, and what do you say?

Purpose

Tests whether the candidate can turn a design into a commitment in plain numbers, including the part the board did not ask about. A paragraph full of reassurance is the answer this question exists to catch.

Signals to score

• States recovery point and recovery time in numbers, per tier where they differ, instead of "near-zero" or "minimal"
• Puts the recovery point in business terms — writes at risk at the worst moment, and that card payments are recovered from the processor's records
• States the monthly cost, and what the cheaper and the dearer options would have bought
• Says what the design does not cover — a bad release or a deleted table reaches Region B within seconds — and what does cover it
• Names the decision the board is taking and who owns the recovery numbers once it is taken
• Says how the numbers will be proven, and what the board will see if a test misses them
• Keeps it short enough to read aloud in about a minute, with no product names
• Offers the path to what the board asked for, with its price, instead of declaring it impossible

Follow-up questions

• A board member asks why not zero. Answer in one sentence.
• Someone runs a migration that deletes a table in production. What does your design do about it?
• Which number in your paragraph are you least sure of, and how will you find out?
• Who owns the fifteen minutes once the board has signed?