A single entry point that routes requests to microservices.

A reverse proxy in front of services. Handles routing, authentication, rate limiting, SSL termination, and request aggregation.

Distributes incoming traffic across multiple servers.

Algorithms: Round Robin, Least Connections, IP Hash, Weighted. L4 (TCP) vs L7 (HTTP). Health checks disable unhealthy nodes.

Restricting the number of requests to protect against overload.

Algorithms: Token Bucket (burst-friendly), Leaky Bucket (constant rate), Sliding Window. Typically implemented at the Gateway or middleware layer.

A pattern that prevents cascading failures.

Three states: CLOSED (normal), OPEN (fail fast), HALF-OPEN (probe). When the error threshold is exceeded, the circuit breaks open.

Storing frequently requested data in a fast storage layer.

Strategies: Cache-Aside, Write-Through, Write-Behind. Invalidation: TTL, event-driven, versioning. Cache stampede is the main danger.

A compact token for passing claims between parties.

Self-contained: header.payload.signature. Enables stateless authentication. Signed with HMAC or RSA. Cannot be revoked before expiry — use short-lived tokens + refresh tokens.

Asynchronous communication via a message queue.

Decouples producer and consumer. Guarantees delivery. Point-to-Point vs Pub/Sub. Dead Letter Queue for unprocessable messages.

Horizontally partitioning data across multiple databases.

Hash-based (consistent hashing), Range-based, Directory-based. Overcomes single-server limits. Challenges: cross-shard queries, rebalancing.

Number of requests per second — a key load metric.

Defines system capacity. 100 RPS — small service, 10K — medium, 100K+ — high-load. Depends on CPU, I/O, and network. Peak RPS is typically 3-5x the average.

Number of unique users per day.

A key business metric. RPS can be estimated from DAU: DAU × actions/user / 86400. Peak factor 2-5x. MAU/DAU ratio indicates engagement (30%+ is good).

A guaranteed level of service availability as a percentage.

99.9% = 8.7 hours downtime/year. 99.99% = 52 min/year. 99.999% = 5 min/year. SLO is the target, SLI is the measurement, SLA is the contract. Error budget = 100% - SLO.

The time from sending a request to receiving a response.

Measured in percentiles: p50 (median), p95, p99. p99 < 100ms is a fast service. Sources: network, serialization, processing, DB queries. Tail latency (p99.9) is often 10x the p50.

The number of operations processed per unit of time.

RPS for APIs, QPS for databases, MB/s for networks. Throughput × Latency = Concurrency (Little's Law). The bottleneck determines the max throughput of the entire system.

A network of servers that caches content closer to the user.

PoPs (Points of Presence) around the world. Push CDN (you upload) vs Pull CDN (caches on first request). Cache invalidation is the main challenge.

Resolves a domain name to an IP address.

Resolution chain: browser cache → OS → recursive resolver → root → TLD → authoritative. TTL controls caching. GeoDNS enables multi-region routing.

TCP — reliable delivery. UDP — fast with no guarantees.

TCP: 3-way handshake, ordering, retransmission, flow control. UDP: connectionless, no guarantees, minimal overhead. TCP for HTTP/DB, UDP for video/gaming/DNS.

Protocol evolution: from text-based to multiplexed.

HTTP/1.1: text-based, one connection = one request. HTTP/2: binary, multiplexing, server push, header compression. HTTP/3: QUIC (UDP-based), 0-RTT, no head-of-line blocking.

REST — text-based JSON/HTTP. gRPC — binary Protobuf/HTTP2.

REST: simple, human-readable, broad support. gRPC: 10x more compact, multiplexing, code-gen, streaming. REST for public APIs, gRPC for internal microservices.

A persistent bidirectional connection between client and server.

Full-duplex after an HTTP upgrade handshake. Low overhead (2-byte frame). Challenges: sticky sessions behind LBs, reconnection logic, scaling via pub/sub.

A distributed system can guarantee only 2 of 3: C, A, P.

Consistency — all reads return the same data. Availability — every request gets a response. Partition tolerance — the system works during network splits. P is mandatory → choose CP or AP.

Transaction guarantees: Atomicity, Consistency, Isolation, Durability.

Atomicity: all or nothing. Consistency: only valid states. Isolation: concurrent transactions don't interfere (levels: Read Committed → Serializable). Durability: persisted after commit (WAL).

Basically Available, Soft state, Eventually consistent.

An alternative to ACID for distributed systems. Prioritizes availability over consistency. Data eventually converges. Suitable for social feeds, analytics, caching.

SQL — strict schema + ACID. NoSQL — flexible schema + horizontal scaling.

SQL: relational, joins, transactions. NoSQL types: Document (MongoDB), Key-Value (Redis), Wide-Column (Cassandra), Graph (Neo4j). Polyglot persistence — use both.

Copying data across multiple database servers.

Master-Slave: writes go to master, reads from replicas. Master-Master: writes to any node (requires conflict resolution). Sync vs Async: consistency vs latency trade-off.

A data structure that speeds up lookups in a table.

B-tree: O(log N) search (default). Hash: O(1) equality. Composite: (a,b) for multi-column WHERE. Trade-off: faster reads, slower writes + extra disk space.

Maps keys onto a ring — adding or removing servers moves minimal data.

Regular hash%N remaps everything when a server is added. Consistent hashing: key → nearest server on the ring. Virtual nodes improve uniformity. Used in distributed caches and sharding.

Storing all events instead of current state.

An append-only log of events. State = replay of all events. Provides a full audit trail and temporal queries. Snapshots for optimization. Challenges: eventual consistency, storage growth.

Separating read and write models.

Command (write) and Query (read) use different models and often different databases. Write: normalized. Read: denormalized (materialized views). Synchronized via events.

A distributed transaction via a chain of local transactions + compensations.

Each service performs a local transaction and emits an event. On failure — compensating transactions roll back. Choreography (events) vs Orchestration (coordinator). Idempotency is required.

Repeated calls with the same parameters produce the same result.

GET, PUT, DELETE are idempotent. POST is not. Implementation: idempotency key in the header, server-side deduplication. Critical for retry logic and payment systems.

Data will become consistent after some period of time.

Not instant synchronization, but convergence is guaranteed. Suitable for read-heavy, globally distributed systems. Challenges: stale reads, conflict resolution (last-write-wins, vector clocks).

Scaling by adding more servers (scale out).

Requires stateless services. Shared-nothing architecture. Auto-scaling by CPU/memory/queue depth. Practically unlimited, but harder for stateful components.

Scaling by increasing the power of a single server (scale up).

More CPU/RAM/SSD. Simple, requires no code changes. But: physical limits, SPOF, expensive at the top tier. Usually for databases where sharding is complex.

An architecture of independent services communicating via APIs.

Each service has its own codebase, database, and deployment. Pros: independent scaling, tech diversity, team autonomy. Cons: network complexity, distributed transactions, observability.

A single application with a shared codebase and database.

Everything in one deployable unit. Pros: simplicity, no network overhead, ACID transactions. Cons: must scale everything together, long deploy cycles, tight coupling. Modular monolith is a compromise.

An infrastructure layer for managing service-to-service communication.

A sidecar proxy alongside each service. Provides: mTLS, retries, circuit breaking, observability, traffic splitting. Data plane (proxies) + Control plane (config).

An intermediary server in front of the backend that hides it from clients.

Functions: SSL termination, caching, compression, load balancing, security (WAF). A forward proxy acts on behalf of clients; a reverse proxy acts on behalf of servers.

An authorization protocol for delegated access.

Flows: Authorization Code (+PKCE for SPAs), Client Credentials (M2M), Device Code. Roles: Resource Owner, Client, Authorization Server, Resource Server. Implicit flow is deprecated.

A rate limiting algorithm that supports bursts.

The bucket fills with tokens at a constant rate. Each request takes a token. If empty — reject. Burst capacity = bucket size. The most popular algorithm (AWS, Stripe, Cloudflare).

Loading data only when it is actually needed.

Don't load everything upfront — fetch on demand. In databases: lazy-fetch related entities. In UI: code splitting, dynamic import. In caching: Cache-Aside = lazy loading.

A queue for messages that could not be processed.

After N retries, the message goes to the DLQ. Monitoring the DLQ is critical (alert!). Reprocess after fixing. Without a DLQ, a poison message blocks the partition.

A mechanism to slow down the producer when the consumer is overloaded.

If the consumer can't keep up, the producer must slow down — otherwise OOM or data loss. Implementation: bounded queues, rate limiting, reactive streams (Flux/Mono).

A probabilistic data structure: 'definitely no' or 'possibly yes'.

A bit array + multiple hash functions. False positives are possible, false negatives are not. Saves memory vs a HashSet. Used to check existence before an expensive operation.

Choosing a single leader node for coordination in a distributed system.

Algorithms: Raft, Paxos, ZAB (ZooKeeper). The leader accepts writes; followers replicate. On leader failure — re-election. Split-brain is the main danger.

Locking a resource across a distributed system.

One process holds the lock. SETNX + TTL in Redis (Redlock for multi-node). Problems: TTL too short (lock expires prematurely), network partition (split-brain). Fencing tokens for safety.