Your circuit breaker opens during normal traffic spikes, causing outages it was meant to prevent. How do you configure it correctly?

What the interviewer is testing

Whether you understand what a circuit breaker is actually for, and can configure it against that purpose.

What it is for

A circuit breaker stops calls to a dependency that is consistently failing, so the caller fails fast instead of waiting on timeouts and exhausting its pools — and so the struggling dependency gets room to recover.

It is not a load management tool. If it opens because the dependency is slow-but-working under load, it is doing the wrong job and causing the outage it exists to prevent.

The configuration that usually fixes this

Trip on error rate, not on absolute counts, with a minimum request volume before the rate is evaluated. Three failures out of five requests is noise; 30% of 200 requests is a signal. A missing minimum volume threshold is the most common cause of spurious tripping.

Evaluate over a rolling window rather than consecutive failures, so a brief blip does not open the circuit.

Set the threshold well above the dependency's normal error rate. If it normally errors at 2%, a threshold at 5% will trip on ordinary variance; 50% is a more defensible line for "this dependency is broken".

Count only the right failures. Connection failures, timeouts and 5xx responses indicate the dependency is unhealthy. A 400 or 404 does not — those are your caller's problem, and including them means bad input trips the circuit for everyone.

Half-open with limited probes, so recovery is tested with a small number of requests rather than by resuming full traffic into a still-fragile dependency.

What must accompany it

A fallback. An open circuit means the call fails immediately — which is useful only if there is something sensible to do: cached data, a default, a degraded response, or a queued retry. A circuit breaker with no fallback converts slow failure into fast failure, which helps the caller's resources and not the user.

What a strong answer adds

Per-instance versus global breaker state. A breaker tracked per caller instance means each must learn the dependency is down independently; shared state trips faster and adds a coordination dependency. Per-instance with a low threshold is usually the pragmatic choice.

Common weak answers

Disabling the breaker. Raising the threshold without adding a minimum volume requirement.