You own the logging platform for a travel company of Expedia's shape. Legal requires that records evidencing a booking and a payment be retrievable for seven years. Engineering wants 30 days of everything, searchable in seconds. Finance has capped the platform's spend. Walk me through the design, and tell me what you would refuse.

What the interviewer is testing

Whether you can tell a retention requirement on records from a retention requirement on logs, and whether you will push back on a requirement that, taken literally, multiplies cost by roughly 85 and creates a privacy liability. The failure here is agreeing to seven years of everything and presenting the bill as inevitable.

The clarifying questions that change the answer

• Is the obligation on the log stream or on the facts? Almost always the facts: evidence that a booking was made and a payment taken. That is a business record, and a debug line that happens to mention a booking id is not the evidence anyone will produce.
• What retrieval latency does legal actually need? Responding to a dispute in days is normal; nobody needs seven-year-old evidence in 200 ms. This single answer moves the data from indexed hot storage to object storage and changes the cost by two orders of magnitude.
• Is there a legal hold? A litigation hold freezes deletion for a defined subset and must override the scheduled purge, which means deletion has to be a targeted operation, not a blanket index lifecycle rule.
• Which jurisdictions conflict? Retention obligations and erasure rights pull in opposite directions for the same record, and the resolution is usually pseudonymisation of the retained copy rather than deletion.

A strong answer's arc

Three systems with three contracts, not one system with one slider.

1. Operational logs. 7 to 30 days, sampled at the noisy end, indexed on a deliberately small field set, deleted on schedule. Optimised for seconds-to-query. This is where the volume is and it is where the cost discipline goes.
2. Business events. A small, schema-versioned, append-only stream of the facts that matter — booking created, payment authorised, refund issued — written to immutable object storage with an integrity manifest and partitioned by date. Typically a fraction of a percent of log volume. Retrieval in hours, retained seven years. This is the system that satisfies legal, and it is cheap because it is small and unindexed.
3. Access and audit logs. Their own retention, set by the control they evidence, and their own access path, because the people who may read them are not the people who read application logs.

Retention class is attached at emission, as a field, by the code that produces the record. It cannot be decided later by an index lifecycle policy, because by then the classes are mixed.

What I would refuse

Applying seven-year retention to the operational log stream. At 100 GB a day, 30 days is about 3 TB of hot indexed storage; seven years of the same stream is roughly 255 TB, and the index rather than the bytes is the expensive part. It also converts every debug line containing a customer identifier into a seven-year privacy obligation that every future erasure request must reach into. The cost is large and the benefit is zero, because nobody will ever query it.

Common weak answers

• "Tier it to cold storage and keep everything." Storage tiering reduces the bytes bill and does nothing about the liability, the erasure surface, or the fact that an unindexed 255 TB of unstructured text is not retrievable evidence in any practical sense.
• "Legal said seven years, so seven years." Legal said seven years about records. Turning that into a platform-wide setting is an engineering decision being disguised as a compliance one.

What a strong answer adds

A retention policy that has never been executed is not a control. Run the deletion on a schedule, alert when it does not complete, and rehearse a legal-hold placement and release the way you would rehearse a restore. The first time you discover that your purge job cannot delete from an index is during an audit, and that is a much worse day than the one where you tested it.