High-Level Design Interview Practice

Advanced System Design & Software Architecture · Lesson 68 · Architecture Practice, Interviews and Capstone

Lesson Overview

Three TechLearningPro candidates were given three prompts that already exist as full case studies in this course: a link shortener, a community feed, and a course checkout. All three drew a cache, a queue, and a second region in the first twelve minutes. The shortener candidate never said whether a redirect could point at an arbitrary host. The feed candidate said "fan-out on write" and never computed what four million followers do to the write. The payments candidate stored "the card" in the service database and treated a timeout as a failure the client should retry with a new charge. The packets in lessons 49, 57, and 55 already refuse those moves. The candidates had not practiced the forty-five-minute cut, so the packets did not help them.

This lesson is that cut. System Design Interview Framework supplies the clock and the six-row rubric. Low-Level Design Interview Practice is the other hour, about types and locks. Here the artifacts stay at service level: a scope sentence, a labeled bottleneck, an HTTP contract, one writer per fact, a small diagram, one deep dive, and a reopen condition. You will run the clock on Link Desk, the shortener from Design a URL Shortening Service. You will then score a feed loop and a payments loop against the probes those products actually contain. The hands-on prompt is a video-sharing hour aligned with Design a Video Streaming Platform: control plane and bytes, not a second copy of the case study.

The rule for every drill is the same. The case study is the answer key you read the next day. The interview is closed-book. A correct sentence you can defend beats a diagram you memorized and cannot recompute.

Learning Objectives

By the end of this lesson you will be able to:

1. Compress a Module 5 case into a forty-five-minute loop without dragging in the next case's subsystems.
2. Open with a scope sentence that includes the trust decision the product cannot dodge.
3. Estimate the hot path and the quiet path separately, and delete boxes the hot path does not need.
4. Write an HTTP contract whose status codes match absence, conflict, revocation, and an unknown dependency.
5. Name the system of record, the derived views, and the staleness each view is allowed to serve.
6. Deep-dive the failure that defines the product: open redirect, celebrity fan-out, or a charge timeout.
7. Close with a decision whose reopen condition is a number you computed, not a slogan.
8. Score a shortener, a feed, and a checkout with the same weights and different required probes.
9. Recognize when the interviewer has moved you from HLD into classes, and switch to lesson 67's clock.
10. Practice a video-sharing prompt by separating upload, packaging, and playback egress.
11. Use the case studies as calibration recordings, not as scripts.
12. Explain a hybrid design by computing amplification, then choosing.

Prerequisites

• Lesson 66, the clock and the weighted rubric. This lesson does not redefine them. It fills them with probes.
• Lesson 23 and lesson 24, so estimates stay labeled and the sequence stays familiar.
• Lesson 49, Link Desk: allowlisted https destinations, 302, idempotent create, clicks off the redirect path. Read it after your first mock, then again before you argue with the score.
• Lesson 57, the hybrid feed: fan-out on write under a follower threshold, fan-out on read above it, ranker skippable, cursor pagination.
• Lesson 55, payments: no card data in our store, idempotency key, unknown timeout, ledger and provider as two facts that can disagree.
• Lesson 51, for the video exercise: the application tier does not carry media bytes; HLS is RFC 8216; object storage and a CDN are the data plane.
• Lesson 27, lesson 33, lesson 35, and lesson 37 as the mechanisms you may name and should not re-teach unless the dive lands on them.

Detailed Core Concepts

The practice contract

Each drill has a private probe list, the way an interviewer does. You do not see it during the forty-five minutes. You see it when you score. A loop that never touches the probe cannot score above a 2 on the deep dive, even if the diagram is fashionable.

If your mock partner skips the probe, ask it of yourself at minute thirty-three. Offering the probe is a navigation point under lesson 66's rubric.

What "building on the case study" means

It means the product decisions in the case study are the ones a strong answer reconstructs, because they follow from the requirements, not because you memorized a page. Link Desk refuses open redirects because a shortener stores a caller-supplied URI. The feed refuses pure fan-out on write because amplification is follower count. Payments refuse storing a PAN because we are a merchant, not a cardholder-data environment, and the browser can send the card to a tokenizer or to provider-hosted fields.

It does not mean quoting the case study's schema from memory. If your row names differ and the invariant matches, the score stands. If your row names match and the invariant is missing, the score falls.

Scope sentences you can reuse as shapes

A scope sentence has the workflow, the scale label, the trust choice, and the exclusion.

• Shortener: "Create and resolve allowlisted https links for our own campaigns, one region, clicks asynchronous, no public shortener for arbitrary hosts."
• Feed: "Home feed for follows, hybrid fan-out, chronological candidates, ranker optional, one region, no chat and no media pipeline."
• Payments: "Authorize and capture a course purchase with an idempotency key, ledger posted with the state change, provider holds card data, reconciliation exists because the two will disagree."
• Video: "Upload a lesson video by signed PUT, package HLS asynchronously, play through a CDN after an entitlement check, one region. The API does not proxy bytes."

Write your own numbers into the sentence as assumptions. The shape is what you practice.

Estimation patterns that show up in every drill

Separate the hot path from the large path. They are often different.

• Shortener: redirects per second are the hot path; create is quiet; click storage is the large path and must leave the redirect latency budget.
• Feed: a celebrity post's write amplification is the hot spike; a normal user's post is cheap; read QPS of the home timeline is the steady load.
• Payments: attempts per second are modest; the hard number is the timeout window in which state is unknown; storage of card data is a number you should be able to say is zero bytes of PAN.
• Video: egress in bytes per day dominates; control-plane QPS is ordinary. A design that scales the API fleet to carry video has estimated the wrong path.

Use lesson 66's habit of labeling peak factor as an assumption. For a launch email, the shortener's redirect peak is a spike of minutes, not a flat day. Say so.

API habits that survive these four products

Unsafe creates carry Idempotency-Key. Replay of the same body returns the original result. A different body with the same key is 409.

Revocation is visible. A disabled link is 410 within the cache staleness you declared. A refund is a new state, not a deleted row. An unpublish of a video removes entitlement and purges or expires the manifest. Deleting the only copy of the bytes is a separate, slower decision you should mention and usually defer.

Absence is 404. Illegal transition is 409. Dependency down on a required path is 503, except where the product can degrade: a feed ranker that is down serves chronological candidates; a click logger that is down still redirects.

Lists use a cursor when the underlying collection receives inserts at the top. Offset pagination on a feed repeats and skips. Say that once and move on.

Data ownership habits

One writer per fact. The link row is owned by the shortener. The timeline cache is derived. The post is owned by the post service. The follower graph is owned by the graph service. The charge state is owned by our payments service. The money movement at the provider is owned by the provider. The ledger entry is owned by us and must balance. When two owners can disagree, the design includes a reconciliation fact, not a hope.

Say what is not stored. Arbitrary destination hosts. Card numbers. Video bytes in the application database. A feed item that is the only copy of the post body, if the cache can be dropped.

Deep-dive menu

Prepare two dives and let the interviewer pick.

Inside the dive: mechanism, failure, user-visible result, one test. Then stop. A second subsystem is a different interview.

Scoring additions on top of lesson 66

Keep the weights: navigation 15, estimation 15, API and data 20, high-level design 15, deep dive 25, trade-offs 10. Add a probe checkbox the reviewer fills before arguing about taste.

• Probe touched with a mechanism: deep dive may be 3 or 4.
• Probe named and postponed with a real reason: deep dive may be 2.
• Probe absent: deep dive is at most 2, and navigation is at most 2 if the scope sentence also missed the trust decision.

A weighted 3.0 remains a solid senior signal. Staff practice adds the operational sentence from lesson 61: who is paged when reconciliation finds a mismatch, or when the CDN still serves a revoked manifest.

Time trouble on purpose

These prompts are easy to over-scope. The repair is a pre-committed exclusion list you write at minute five and defend. For the shortener, exclusions are preview fetches of the destination, custom per-click experiments, and a public multi-tenant shortener. For the feed, exclusions are chat, notifications, and the media pipeline. For payments, exclusions are marketplace payouts, chargeback operations design beyond "a case is opened," and a second payment provider. For video, exclusions are live streaming, a global multi-CDN steering plane, and recommendations.

If the interviewer pulls an exclusion back in, drop your second dive, not your probe. The probe is why the prompt exists.

Architecture and Design Diagrams

The practice loop is lesson 66's pipeline with a probe gate before the score. You can draw this once on a practice card and reuse it for every prompt.

mermaidCopy
flowchart TD
    S[Scope sentence with trust choice] --> N[Hot path and large path estimates]
    N --> C[HTTP contract]
    C --> O[Owners and derived views]
    O --> D[Diagram with protocols]
    D --> P{Probe chosen}
    P --> V[Mechanism failure and user result]
    V --> R[Reopen condition tied to a number]
    R --> Score[Lesson 66 weights plus probe checkbox]

Link Desk's interview diagram is five boxes. Anything more is a case-study figure you do not have time to defend.

mermaidCopy
flowchart LR
    subgraph outside [Outside the trust boundary]
        Browser[Browser]
        Creator[Authenticated creator]
    end
    Edge[Edge: authn on create, rate limits]
    API[Link service]
    DB[(Link rows)]
    Cache[Redirect cache]
    Clicks[Click log async]
    Creator --> Edge
    Browser --> Edge
    Edge --> API
    API --> DB
    API --> Cache
    API --> Clicks

The feed interview diagram has to show two write paths or it is not the hybrid. A single arrow labeled "fan-out" hides the decision.

mermaidCopy
flowchart TD
    Post[Post write] --> Thr{Follower count under threshold?}
    Thr -->|yes| Push[Append post id to follower timelines]
    Thr -->|no| Author[Keep on author timeline only]
    Read[Home read] --> Merge[Merge viewer timeline and celebrity authors]
    Push --> Read
    Author --> Merge
    Merge --> Rank[Optional ranker]
    Rank -->|down or slow| Chrono[Serve chronological candidates]

The payments diagram is a trust boundary more than a service map. Card data never crosses into our database. The ledger and the provider are different owners.

mermaidCopy
flowchart LR
    Browser[Browser] -->|card to provider-hosted fields| Provider[Payment provider]
    Browser -->|token, amount, Idempotency-Key| Pay[Payments service]
    Pay --> Ledger[(Ledger and payment state)]
    Pay -->|token and idempotency key| Provider
    Provider -->|signed webhook| Pay
    Batch[Settlement file] --> Recon[Reconciliation cases]
    Ledger --> Recon

Read these as the maximum drawing for minute thirty. If your board has more boxes, you have spent the dive.

Technical Explanation

Shortener arithmetic you should be able to redo

Assumptions, labeled as such: 2 million redirects per day, peak factor 10, so about 2e6 * 10 / 86400 ≈ 230 redirects per second. Creates: 20,000 per day, negligible. Row size about 500 bytes. Five years of links is about 20,000 * 365 * 5 * 500 bytes, under 20 GB. A click event of 200 bytes at 2 million per day is about 400 MB per day, about 150 GB per year if you keep raw clicks that long. You probably keep aggregates and a short raw window. Say the window.

The first saturation is not storage. It is redirect latency when the database is slow, which is why a cache sits on resolve, and why a cache miss storm needs a single-flight on a hot code. The create path does not need a shard. A public shortener with user-generated links to any host is a different product: abuse volume, malware destinations, and a trust model you excluded.

Code generation: a random 64-bit value, encoded, is unguessable for practical rates. A sequential counter is guessable. A custom alias shares the key space and the unique constraint. Collision on insert retries a new random code. You do not need a distributed id service at 20,000 creates per day.

Redirect status: 302 so browsers and intermediate caches do not freeze a destination you might disable. 301 is a promise you cannot take back. 410 after disable. 404 if the code never existed. Cache TTL is the maximum time a disabled link may still redirect. Delete the cache key on disable and still assume a replica was late. The TTL is the real bound.

Clicks: append asynchronously. If the logger is down, redirect still returns 302. Counts may be low. Say that accuracy choice. It is the trade-off row.

Feed arithmetic you should be able to redo

Assumptions: 10 million daily active viewers, each opening the feed 10 times a day, peak factor 5. Reads: 1e8 * 5 / 86400 ≈ 5,800 per second. Writes: 1 million posts per day, most with 100 followers, a few with 5 million.

A median post fan-out is 100 timeline appends. A celebrity post is 5 million appends. At even a generous 5,000 appends per second, the celebrity post takes many minutes to finish pushing, and it contends with everyone else. That is why the threshold exists. Pick a threshold you can say, such as 10,000 followers, and compute: accounts under it are pushed; accounts over it are merged at read from a short per-author list. A viewer who follows forty normal accounts and three celebrities does forty cache reads plus three author reads, not five million writes. Deduplicate by post id so a threshold crossing cannot show the exam announcement twice.

The ranker, if you have one, is after the candidate set and must be skippable. The Thursday exam post is a correctness item. A model outage is not allowed to hide it. Chronological fallback is the design, not a degraded accident you hope not to mention.

Cold cache: rebuild from the follow graph and recent author posts, with a limit so a celebrity rebuild does not become a pure fan-out you already refused. Say the limit.

Payments arithmetic and the timeout

Assumptions: 50 purchases per second at a launch peak, far below what a single primary needs for the row itself. The hard problem is correctness under retry. The client sends Idempotency-Key. You store the key, a hash of the body, and the payment state. Same key and same body returns the stored result, including an in-flight result. Same key and different body is 409. A new key on a client retry is a second charge. Say that the client must persist the key before the call.

States you should be able to list: PENDING, AUTHORIZED, CAPTURED, FAILED, UNCONFIRMED. A timeout or a connection drop after the request was written is UNCONFIRMED, not FAILED. A worker queries the provider with the same idempotency key, using the provider's published API, and moves the state when the provider answers. Until then the learner sees "payment processing," not a new checkout that mints a new key.

The ledger posts in the same database transaction as the move to CAPTURED. A capture without a journal, or a journal without a capture, is the bug finance finds a month later. Provider webhooks are inputs, deduped by the provider's event id. They are not the system of record. Settlement files are reconciled against the ledger. A mismatch opens a case. It does not silently edit a balance.

Card data: the browser talks to provider-hosted fields or a tokenizer. Our service receives a token. The database stores the token reference if we must, the amount in minor units, the currency, and the charge id. A column for PAN is a failed loop even if every other box is right.

Video path in one page

Control plane: create an upload session, return a short-lived signed PUT to object storage, complete the session with an idempotency key, enqueue packaging. Data plane: workers write HLS playlists and segments, RFC 8216, back to object storage. Playback: the API checks entitlement and returns a manifest URL; the player fetches segments from the CDN. Egress is the CDN's bill, which you estimate in terabytes, and it is not a reason to add API replicas that proxy bytes.

Revoke: entitlement fails closed immediately. CDN objects expire or are purged. Say the residual window, the same way the shortener says the cache TTL. A design with no residual window and no purge is a wish.

How to use the case study the next day

Score the recording first, with the probe checkbox, before you reread the lesson. Then read the case study and write three gaps: a number you could not recompute, a status code you missed, a failure you never said. Practice only those gaps the next session. Rereading the whole chapter feels like work and preserves the script. The gaps are the work.

When the interviewer goes low-level

Sometimes "design a shortener" becomes "write the redirect handler." You have been moved. Say "I am switching to the request path in one process." Then talk about the allowlist check, the cache get, and the status code. Do not invent a class hierarchy unless they ask for one. Lesson 67's rule still holds: ports for the database and the cache, time injected if expiry depends on it, no vendor SDK in the core. The allowlist is application code over java.net.URI. It is not a framework feature.

Staff extras that fit in two minutes

Name the on-call symptom. Shortener: redirect error rate and disable lag. Feed: fan-out delay and timeline rebuild age. Payments: count of UNCONFIRMED older than five minutes, and reconciliation mismatches. Video: packaging backlog and CDN 4xx on segments. One symptom each. A loop that lists a monitoring product without a symptom does not get the staff credit.

Practical Implementation or Design Walkthrough

Forty-five minutes, prompt: "Design a URL shortener." This is the interview cut of lesson 49. Read that lesson tomorrow. Today the board has to stand alone.

Minutes 0–6

Questions: who creates links, may the destination be any host, do we need click counts on the redirect, one region or many, and is this the public internet or our campaigns?

Answers you write down if the interviewer says "you decide": authenticated employees create links; destinations are https and the host is on an allowlist a reviewer edits; anyone may resolve; click counts are best-effort; one region; our campaigns, not a public pastebin for URLs.

Scope sentence. Create, resolve, and disable allowlisted https links. 302 on success. Clicks asynchronous. One region.

Out of scope. Preview scrapes, arbitrary hosts, password-protected links, editing a destination in place. Changing a target is disable plus create.

Quality. Redirect p99 under 50 ms when the cache is warm. A disable becomes visible within the cache TTL, which you set to 60 seconds. Creates are durable before the API returns.

Minutes 6–12

Use the arithmetic from the technical section, with your own assumptions stated. End with: "Redirect QPS is a few hundred, row storage is tens of gigabytes, click volume is the thing we take off the path. One relational primary is enough. I will not shard. I will cache resolves."

If the interviewer multiplies redirects by 100, recompute. A few tens of thousands of redirects per second still may not require a shard of the link table if the cache absorbs reads. The reopen is cache hit ratio and primary read capacity, not a reflex to add a second region.

Minutes 12–20

Expiry is checked at read time against expires_at. A sweeper that marks rows expired is an optimization. Correctness does not depend on it.

Minutes 20–26

Link row, owned by the link service: code, destination, owner, created_at, expires_at, disabled_at. Unique on code. Cache key is the code. Cache value is the destination and the disabled bit, or a negative entry for 410. TTL 60 seconds. Click events owned by an analytics consumer, not by the redirect transaction. Allowlist owned by a reviewer workflow, cached, and small.

Unguessable random code. Custom alias in the same unique index. Collision retries.

Minutes 26–33

Draw the five-box diagram. Speak the trust boundary: the creator is authenticated; the browser is not; the destination host must already be on the list before we store it. We do not fetch the destination server-side. That fetch would be a server-side request forgery the day the allowlist is wrong.

Minutes 33–41

Interviewer picks disable and cache. You say: disable sets disabled_at and deletes the cache key. A request that still hits a stale replica or a stale cache may 302 for at most the TTL. After that, reads see 410. You refuse 301 because a browser may cache it indefinitely, and a disable would not be observed. Failure: the database is down. Cache hits still redirect. Cache misses return 503. We do not guess a destination. Failure: the click sink is down. Redirect still succeeds. The count is low until the sink returns. That is an accepted loss.

If they had picked create, you would have shown the unique idempotency key stored with the request hash, and a code insert that retries on unique violation.

Minutes 41–45

Decision. One primary, cache-aside on resolve, 302, allowlist, async clicks.

Refused. Open destinations, 301, synchronous click writes, sharding.

Cost. Disable is not instantaneous. The bound is the TTL. Creators must understand that.

Reopen. Measured redirect load that misses the cache often enough to hurt the primary, or a product decision to allow arbitrary hosts, which reopens abuse and the server-side request question and is a new design.

Staff sentence. On-call pages on redirect 503 rate and on disable-to-410 lag above the TTL. The allowlist change is a reviewed write, not a config file on one laptop.

Score of a complete board

Navigation 4, estimation 3, API and data 4, high-level design 3, deep dive 4, trade-offs 4. The estimation 3 is because the click retention window was a bit hand-wavy. Weighted around 3.7. A board that forgot the allowlist caps the deep dive at 2 and the total under a pass, no matter how elegant the cache is.

Enterprise Real-World Scenarios

Scenario 1: community feed, forty-five minutes

The prompt is TechLearningPro's home feed. The case study is lesson 57. The candidate has read it. In the room they still have to compute.

Assumptions they should write: daily active learners, follows per learner, posts per day, and the follower count of the largest instructor account. Use course-shaped numbers if none are given: 5 million DAU, 20 feed opens each, peak factor 4, posts with a median of 80 followers, and one instructor at 4 million. Read QPS is large and cacheable. The instructor post is the write spike.

A failing loop says "fan-out on write is the standard" and draws one path. Ask them what 4 million appends costs. If they cannot say, estimation is 1 and the deep dive is 1. A passing loop draws the threshold diamond, picks a threshold, merges on read for accounts above it, dedupes by post id, and makes the ranker optional. They mention cursor pagination in one sentence. They leave chat, push notifications, and video transcoding out of scope, with pointers to lessons 50, 56, and 51 if this were a design review. In the interview, the names of those systems are enough.

Cold cache is the second dive they should offer. Rebuild has a cap. A design that rebuilds by pushing the celebrity post into every follower has reintroduced the spike on the failure path. Interviewers who have read lesson 57 will ask this. Practice it.

Score the probe "celebrity write" as touched or not before you debate whether they said the word "Redis." The timeline store can be any durable log or cache they can explain. The hybrid is the design.

Scenario 2: course checkout, forty-five minutes

The prompt is "design payments for a course purchase." Lesson 55 is the packet. The candidate who starts with a table of card columns has failed the trust probe in the first drawing. Stop and rescore only after they move card data to the provider. Partial credit exists if they correct it out loud before the dive. Lesson 66's recovery rule applies.

A passing board: Idempotency-Key persisted before the call; states including UNCONFIRMED; ledger in the same transaction as capture; webhooks deduped by event id; settlement reconciliation as a case, not a silent write; PAN absent. The estimate shows that 50 captures per second is not the reason to shard. The reason to be careful is double charge and an unexplainable settlement line.

The interviewer asks, "The learner double-clicks." The answer is one key, one charge. The interviewer asks, "The client generates a new key on retry." The answer is that this is a client bug and the service cannot detect it unless the order id is unique and a second key for an already-captured order is refused. Say the order-id guard. It is the practical backstop. Then say the client contract anyway, because a second order id is a second purchase and might be legitimate.

Staff add: UNCONFIRMED older than five minutes is a page. Reconciliation mismatch is a page to finance operations, not to the learner's spinner. Marketplace payouts stay excluded. Lesson 55 said the capstone may extend there. This interview does not.

Weighted score for a board that has the timeout and the ledger and a vague diagram: navigation 3, estimation 3, API and data 4, high-level design 3, deep dive 4, trade-offs 3. About 3.4. A board that retries with a fresh key on timeout is a deep dive of 1 and a no-hire on this loop, because the mechanism creates the incident the prompt is about.

What the scenarios share

The shortener fails people who love caches and forget the open redirect. The feed fails people who love a single slogan and skip multiplication. Payments fails people who love retries and forget an unknown outcome. The same rubric catches all three, which is why the weights do not change. What changes is the probe checkbox. Practice all three in a month. A perfect shortener script does not predict the payments score.

Best Practices

• Write the trust choice into the scope sentence. Hosts, card data, or bytes.
• Estimate the hot path and the large path as different numbers.
• Let the estimate delete a region, a shard, or a synchronous write.
• Put Idempotency-Key on unsafe creates and say what a mismatched body returns.
• Make revocation observable: 410, a feed delete, a failed entitlement, a refund state.
• Mark caches and timelines as derived. Mark one service as the writer of the record.
• Offer two dives. Put the product's defining failure in one of them.
• Tie the reopen condition to a computed threshold.
• Score the probe before you score the drawing.
• Read the case study after the mock, and practice only the gaps.
• When the prompt is video, state that the API does not proxy media bytes.
• Keep exclusions visible so a nervous hour does not absorb chat, search, and a data warehouse.

Common Mistakes and Anti-Patterns

The memorized poster. The candidate reproduces a blog diagram for "the URL shortener" with a key-value store, a cache, and a base62 code, and cannot say why the redirect is 302. It happens because practice stopped at recognition. The consequence is a deep dive of 1 on disable. The repair is to close the book and require the status code and the allowlist before any box.

Slogan fan-out. "Fan-out on write" or "fan-out on read" is the whole answer. It happens because the hybrid was remembered as a phrase. The consequence is a design that falls over on the instructor post or that does thousands of reads per feed view. The repair is to multiply follower count by posts before choosing, and to draw both paths.

The cheerful retry. Timeouts retry the provider with a new idempotency key, or the client is told to "just retry." It happens because retries are a reliability habit applied without the unknown state from lesson 37 and lesson 55. The consequence is a double capture. The repair is UNCONFIRMED and the same key.

Bytes through the app. Video upload is a multipart post to the API, and playback is the API streaming the file. It happens because it is the smallest design that works for a demo. The consequence is an origin that falls over on the first required lesson, which is the incident in lesson 51. The repair is signed PUT and CDN playback, said in the scope sentence so you cannot forget it later.

Synchronous analytics. The redirect waits for the click insert. It happens because one database feels simpler. The consequence is that a slow insert becomes a slow link, and a launch email pages the shortener. The repair is an explicit accuracy loss when the sink is down.

Scope creep as diligence. The feed design grows a chat system because "users will want it." It happens because completeness feels senior. The consequence is no time for the threshold. The repair is the exclusion list at minute five.

Sharding as a compliment. One primary would have been enough, and the candidate partitions anyway, then cannot say which key. It happens because scale language is a status signal. The consequence is a trade-off row of 1. The repair is the reopen sentence: we shard when this measured number crosses this line.

Troubleshooting and Design Review

Review a mock in this order: scope sentence, bottleneck sentence, probe mechanism, reopen number. If any of the four is missing, the loop is not a pass yet, regardless of the weighted math. The math will agree once the caps from the probe checkbox are applied. Do not skip the checkbox to be kind. Kindness is a second mock, not a fictional 3.

Interview Questions and Answers

Q1. How do you practice a case study without memorizing it?

Run a closed-book forty-five-minute loop, score it with lesson 66's weights, and mark the probe touched or missed. Only then open the case study and write down gaps in numbers, status codes, and failures. The next session practices the gaps on a blank page. Highlighting the chapter feels productive and leaves the script intact. The recording is the evidence. If you can redraw Link Desk's allowlist and 302 without the page, you have learned the design. If you can only redraw it with the page open, you have learned to read.

Q2. What is the minimum API for a shortener interview?

Create with an idempotency key and an allowlist check, a redirect that returns 302, 404, or 410, and an idempotent disable. JSON resolve is optional. Click ingestion is not a client API. Status codes matter more than path spelling. 301 fails the disable probe. 200 with a JSON destination fails the browser story unless you also specify the redirect. A create that accepts any http URL fails the trust probe. Four sentences cover this if they contain those codes and the allowlist. A page of endpoints without them does not.

Q3. How do you justify a hybrid feed in under five minutes?

Compute one celebrity amplification and one median amplification. Show that pushing the celebrity blocks the write path, and that assembling every home view by querying every follow is the wrong cost for the median user when the numbers say so. Then draw the threshold: push below, merge above, dedupe by post id. Name the cold-cache rebuild cap so the failure path does not become pure push. Mention that the ranker is skippable. Stop. A five-minute hybrid you can recompute beats a thirty-minute hybrid you cannot.

Q4. Why is a payment timeout not a failure?

The request may have reached the provider and been approved after your socket gave up. Marking it FAILED and retrying with a new idempotency key creates a second charge. Marking it FAILED and not retrying loses a payment the learner completed. UNCONFIRMED means we do not know, and we will ask with the same key. The learner sees a processing state. A worker uses the provider's published query or the idempotent retry rules of that provider's public API. You do not invent a private status method. You do not store the card to "retry ourselves."

Q5. Where does the ledger sit relative to the payment state?

In the same database transaction as the transition to CAPTURED or REFUNDED. The journal is our fact. The provider's balance is their fact. They diverge. Reconciliation reads settlement files and opens cases. A design that updates a learner balance from a webhook alone, with no unique event id and no journal, will apply a retry twice. A design that journals without the state change will show money we did not capture. Say both bugs. The interviewer is listening for the single transaction and for the later reconcile, not for an accounting lecture.

Q6. What do you estimate first for video sharing, and what do you refuse to do with that number?

Estimate source bytes, packaged bytes for a small ladder of renditions, and egress per day. The egress number justifies a CDN. It does not justify scaling the application tier to stream those bytes. Control-plane calls, upload session and playback authorization, are a separate and much smaller QPS. The refusal is in the scope sentence so the diagram cannot quietly route video bytes through the API. Packaging is asynchronous. A retried complete of the upload session is idempotent. Revocation fails the entitlement check immediately and accepts a bounded CDN residual, which you name.

Q7. How do you talk about cache invalidation in a shortener or a feed without a toolkit tour?

State the promise, then the mechanism. Shortener: a disabled link may still redirect for at most the TTL, and disable also deletes the key so the common case is faster than the promise. Feed: a timeline is derived; a deleted post is removed from the author record and filtered at read, or tombstoned, so a pushed copy cannot resurrect it forever. Name one stale read the user can observe. If you cannot name it, you do not yet have a cache design. Lesson 27 is the background. The interview wants the promise in seconds and the user-visible glitch.

Q8. What do you drop first when the clock is behind?

Drop the second deep dive, the extra endpoints, and any region or shard the estimate did not demand. Keep the scope sentence, the bottleneck, the probe mechanism, and the reopen condition. A finished shallow loop that includes the probe outscores a half-drawn masterpiece that does not. Say, "I am skipping the analytics detail to finish disable." Interviewers hear that as navigation. Silence while you draw a warehouse is how the probe dies.

Q9. How do you answer "could we use a queue?" when you do not want one on the hot path?

Yes, for the work that may lag: clicks, feed push to non-celebrity followers, packaging, webhook handling. No, for the decision the user is waiting on, unless you have a fallback: the redirect, the entitlement check, the unique capture. A queue on the redirect path makes a down broker into a down link. Say the user-visible wait. If the product accepts the wait, the queue is honest. If the product is a click, the queue is for the log, and the response returns first. The pattern is not the question. The wait is the question.

Q10. How should interviewers calibrate across the shortener, the feed, and payments?

Use one rubric and a per-prompt probe. Reviewers tick the probe from a quote before they average the six rows. A missing probe caps the deep dive. Reviewers who score "mentioned a log" as depth will inflate loops differently, and calibration will drift. The quote has to contain the mechanism: allowlist and 302, threshold plus merge, UNCONFIRMED and the same key. Run one recorded loop of each prompt through the panel once a quarter. If the scores differ by more than a point on a row, read the quotes. Do not add a new row for confidence.

Q11. When is a second region the right interview answer?

When a written latency or residency constraint makes a single region fail the requirement, or when the availability target and the failure story require an independent site and you have said what stays consistent across sites. "Users everywhere" is not that constraint. A single region with a CDN for video bytes already puts bytes near users. Payment state across two regions that both capture is a dual-charge risk you must design before you draw the region. If you cannot say the conflict rule, you are not ready to draw it. The reopen condition is the honest place for the second region in a forty-five-minute senior loop.

Q12. What does a staff signal look like on these prompts without consuming the clock?

One symptom you would page on, one rollout sentence, and a reopen condition with a number. Shortener: page on 503 and on disable lag; ship to employees before a campaign; reopen shards on measured miss rate. Feed: page on push lag; backfill timelines lazily; reopen the threshold when the follower distribution changes. Payments: page on aged UNCONFIRMED and on reconciliation mismatches. Two minutes at the end are enough. A staff candidate who never finishes the probe has not earned the extra credit. The probe remains the senior bar. The symptom is the staff bar on top.

Hands-On Exercises

Exercise 1: closed-book trio

Problem. In one week, run three forty-five-minute loops: shortener, feed, checkout. Record them. Score the next day. Then open lessons 49, 57, and 55.

Tasks.

1. For each loop, keep the scope sentence, the estimate, the API, the owners, the diagram, one dive, and the reopen condition.
2. Fill the probe checkbox from the table in this lesson before you compute the weighted score.
3. Write three gaps per prompt after reading the case study.
4. Redo only the worst prompt for thirty minutes, repairing the gaps.

Done when. Each recording has a probe quote or an honest miss, and the second take of the worst prompt moves that row by at least one point.

Exercise 2: video-sharing hour

Problem. Forty-five minutes: "Design video sharing for short learner project videos on TechLearningPro." One region. No live stream. No recommendations. Use the control-plane versus data-plane split from lesson 51 without copying its packet.

Tasks.

1. Estimate control-plane QPS and egress separately, from assumptions you label.
2. Specify upload session, idempotent complete, and playback entitlement.
3. State that bytes go to object storage and the CDN, and that the API returns a manifest.
4. Name the revoke residual window.
5. Deep-dive either the idempotent complete or the revoke. Offer both.
6. Exclude transcoding details beyond "a worker writes a small HLS ladder, RFC 8216," unless the dive is packaging.

Done when. A reviewer can point at the tier that carries bytes, and it is not the application fleet.

Evaluation rubric

Apply the cap: deep dive at most 2 if the probe checkbox is empty. A video solution that proxies bytes through the API caps high-level design at 2.

Lesson Summary

High-level interview practice is lesson 66's clock applied to products you have already studied, closed-book, with a probe you must touch. The shortener probe is the allowlist and a 302 you can disable. The feed probe is celebrity amplification and a hybrid you can recompute. The payments probe is an unknown timeout, the same idempotency key, a ledger transaction, and no card numbers. The video exercise probe is which tier carries the bytes.

The case studies are the next-day answer key. The score uses the same weights as lesson 66, plus a checkbox that caps the deep dive when the probe is missing. Slogan diagrams, cheerful retries, and shards you cannot justify fail the loop even when the drawing looks complete. Practice the gaps, not the highlights.

Lesson 69 turns a finished design into a review. Lesson 70 removes the timer and asks for the packet a review can reject.

Further Reading

• RFC 9110 — 302, 404, 409, 410, and 503, the shortener and payments contract.
• RFC 8216 — HTTP Live Streaming, the packaging format named in the video exercise.
• Stripe idempotent requests — a published provider contract for idempotency keys. Behavior in our service follows lesson 37; we do not invent a private payments API.
• C4 model — when a practice diagram needs to stay at containers and not drift into classes.
• Lesson 49, lesson 51, lesson 55, lesson 57, and lesson 66 — the packets and the clock this drill compresses.