Architecture Interview Questions — All Categories
98 questions across 27 categories
Designing systems under real constraints: requirements, trade-offs, and the reasoning behind a specific design choice.
How would you handle a migration that needs to run exactly once across an entire fleet of clusters, not just once per cluster?
ExpertArgo CDKubernetes8 min
Even after mitigating cold starts, a small amount of irreducible tail latency remains. How would you design the caller's retry behavior to handle that remaining tail?
AdvancedAWSLambda8 min
How would you design alerting so a public S3 exposure is caught within minutes, rather than being discovered by an external scanner or a customer report?
AdvancedAWSS38 min
How would you scale S3 public-exposure alerting for an organization with hundreds of AWS accounts, where per-account Config rules alone don't scale operationally?
ExpertAWS8 min
Should a new AKS cluster use native Kubernetes RBAC or Azure RBAC for Kubernetes Authorization to control kubectl-level access, and what does the Azure option actually change?
IntermediateAzureKubernetesAKS6 min
You're standing up a new AKS cluster and need to choose a network plugin: Azure CNI or kubenet. What's the actual trade-off, and why can this decision be hard to reverse later?
IntermediateAzureKubernetesAKS7 min
How would you let a pod in AKS call a Key Vault or Storage API using its own Azure identity, without mounting any credential file or secret into the pod at all?
AdvancedAzureKubernetesAKS7 min
How would you decide between App Service, Azure Functions, and AKS for a new event-driven workload, beyond just 'Functions is for small things'?
IntermediateAzureApp ServiceAzure Functions7 min
How would you design a zero-downtime, safely-rollback-able release process for an App Service using deployment slots?
AdvancedAzureApp Service8 min
An Azure Function on the Consumption plan is getting cold-start complaints, and someone suggests 'just move it to Premium.' When does that actually pay for itself, versus just adding cost?
IntermediateAzureAzure Functions6 min
How would you design secret rotation for a live, high-traffic application backed by Key Vault, so rotating a credential never causes a production outage?
ExpertAzureKey Vault8 min
How would you design a resource group and subscription structure for an organization with 15 teams, balancing isolation, cost tracking, and not making every team manage their own subscription?
IntermediateAzure8 min
How would you design a multi-stage Azure Pipelines YAML pipeline so production deployment requires manual approval, while dev and staging deploy automatically?
IntermediateAzure Pipelines6 min
A single Azure service connection with subscription-wide Contributor access is used by every pipeline, including ones that only read a storage account. What's wrong here?
AdvancedAzure Pipelines7 min
A compliance requirement says certain records must be provably unmodifiable for seven years. How would you design this with Blob Storage's immutability features, and what breaks if you choose the wrong policy type?
AdvancedAzureBlob Storage7 min
How would you choose a Storage account's replication setting (LRS, ZRS, GRS, or GZRS) for a workload that genuinely needs regional resilience?
IntermediateAzureBlob Storage7 min
A team wants zero-downtime deploys with fast rollback for a high-traffic payments API. Would you recommend blue-green or canary deployment, and why?
AdvancedCI/CDKubernetes10 min
How would you design the metrics and thresholds that gate automatic canary promotion versus automatic rollback?
AdvancedKubernetes8 min
Your architecture serves a large volume of data out to end users and other services, and data transfer/egress costs have become one of your largest line items. What architectural decisions actually reduce this?
AdvancedAWS8 min
How would you design the data layer differently for an active-active multi-region architecture versus an active-passive (failover) one?
ExpertAWS10 min
How would you design the actual mechanism that decides whether a given database query goes to the primary or a read replica, for an application that wasn't originally built with this split in mind?
AdvancedDatabases8 min
During a network partition, both your old primary and a newly promoted replica briefly accept writes at the same time. How does automatic failover cause this, and how do you design against it?
ExpertDatabases8 min
How would you design artifact signing into your CI/CD pipeline so a deployed container image or binary can be verified as genuinely coming from your build, not tampered with in transit?
AdvancedDevSecOps7 min
What does 'build provenance' actually mean in a supply-chain security context, and how would you start implementing it (e.g. via SLSA) for an existing CI pipeline?
AdvancedDevSecOps8 min