This third set is about three things: how services expose APIs, how they find and call each other safely, and how a team knows the whole system is healthy. It also has the SLO and error budget maths that often comes up in senior and SRE-style interviews.
How to practise: read each question and tap the option you think is correct. You will see right away whether you got it, along with a short explanation, and your score is tracked at the bottom of the screen. This set has 15 questions.
Topics covered in this set
- REST vs gRPC vs GraphQL
- Offset vs cursor pagination
- API gateways and service discovery
- Circuit breakers, retries, backoff and jitter
- Saga pattern and monolith vs microservices
- Logs, metrics, traces, SLIs, SLOs and error budgets
System Design MCQs with answers and explanations
Q1. Two internal services exchange many small requests and need low latency, a strict schema and streaming in both directions. Which API style fits best?
a) gRPC, which uses Protocol Buffers over HTTP/2 with generated client code and bidirectional streaming
b) SOAP over SMTP
c) GraphQL subscriptions over plain TCP
d) REST with JSON over HTTP/1.1
Q2. Which pair correctly lists a benefit and a drawback of GraphQL compared with REST?
a) Benefit: fewer types; drawback: cannot be used from mobile apps
b) Benefit: clients ask for exactly the fields they need in one request; drawback: per-URL HTTP caching is harder and naive resolvers can cause N+1 database queries
c) Benefit: built-in HTTP caching; drawback: over-fetching
d) Benefit: no schema needed; drawback: slower JSON
Q3. A feed API uses ?offset=100000&limit=20. Users see duplicate items while new posts arrive and deep pages are slow. What fixes both problems?
a) Switching to page numbers instead of offsets
b) Caching every page for an hour
c) Increasing the limit to 1,000
d) Cursor (keyset) pagination, for example WHERE id < :last_seen_id ORDER BY id DESC LIMIT 20
Q4. Which responsibility does NOT normally belong in an API gateway?
a) Core business rules such as calculating an order's discount
b) Aggregating several backend calls into one response for a client
c) TLS termination and authentication
d) Rate limiting and request routing to services
Q5. In a microservices system, service instances start and stop constantly with new IP addresses. What does service discovery provide?
a) A database for user sessions
b) A way to share one database between services
c) A tool that generates API documentation
d) A registry (such as Consul, Eureka or Kubernetes DNS) that tracks healthy instances so callers or load balancers can find a current address by service name
Q6. A circuit breaker protecting calls to a payment service is in the open state. What happens next?
a) Every call is sent to the payment service with a longer timeout
b) The service is restarted automatically
c) Calls fail fast without reaching the service; after a cool-down the breaker moves to half-open and lets a few trial requests through to test recovery
d) The breaker closes after the first failure
Q7. Why is random jitter added to exponential backoff when clients retry a failed service?
a) To guarantee the request succeeds
b) So that many clients that failed at the same moment do not all retry at the same moment and overload the service again
c) To make each retry faster than the last
d) To avoid needing timeouts
Q8. A client retries a failed call up to 5 times with exponential backoff starting at 100 ms and doubling each time, with no jitter. What is the total wait across all 5 retries if every attempt fails?
a) 1.6 s
b) 3.1 s
c) 500 ms
d) 6.3 s
Q9. A request passes through three service layers, and each layer makes up to 3 attempts at calling the next one. If the database at the bottom is down, up to how many calls can reach it for one user request?
a) 9
b) 81
c) 3
d) 27
Q10. An order flow spans the Order, Payment and Inventory services, each with its own database. How does the saga pattern keep data consistent?
a) It runs a two-phase commit on every request
b) It runs a sequence of local transactions, and if a step fails, it runs compensating actions such as refunding the payment and cancelling the order
c) It copies all data into one shared database
d) It uses one distributed lock across all three databases
Q11. A five-person startup is building its first product and requirements change weekly. What architecture is usually the best starting point?
a) Serverless functions with a shared database for every endpoint
b) Twenty microservices, one per feature
c) A separate microservice per developer
d) A modular monolith with clear internal boundaries, split into services later if scale or team size demands it
Q12. A checkout request is slow, and it passes through eight services. Which observability tool shows which service added the delay?
a) An uptime ping check
b) Application logs searched by timestamp
c) Server CPU metrics alone
d) Distributed tracing, where a trace ID is passed between services and each hop records a timed span
Q13. Which statement correctly distinguishes SLI, SLO and SLA?
a) An SLA is internal and an SLO is a legal contract
b) They are three names for uptime
c) An SLI is a target and an SLO is a measurement
d) An SLI is a measured value such as the share of requests served in under 300 ms; an SLO is the internal target for it, such as 99.9%; an SLA is a contract with customers that carries penalties if missed
Q14. A service has an availability SLO of 99.9% measured over 30 days. How much full downtime does its error budget allow in that window?
a) About 4.3 minutes
b) About 43.2 minutes
c) About 21.6 minutes
d) About 8.76 hours
Q15. A service with a 99.9% success SLO over 30 days starts failing 1% of requests. If this continues, how long until the whole month's error budget is used up?
a) About 3 days
b) About 30 days
c) About 10 days
d) About 1 day
Quick revision notes
- gRPC for fast internal calls, REST for public and cacheable APIs, GraphQL for flexible client-driven queries.
- Cursor pagination beats OFFSET for deep pages and changing data.
- Gateway handles edge concerns like auth and rate limits. Discovery finds healthy instances by service name.
- Circuit breaker: closed → open → half-open; backoff with jitter; retries multiply across layers (3 × 3 × 3 = 27).
- 99.9% over 30 days = 43.2 minutes of budget; burn rate = observed error rate ÷ allowed error rate.
Frequently asked questions
Should I choose REST or GraphQL for a new public API?
REST is easier to cache, secure and document, and it fits APIs built around resources. GraphQL helps when many clients need the same data in different shapes. A lot of systems use REST for the public API and gRPC inside.
What should happen when the error budget runs out?
Usually the team stops risky feature launches and works on reliability until the budget comes back. Product and engineering should agree on this rule before it is needed, not during an outage.
Are retries always safe?
No. Retry only idempotent operations, or requests that carry an idempotency key. If you retry something like a payment without that key, the customer may get charged twice.
Comments
Post a Comment