Explain static stability, and give two examples of designs that violate it.

What the interviewer is testing

A conceptual question, testing whether the candidate can state the principle precisely and recognise it in the wild.

The definition

A statically stable system continues operating correctly with the resources it already has when a dependency fails, rather than requiring an action — provisioning, scaling, reconfiguring — to recover.

The reasoning behind it: control planes fail more often than data planes, in every system including every cloud provider's. Control planes are complex, low-volume and stateful; data planes are simple, high-volume and well-exercised. A data plane that depends on its control plane inherits the lower reliability of the two, at exactly the moment the control plane is most stressed.

Violation one: disaster recovery that provisions at failover

A pilot-light plan that creates capacity in the secondary region when failover is triggered depends on the control plane precisely when a regional event is stressing it — and when every other customer is requesting the same instance types simultaneously. Add provisioning time and account quotas sized for the pilot light, and the recovery objective is unachievable.

The statically stable version is warm standby: the target already runs, sized for the load, so failover is a traffic change rather than a build operation.

Violation two: autoscaling as the capacity plan

Autoscaling has a reaction time of minutes and depends on the same control plane. A system with no headroom, relying on scaling to absorb a spike, fails during the spike. The statically stable version carries enough standing capacity to absorb the anticipated ramp, with scaling handling the sustained change rather than the burst.

Other common violations worth naming

Fetching secrets or feature flags per request with no cached fallback. Service discovery that fails closed when the registry is unreachable. Certificate renewal that must succeed for the service to keep running. Anything where the recovery path depends on the thing that is down.

What a strong answer adds

The cost, stated honestly: static stability means running below full utilisation, permanently — roughly two-thirds or less across three availability zones so that losing one does not cause an overload. A cost review will identify that headroom as waste unless the reasoning is written down, so the justification belongs in the design record.

Common weak answers

Describing it as "having redundancy". Omitting the control plane versus data plane distinction, which is the actual content of the idea.