A downstream service slows from 50 ms to 3 s. Within two minutes every service in the request path is down, including ones that do not call it. Explain the mechanism.

What the interviewer is testing

Whether you can name the specific amplification mechanism rather than saying "cascading failure".

The mechanism, step by step

1. The slow dependency holds each caller's thread or connection for 3 seconds instead of 50 ms — a sixtyfold increase in occupancy.

2. By Little's Law, in-flight requests equal arrival rate times latency. At constant traffic, the caller's concurrency requirement rises sixtyfold, and its thread or connection pool exhausts within seconds.

3. Once exhausted, the caller cannot serve any request, including ones that never touch the slow dependency — because they share the pool. This is why services that do not call it also fail.

4. Callers time out and retry, multiplying load on a service that is already saturated, so it gets slower, so more callers time out. The loop is self-sustaining.

5. Retries at multiple layers multiply. Three layers each retrying three times is 27 requests for one user action.

The prevention

Bulkheads. Separate connection pools per dependency, so a slow one exhausts only its own allocation. This alone would have prevented step 3, which is where a partial failure became total.

Timeouts derived from measured latency, not defaults. A 30-second default means occupancy rises 600-fold before anything gives up.

Deadline propagation rather than independent per-hop timeouts, so downstream services abandon work whose caller has already given up.

Circuit breakers to break the retry loop, with a fallback so failing fast produces something useful.

Retry budgets capping retries as a fraction of total requests, and retrying at one layer only.

Jitter, so callers that failed together do not retry together.

Load shedding at the struggling dependency, so it returns 429 quickly and prioritises rather than degrading for everyone.

What a strong answer adds

Naming the general principle: most outages are amplification, not failure. A single dependency degrading is normal; the architecture decides whether that stays contained or becomes an estate-wide outage. Every mechanism above exists to break a specific amplification step.

Common weak answers

"Add a circuit breaker" without explaining the pool exhaustion. Blaming the downstream service, which does not explain why unrelated services failed.