System Design

System Design Interview — Master Checklist

Click a section title to open its detailed page, or expand here to skim the sub-topics.

🔎

Showing 15 of 15 sections

1) Interview game plan ↗

Drive your interview: clarify goals, size the system, propose architecture, and call out trade-offs.

Clarify goals & constraints (users, DAU/QPS, latency SLOs, durability, data retention, multi-region, budget)
Back-of-the-envelope sizing (RPS, throughput MB/s, storage GB/TB, peak vs p95/p99)
API & data model first (critical entities, access patterns, indexes)
High-level architecture (clients, API GW, services, storage, cache, async)
Scale & resilience plan (sharding, replication, failover, backpressure, retries)
Consistency/availability tradeoffs & data flows
Security, privacy, and compliance
Observability (logs/metrics/traces), rollouts, testing
Explicit trade-offs & alternatives

2) Performance math & sizing ↗

Quick, defensible estimates to align capacity, latency targets, and costs with requirements.

Latency/throughput basics; p50/p95/p99 thinking
Little’s Law (L = λW), utilization, queueing intuition
Estimate: read/write QPS, fan-out, payload sizes, cache hit ratio
Capacity headroom, peak/diurnal traffic, burst handling
Cost rough-cut (compute, egress, storage, ops)

3) Internet & networking fundamentals ↗

From DNS to CDNs and load balancers—how users get to your service reliably and fast.

DNS, Anycast, CDN, caching layers, HTTP/1.1 vs HTTP/2 vs HTTP/3
TLS termination, mutual TLS, ALB/NLB/ingress
Load balancing: L4/L7, algorithms (RR, least-conn, EWMA), health checks
NAT, VPC, private subnets, egress patterns

4) Storage & databases ↗

Pick the right store, model data correctly, and plan for scale and consistency.

SQL vs NoSQL: when to use which
Indexes (B-tree, hash), covering indexes, composite keys
Transactions, ACID, isolation levels, MVCC
Sharding: range, hash, consistent hashing, hot-key mitigation
Replication: sync/async, leader/follower, quorum, read-replicas
Time-series, wide-column, document, key-value, graph stores—strengths & tradeoffs
Data modeling: normalization vs denormalization; write/read amplification
Schema evolution & compatibility (Avro/Protobuf/JSON)

5) Caching ↗

Where and what to cache, how to invalidate, and how to keep things consistent.

Where to cache: client, CDN/edge, reverse proxy, service, DB
What to cache: objects, query results, rendered views
Invalidation: TTL, explicit busting, versioned keys
Consistency: write-through, write-back, refresh-ahead
Eviction & sizing: LRU/LFU, slab/segment, memory vs distributed cache

6) Messaging & streaming ↗

Queues vs logs, delivery semantics, partitioning, and event-driven patterns.

Queues vs logs; at-least-once vs exactly-once semantics
Ordering & partition keys; consumer groups; backpressure
Idempotency keys, dedupe, poison queues, DLQs
Event-driven patterns: async workflows, outbox, CDC
Stream processing vs batch; windowing, watermarking

7) Distributed systems theory (just enough) ↗

Core models and algorithms you’ll reference when explaining trade-offs.

CAP, PACELC; consistency models (strong, eventual, causal)
Consensus & coordination: Raft/Paxos, ZooKeeper/etcd use cases
Leader election; fencing tokens
Clocks & ordering: NTP drift, Lamport clocks, vector clocks
Conflict resolution (last-write-wins, CRDTs, merge strategies)

8) Reliability & resilience ↗

Design for failure: graceful degradation, retries, and disaster recovery.

Health checks, graceful degradation, brownout/bailout modes
Retries with jitter, exponential backoff, circuit breakers, bulkheads
Rate limiting & throttling (token/leaky bucket), quotas
Backpressure in services and streams
Disaster recovery: RTO/RPO, backup/restore, warm vs hot standby
Multi-AZ vs multi-region; active-active vs active-passive

9) Observability & operations (SRE basics) ↗

Measure the right things, roll out safely, and run effective incidents.

Golden signals: latency, traffic, errors, saturation
Metrics (RED/USE), logs, traces; sampling; exemplars
Alerting on SLOs; error budgets
Rollouts: canary, blue/green, feature flags
Incident response, runbooks, postmortems
Capacity planning & autoscaling (HPA, queue depth, custom metrics)

10) APIs & service design ↗

Choose the right interface, keep it compatible, and design for idempotency.

REST vs gRPC vs GraphQL; API gateway patterns
Pagination, filtering, long-polling vs WebSocket/SSE
Versioning strategies; backward compatibility
Idempotent APIs; exactly-once effects vs at-least-once delivery
Multi-tenancy: noisy neighbors, data isolation, quotas

11) Security, privacy, compliance ↗

Bake in auth, encryption, data minimization, and compliance from day one.

AuthN/AuthZ: OAuth2, OIDC, JWT, mTLS, service-to-service auth
Secrets management (KMS, Vault), key rotation
Data encryption in transit/at rest; envelope encryption
PII handling, data minimization, retention & deletion
Abuse prevention: bot protection, WAF, spam/fraud signals
Compliance basics: GDPR/CCPA “right to be forgotten”, PCI areas

12) Compute & runtime ↗

Pick the right execution model and keep resources in check.

Threads vs async I/O; connection pools; N+1 query pitfalls
Containers vs serverless; cold starts, concurrency limits
Scheduling & bin packing (k8s), resource requests/limits
Service discovery, config, and feature flags

13) Advanced patterns ↗

Patterns for complex domains: CQRS, Sagas, search, recsys, geo, media, payments, ML.

CQRS & Event Sourcing; read models & replay
Saga/orchestration vs choreography; workflow engines
Search systems (indexing, inverted indexes, relevancy basics)
Recommendation/news-feed ranking: fan-out vs fan-in
Geo & mapping: H3/Geohash, radius queries, geo-sharding
Media delivery: chunking, ABR (HLS/DASH), CDN, origin shielding
Payments & finops patterns: idempotency, reconciliation, ledgering
Feature stores & real-time ML inference at scale (just enough to speak to)

14) Testing & quality at scale ↗

Prove correctness under change and load; test contracts and data quality.

Unit, integration, contract testing for services
Load & stress tests, chaos experiments, failure injection
Data quality checks (schema, freshness, completeness)
Shadow traffic & replay; synthetic users

15) Cost & efficiency ↗

Design with costs in mind: egress, storage tiers, caching, and $/request.

Egress awareness, storage tiers, compression
Hot/warm/cold data; TTL/archival strategy
Caching to cut cost; reserved vs spot capacity
Measuring $/request and $/tenant