⚡ Interactive Practice Engine: 50 Rapid-Fire Architecture Drills

Execute (x) permission on a directory is required to traverse (enter/cd) into it or look up inodes within it. Read (r) only allows reading the directory contents (ls). Without x, any attempt to cd fails with Permission denied.

Linux Load Average includes processes in both TASK_RUNNING and TASK_UNINTERRUPTIBLE (D state). A high load average with low CPU utilization indicates processes blocked on disk I/O, NFS mounts, or uninterruptible kernel locks.

Default range is 32768–60999 (approx. 28,231 ports). To expand, set net.ipv4.ip_local_port_range = 1024 65535 (approx. 64,511 ports). One host can maintain up to 64,511 simultaneous outbound connections to a single remote IP:Port tuple.

It is an application bug. CLOSE_WAIT means the remote client sent a FIN and the kernel acknowledged it, but the local application process has failed to call close() on the socket file descriptor (socket leak).

tcp_tw_recycle dropped packets from different clients sharing a common NAT Gateway due to desynchronized TCP timestamps. tcp_tw_reuse only applies to outbound client connections where timestamps are locally generated and monotonic.

Default period is 100ms (cpu.cfs_period_us = 100000). Throttling metrics are tracked in /sys/fs/cgroup/cpu/cpu.stat via nr_throttled and throttled_time.

service.internal has 1 dot. Since 1 < 5, glibc sequentially queries all search paths in /etc/resolv.conf (e.g. namespace.svc.cluster.local, svc.cluster.local, cluster.local) before querying service.internal. directly.

ICMP Type 3, Code 4 (Destination Unreachable, Fragmentation Needed and DF Set). Blocking this ICMP packet in firewalls causes PMTUD blackholes.

Linux disables default signal handlers for PID 1. If the application has not explicitly registered a handler for SIGTERM, the kernel discards the signal. Use tini or dumb-init.

Controlled by net.netfilter.nf_conntrack_max. When saturated, the kernel drops incoming packets for new connections, incrementing net.netfilter.nf_conntrack_insert_failed.

• 5 nodes: Quorum is ⌊ 5/2 ⌋ + 1 = 3. It tolerates 2 node failures.
• 6 nodes: Quorum is ⌊ 6/2 ⌋ + 1 = 4. It still tolerates only 2 node failures while increasing network replication latency. Never use even-numbered clusters.

1. Guaranteed: requests == limits for all containers. oom_score_adj = -997.
2. Burstable: requests < limits. oom_score_adj is dynamically calculated between 2 and 999.
3. BestEffort: No requests or limits. oom_score_adj = 1000 (killed first).

EBS volumes are physically constrained to a single Availability Zone. If the replacement node is launched in a different AZ, the volume cannot attach. Fix by setting volumeBindingMode: WaitForFirstConsumer on the StorageClass.

Mutating webhooks execute FIRST (sequentially) so they can modify or inject fields. Validating webhooks execute LAST (in parallel) to verify the final mutated state.

The eviction API rejects the pod eviction to respect minAvailable: 1. kubectl drain blocks indefinitely until the PDB is adjusted or another replica is launched.

Edge-triggered systems react to state transitions and miss updates if an event is dropped. Level-triggered controllers reconcile current state against desired state, ensuring automatic convergence even after crashes or missed network messages.

Cluster Autoscaler scales AWS Auto Scaling Groups (ASGs), waiting for ASG cooldowns and Launch Template evaluations. Karpenter bypasses ASGs and directly invokes the AWS EC2 Fleet API, provisioning custom bin-packed instances in <45s.

• AWS VPC CNI assigns native AWS VPC secondary private IPs to ENIs attached to the EC2 host.
• Cilium uses an overlay or native routing IPAM, utilizing eBPF to route packets directly in the kernel without kube-proxy iptables rules.

The API Server sets metadata.deletionTimestamp but does not delete the object from etcd. It remains in Terminating state until the managing controller completes cleanup and removes its string from metadata.finalizers.

JVM memory management retains allocated heap memory from the OS even after garbage collection. Memory usage rarely drops, causing HPA to scale out to max replicas and never scale down. Autoscale Java on CPU or request rate.

serial is an incrementing integer. Every time Terraform writes a state modification, it increments serial. It acts as an optimistic concurrency lock: if the remote state serial is higher than the runner’s local state, Terraform aborts to prevent overwrite collisions.

They instruct Terraform that a resource address changed (e.g. aws_s3_bucket.a to module.storage.aws_s3_bucket.b) without destroying and re-creating the physical cloud resource.

Asymmetric routing. Outbound packets flow through the firewall in AZ-a, but return packets hash to the firewall in AZ-b. Because Firewall B has no record of the initial TCP SYN, it drops the return packet.

At /var/run/secrets/eks.amazonaws.com/serviceaccount/token. The SDK passes this JWT to STS via AssumeRoleWithWebIdentity.

The two surviving nodes in the non-isolated AZs retain quorum (2/3) and elect a new Raft leader within 300ms. The isolated node enters a follower state and rejects write requests.

Amazon S3 and Amazon DynamoDB. They modify VPC route tables directly and do not incur hourly ENI or data processing fees.

• XRD: Defines the custom API schema and type definition (the OpenAPI specification).
• Composition: Defines the implementation template that maps the XRD to real cloud managed resources (e.g., creating an RDS instance, S3 bucket, and IAM role).

OPA Gatekeeper uses Rego (a declarative query language based on Datalog). Kyverno uses Kubernetes-native YAML.

1. Fulcio: Ephemeral Certificate Authority issuing x509 certs based on OIDC tokens.
2. Rekor: Immutable transparency log for signature proofs.
3. Cosign: Client CLI for signing and verifying OCI container artifacts.

When provisioning account B that depends on outputs from account A before account A has run terragrunt apply, Terragrunt fails validation. mock_outputs injects temporary dummy values to allow terragrunt validate and plan to succeed.

Cardinality is the total number of unique time series produced by multiplying label value sets. Adding user_id, order_id, or client_ip creates millions of unique series, exhausting TSDB memory.

The 1-hour window detects serious 2% budget consumption over 30 days. The 5-minute short window ensures the alert automatically resolves if the outage was a temporary spike that already ended.

• Head sampling decides whether to sample at request entry, dropping 99% of traces before knowing if they will result in an error.
• Tail sampling waits until the trace finishes, ensuring 100% of errors and high-latency traces are retained while sampling successful 200 OK traces at 1%.

When a highly popular cached key expires, thousands of concurrent requests encounter a cache miss simultaneously and hammer the backend database at the exact same millisecond.

It computes a probability of refreshing the cache before the key expires based on the computation time δ and remaining TTL. As TTL decreases, background requests refresh the key before it expires for users.

Each new pod replica initializes its own connection pool (e.g., 50 connections). 200 new pods attempt 10,000 new database connections, exceeding database max_connections and crashing the database engine.

1. Closed: Normal operation; requests pass through.
2. Open: Failure threshold breached; requests fail fast immediately without calling downstream.
3. Half-Open: Tests downstream recovery by allowing a small percentage of trial requests.

traceparent (format: 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01).

Human error is a symptom of systemic failure, not the root cause. Focus on systemic vulnerabilities, missing automated guardrails, and psychological safety rather than individual punishment.

• rate() calculates the per-second average rate over the entire specified time window (smooth, ideal for alerts).
• irate() calculates the rate based on the last two data points in the range (volatile, ideal for zooming into fast micro-spikes on dashboards).

Exactly 2 minutes via EC2 Spot Instance Interruption Notices published to metadata and Amazon EventBridge / SQS.

Graviton (ARM64) instances offer an immediate 20% direct price reduction and up to 20% higher performance per watt, yielding a combined ~40% price-performance gain.

gp3 is 20% cheaper per GB and decouples IOPS and throughput from volume size. With gp2, achieving 3,000 IOPS required provisioning a wasteful 1TB volume; gp3 provides 3,000 IOPS free on any volume size.

Speed-of-light optical latency across 700+ km adds 15–25ms to every synchronous write. Under the CAP Theorem, you cannot achieve both continuous Availability and immediate Consistency during cross-region network partitions.

Users are deterministically partitioned into isolated independent cells (e.g., by customer ID or geography). Each cell owns all primary data for its partitioned users, eliminating cross-region distributed locks.

catalog-info.yaml (defining apiVersion: backstage.io/v1alpha1, kind: Component, type: service, etc.).

Standard transformers allocate contiguous GPU memory for the Key-Value (KV) cache, resulting in 60–80% memory fragmentation. PagedAttention divides the KV cache into non-contiguous virtual memory blocks, unlocking 4x higher throughput.

Tensor Parallelism (TP=4) across GPUs on the same physical node connected via high-speed NVLink. It splits matrix multiplication within each layer, whereas Pipeline Parallelism splits layers across nodes and adds latency.

1. Title & Status (Proposed, Accepted, Superceded).
2. Context (The problem and business drivers).
3. Decision (The chosen architectural change).
4. Consequences (Positive and negative trade-offs).
5. Compliance / Verification (How adherence is monitored).

Feature freezes. Deployment of non-critical product features is halted. 100% of engineering bandwidth is redirected toward reliability hardening, automated test suites, and infrastructure debt until the error budget recovers.