Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
48 results for “Financial Services Regulation”
Operational Resilience Requirement
A supervisory expectation that a firm can continue delivering critical business services through disruption, expressed as an impact tolerance it must evidence.
Zonal vs Regional Services
Whether a cloud resource lives in one availability zone or is inherently spread across several — a property that determines what a zone failure takes with it.
API Gateway
A single entry point in front of a set of services that handles authentication, rate limiting, routing and protocol translation.
Airbnb's Service-Oriented Migration
Airbnb decomposed a large Rails monolith by first extracting a unified data-access layer, so that services were built on owned data rather than on shared database tables.
Backend for Frontend
A separate, narrow backend per client experience, which aggregates and reshapes downstream services for exactly that client's needs.
Best Effort Delivery
The guarantee push notification services actually offer — which is none — and the design consequences of building on a channel that may silently drop.
Cognitive Load
The total amount a team must hold in its head to work effectively, and a real constraint on how many services or domains one team can own.
Contract Testing
Verifying that a provider satisfies the expectations each of its consumers actually relies on, without running all the services together.
Cross-Service Debugging
Investigating a failure that spans multiple services by moving between traces, logs, metrics and profiles along a single correlated request.
Distributed Monolith
A system split into services that must still be developed, tested and deployed together, incurring the costs of distribution without the benefits.
Distributed Trace
A causally-linked record of one request's path across services, composed of spans that carry timing, attributes and parent relationships.
Managed Service Upgrade Window
The period during which a provider may apply patches or version upgrades to a managed service, usually involving a failover or brief unavailability.
Microservices
An architectural style where an application is a set of independently deployable services, each owning its data and aligned to a business capability.
Module Dependency Enforcement
Automated checks that prevent one module from importing another's internals, giving a monolith the boundary discipline of separate services.
Quantified Risk Estimate
Expressing a risk as a probability distribution over financial loss rather than as a colour, which makes risks comparable and mitigations arguable on cost.
RED Method
A minimal per-service dashboard: Rate, Errors, Duration — the request-centric view of whether users are being served.
Saga
A sequence of local transactions across services where each step has a compensating action that semantically undoes it if a later step fails.
Server-Side Request Forgery
Inducing a server to make an HTTP request to an attacker-chosen destination, turning it into a proxy into networks and services the attacker cannot reach directly.
Shared Responsibility Model
The division of duties between provider and customer, which shifts with the service model and is routinely misunderstood in the customer's disfavour.
Tail Latency
The latency experienced by the slowest small percentage of requests, which is what users and dependent services actually feel.
XA Transaction
The X/Open standard interface for two-phase commit across heterogeneous resource managers, still common in enterprise middleware and rarely the right choice for new services.
A platform of 40 services has logs only, and incidents take hours to diagnose. Design the observability strategy and its rollout order.
Why logs alone fail at this size Logs answer "what happened in this service". They cannot answer "where did this request spend its time across twelve services",
A platform team proposes adopting a service mesh for 40 services. Make the case for and against, then decide.
What it genuinely provides mTLS everywhere, with automated certificate rotation. This is usually the deciding factor. Doing mTLS by hand means short lived certi
A team is splitting a monolith into services. How do you decide where the boundaries go?
The criterion is what changes independently Parnas's information hiding is the sharpest formulation: decompose around the decisions most likely to change , not
A team shows you a design with eight services. Without knowing the domain, what questions tell you whether the boundaries are right?
What the interviewer is testing Whether you can evaluate a structure from its properties rather than needing to be a domain expert in every system you review. T
An estate has database passwords in environment variables across 200 services. Design the migration to a secrets manager.
Sequence it by risk, not by convenience Phase 0 — stop the bleeding. Secret scanning in CI and on the existing repositories, blocking new commits containing cre
An order API calls six services synchronously and takes 3 seconds at p95, failing whenever any dependency is degraded. Redesign it.
Diagnose with arithmetic Six synchronous dependencies at 99.9% each give 99.4% — roughly four hours a month, from components that are individually fine. And lat
Design the audit logging for a system handling financial transactions. What is logged, where does it go, and what makes it hold up?
What is logged Significant actions only , defined explicitly rather than logging everything — an audit trail nobody can search is not usable evidence: Authentic
Four services want four different databases: Postgres, MongoDB, Cassandra and Neo4j. What do you say?
The response: make each team justify it against a default Polyglot persistence is legitimate and routinely over applied. The question for each is not "is this d
Integration failures between 30 services are found in a shared staging environment, days after merge. Propose a change.
Why the current model fails A shared staging environment is a serialised, high latency feedback channel . Failures are found late, attribution is ambiguous (who
Leadership asks whether to build an internal developer platform or buy one. Twelve teams, forty services, growing. How do you frame the decision?
Reject the framing as a binary Nobody builds or buys a whole platform. A platform is an assembly: source control, CI, artifact registry, infrastructure provisio
Placing an order must reserve stock, charge the card and create a shipment across three services. Design it, and justify why not a distributed transaction.
First: question the boundary A transaction spanning three services often means one invariant has been split across three owners. Before designing a protocol, ch
Three teams keep breaking each other's services with API changes. Someone proposes contract testing. How do you introduce it without a six-month programme?
Start with one pair, not with the estate Pick the pair of services that has broken each other most recently. Instrument that one relationship end to end: the co
Two services share a database because it was faster to build that way. Both teams now block each other on every schema change. What do you do?
Name the actual coupling They are not two services. They are one deployable unit split across two repositories, with the coupling moved from code — where a comp
You are introducing distributed tracing across 40 services owned by 12 teams. Plan the adoption.
The property that shapes the whole plan Value is non linear in coverage. One service that does not propagate context breaks the trace into fragments, and everyt
You must make a breaking change to an API used by 200 internal services and 40 external partners. Design the change and the migration.
First, verify it must break Many "breaking" changes are avoidable. Adding a field is safe if clients ignore unknown fields — which should be a documented expect
Your services currently trust anything inside the VPC. A security review says move to zero trust. What changes, and what will it cost you?
What the interviewer is testing Whether "zero trust" is a concrete set of changes to you, or a slogan. What actually changes Workload identity. Every service ge
A team wants to self-manage Kafka on Kubernetes to save money against the managed service. Evaluate.
The comparison they have probably made Instance cost versus managed service list price. That comparison usually favours self managing by a wide margin, and it o
Financial Services Regulation
Operational resilience, payment rules and supervisory expectations as design inputs.
Managed Services
Which operational responsibilities actually transfer, and which do not.
Cloud Databases
Managed relational, key-value, document and analytical services.
Contract Testing at Scale
Keeping dozens of services compatible without an environment that runs all of them.
Domain Boundaries
Where the language of the business changes, and services should too.
Orchestration vs Choreography
A coordinator that knows the flow, or services that react to events.
Private Connectivity
Private endpoints, peering and dedicated links to managed services.
Product Thinking
Treating platforms and services as products with users and a lifecycle.
Saga
Local transactions with compensating actions across services.
Service Templates
Scaffolding new services with observability, CI and security already wired in.