Skip to content

C. Design quiz

Read the examples first.

A team is about to build a job scheduler with a registry, a queue and two controllers. Which of the following items belong in the analysis it does before building?

Select all that apply.

Show answer
  • Correct: How each part, such as the registry, can fail.. Right. P22 asks for a list of how each part can fail before you build.
  • Correct: How the two controllers can fight over the same job while neither has failed.. Right. P22 covers unsafe interactions between parts that have not failed.
  • Correct: How the scheduler can harm users through foreseeable misuse while it works as designed.. Right. P22 includes harm that a system causes while working as designed.
  • Incorrect: Which components have a health endpoint that tests can read.. That is test access, which belongs to P26. It does not list failures or interactions.
  • Incorrect: How long the queue can run before memory leaks make it fail.. That is accumulated degradation, which P28 covers with a soak test. P22 asks for a list of failure modes before the build.
A reviewer checks whether a design meets the check of P22. Which of the following findings show that it does?

Select all that apply.

Show answer
  • Correct: A reviewed list of failure modes and unsafe interactions exists for each component.. Right. This is the check of P22, a list per component that is reviewed.
  • Incorrect: A peak load test passed on the finished system.. A peak test does not list failure modes or interactions. Short peak tests are also what P28 warns against when used alone.
  • Incorrect: The first failure analysis was written after an incident.. This is the violation named in P22. The analysis has to come before the build.
  • Incorrect: Each component passed its own unit tests in isolation.. Isolated tests do not show how parts that have not failed interact unsafely, which P22 requires.
A platform team packages ten applications. Which of the following choices follow P23?

Select all that apply.

Show answer
  • Correct: Give each application its own Helm chart with one stated purpose.. Right. P23 asks for modules, and each component has one stated purpose.
  • Correct: Remove a chart option that no application uses.. Right. The check of P23 says that no part is unused.
  • Incorrect: Put all ten applications in one chart so that there is only one thing to maintain.. One chart for all is the opposite of splitting into modules, which P23 asks for.
  • Incorrect: Add options now for needs that the team imagines for next year.. P23 names adding features for imagined future needs as its violation.
A product team wants to apply the management form of P23, simple structures and few priorities. Which of the following actions fit?

Select all that apply.

Show answer
  • Correct: Keep one team backlog with one ranked list.. Right. P23 in management uses the fewest priorities that meet the objective.
  • Correct: Stop a recurring meeting that no longer serves the objective.. Right. The management form of P23 says to stop work that is not needed.
  • Incorrect: Keep a separate priority list for each stakeholder group.. Parallel priority lists add priorities. P23 uses the fewest that meet the objective.
  • Incorrect: Add a second approval layer in case of future needs.. An extra layer for imagined needs is the violation of P23. It uses the fewest layers instead.
  • Incorrect: Give the same task to two owners so that one can cover for the other.. One accountable owner is the topic of P30, and it does not make a structure simpler.
A team writes the design document for a new Kubernetes cluster that holds customer data. Which of the following parts of the document satisfy the check of P24?

Select all that apply.

Show answer
  • Correct: A maintenance section.. Right. P24 checks that each design document has a maintenance section.
  • Correct: A decommissioning section that says how to delete the cluster and its data.. Right. P24 asks to define the deletion before you create the cluster.
  • Incorrect: A note that the end-of-life plan will be written when the cluster is retired.. P24 says to plan decommissioning at design time. Later leads to orphaned resources.
  • Incorrect: A list of the readiness endpoints of each component.. Test access is P26. It does not cover maintenance or decommissioning.
A company signs a contract with a hosting vendor. Which of the following clause sets follow the management form of P24, plan the exit at the start?

Select all that apply.

Show answer
  • Correct: An exit clause and a clause that returns the company's data.. Right. P24 asks to plan how a contract ends, with an exit and handover.
  • Correct: A deletion date for the personal data collected under the contract.. Right. P24 plans deletion at the start. Personal data has a limit on how long it is kept.
  • Incorrect: A price schedule for the first three years.. Prices do not say how the contract ends, which P24 asks for.
  • Incorrect: A promise to negotiate the exit terms when the company decides to leave.. P24 plans the exit when the contract starts, not when it ends.
A team writes a failover runbook for on-call engineers. Which of the following steps follow P25?

Select all that apply.

Show answer
  • Correct: Test the runbook with real on-call engineers at night.. Right. P25 checks that critical tasks are tested with real operators, in the real environment.
  • Correct: Make the CLI output for success and failure unambiguous.. Right. P25 asks for a design that works under stress, such as clear CLI output.
  • Incorrect: Test it only with the author, who knows the system best.. P25 asks for real users and the full range of users, not the one who wrote it.
  • Incorrect: Add a line to the review that engineers who misread the output must be more careful.. Blaming users for errors that the interface invites is the violation named in P25.
An engineer ran the wrong command during an incident, because two commands differ by one letter and print similar output. Which of the following responses follow P25?

Select all that apply.

Show answer
  • Correct: Rename the commands so that they differ clearly, and test the change with operators under time pressure.. Right. P25 changes the interface for the real user and tests critical tasks with real operators.
  • Correct: Add a dry-run mode that shows what a command would do.. Right. A dry run (P26 test access) also helps people avoid the error, and it supports P25.
  • Incorrect: Write in the review that the engineer must read output more carefully.. This blames the user for an error that the interface invites, the violation of P25.
  • Incorrect: Add a slide about the commands to the next training day.. Training does not remove the error the interface invites. P25 asks for the design to change.
A manager applies the management form of P25, work designed for real people, to a new team of eight. Which of the following states show it?

Select all that apply.

Show answer
  • Correct: Each member can name their role and the team's current goal.. Right. P25 in management asks for clear roles, plans and goals.
  • Correct: The workload is one that people can carry.. Right. P25 asks for a workload people can carry.
  • Incorrect: Roles change weekly, and slips are traced to the people who made them.. Unclear roles and blaming people for errors the setup invites is the violation of P25.
  • Incorrect: The team designs its work for an average team, and ignores the people who differ.. P25 designs for the full range of people, not an average person.
A team builds a payment service. Which of the following designs satisfy the check of P26?

Select all that apply.

Show answer
  • Correct: Each component documents how to set and observe its key states.. Right. This is the check of P26.
  • Correct: A component has a readiness endpoint and a dry-run mode.. Right. P26 names health and readiness endpoints and dry-run modes as test access.
  • Incorrect: A component can only be tested with live customers.. A component that can only be tested in production is the violation of P26.
  • Incorrect: The service passes a load test but has no way to read its internal state.. P26 needs the internal state to be observable and settable, which a load test alone does not give.
  • Incorrect: An extra replica of each component, so that one can fail.. Extra replicas are redundancy, not test access, which is what P26 asks for.
An audit team wants the management form of P26, auditable processes, for access approvals. Which of the following choices fit?

Select all that apply.

Show answer
  • Correct: Store each approval as a ticket that an auditor can sample.. Right. P26 in management makes controls leave evidence that a reviewer can sample.
  • Incorrect: Give approvals by phone, and trust the approver to remember them.. No record is left, so a reviewer cannot sample the control, which P26 requires.
  • Incorrect: Approve requests by chat, with no link to the ticket system.. Chat approvals leave no sampled evidence, which P26 requires.
  • Incorrect: Delete tickets after a month to keep the system small.. Deleting the evidence removes what a reviewer would sample, against P26.
A service retries failed calls to a partner API, and message order and latency vary. Which of the following choices follow P27?

Select all that apply.

Show answer
  • Correct: Retry with jitter.. Right. P27 names retries with jitter as a way to tolerate variation.
  • Correct: Make operations idempotent.. Right. P27 names idempotent operations, so repeated calls do not change the result.
  • Correct: Run tests with varied latency, clock drift and message order.. Right. This is the check of P27, tests with varied inputs show stable results.
  • Incorrect: Assume that messages always arrive in order and on time.. A system that works only when timing is exact is the violation of P27.
A service receives messages with fields in different forms. A teammate says it should accept anything and guess the meaning. Which of the following statements are correct?

Select all that apply.

Show answer
  • Correct: P27 asks for stable results when inputs vary in ways like latency and order.. Right. P27 tolerates variation within the specification, such as timing, order or any format the schema allows. Malformed data lies outside it.
  • Correct: P33 asks the service to reject and log input that violates the specification.. Right. P33 rejects and reports invalid input instead of silently accepting it.
  • Incorrect: Guessing the meaning of malformed fields is robustness under P27.. K3 draws the line between the two rules. P27 tolerates variation within the specification, and P33 rejects and reports input outside it. Guessing at malformed fields is the silent acceptance that P33 rules out.
  • Incorrect: P33 allows silent acceptance of unknown fields if the sender is a trusted team.. P33 says to reject and report violations instead of silently accepting them.
A team applies the management form of P27, robust plans, to its yearly roadmap. Which of the following results show it?

Select all that apply.

Show answer
  • Correct: The roadmap still delivers its top objective if one engineer leaves.. Right. P27 in management makes plans that work when assumptions vary within a credible range.
  • Incorrect: The plan holds only if every estimate is exact and nobody leaves.. A plan that needs exact assumptions is fragile, the opposite of P27.
  • Incorrect: The plan has a long list of tasks and no spare room.. This gives no tolerance for variation, which P27 asks for.
  • Incorrect: The plan is rewritten after every change in staffing, and each rewrite resets the schedule.. Rewriting after each change is not robustness. P27 asks for a plan that works across a credible range.
A team prepares a message broker for production. Which of the following checks follow P28?

Select all that apply.

Show answer
  • Correct: An endurance test runs for several days at a realistic load.. Right. P28 checks for an endurance (soak) test that represents real use.
  • Correct: The team measures the growth of leaks, wear and fragmentation during the test.. Right. P28 needs the growth to be measured, not only whether the test passes.
  • Incorrect: A one-hour peak test at the maximum load.. A short peak test alone is the violation of P28. It misses damage that builds up.
  • Incorrect: A failure list for each component, written before the build.. That is P22. It is useful, but it does not test accumulated damage over time.
An operations team applies the management form of P28, sustainable pace. Which of the following actions fit?

Select all that apply.

Show answer
  • Correct: Review on-call load and overtime every month.. Right. P28 limits sustained overtime and tracks what builds up.
  • Correct: Track technical debt and deferred maintenance.. Right. P28 names debt that builds up slowly, such as technical debt and deferred maintenance.
  • Incorrect: Accept 60-hour weeks as a pattern, since each week is survivable.. Repeated loads below the maximum cause damage that does not recover. P28 limits sustained overtime.
  • Incorrect: Plan only for the busiest single week of the year.. P28 asks to design for damage over the whole design life, not only the largest load.
A platform team will upgrade the CNI plugin of a cluster. Which of the following practices follow P29?

Select all that apply.

Show answer
  • Correct: Keep a tested compatibility matrix of Kubernetes, CNI and CSI versions.. Right. P29 checks that each interacting pair is on a tested compatibility list.
  • Correct: Test the upgrade with the storage driver in the real environment.. Right. P29 verifies compatibility in the real environment.
  • Incorrect: Upgrade the plugin alone, since it passed its own tests.. P29 names this as the violation. A good part can still break another that was never tested with it.
  • Incorrect: Put the plugin in one chart with the storage driver to reduce the number of parts to manage.. Packaging the two together does not test whether they work together, which P29 asks for. It also goes against the modules of P23.
Two platform teams will merge. Which of the following steps follow the management form of P29?

Select all that apply.

Show answer
  • Correct: Compare the on-call rules and release processes of both teams before the merge.. Right. P29 checks that teams and processes are compatible, and plans the integration.
  • Incorrect: Merge on a fixed date and sort out the differences later.. P29 checks compatibility before merging, not after.
  • Incorrect: Keep both release processes, and have both teams apply them to the same service.. P29 asks to plan how the differences are integrated. Leaving both processes in force on one service skips that plan, and the two processes then fight over the same releases, much like two owners of one property under P30.
  • Incorrect: Choose the larger team's culture for everyone without comparison.. P29 asks for a comparison and an integration plan, not a decision with no check.
A deployment is managed by a GitOps tool, and a horizontal autoscaler is enabled. Which of the following setups follow P30?

Select all that apply.

Show answer
  • Correct: The autoscaler owns the replica count, and the manifest leaves the field out.. Right. P30 gives each managed field exactly one owner.
  • Incorrect: The GitOps tool and the autoscaler both set the replica count.. Two mechanisms on one property is the violation of P30. They keep reverting each other.
  • Incorrect: A second GitOps tool is added as a backup to set the count.. A second owner for the property breaks the rule of exactly one owner in P30.
  • Incorrect: Redundant copies of the manifest are kept in two repositories.. P30 asks for one source of truth per configuration value.
One backlog gets orders from two managers who disagree. Which of the following actions follow P30 in management?

Select all that apply.

Show answer
  • Correct: Name one product owner for the backlog.. Right. P30 gives each objective one accountable owner.
  • Correct: Make sure each person reports to one person for a given task.. Right. P30 in management is unity of command.
  • Incorrect: Let both managers keep setting priorities and ask the team to balance them.. Two owners for one property over-constrain the team, against P30.
  • Incorrect: Give the component to four teams so that all managers are represented.. P35 wants one owning team for each component boundary, and P30 one accountable owner per objective. Four owning teams do the opposite.
A team must pick autoscaler settings, and no model predicts good values. Which of the following approaches follow P31?

Select all that apply.

Show answer
  • Correct: Generate several variants and test each one under load.. Right. P31 generates many variants and tests them.
  • Correct: Record which variants each round kept, and repeat the round.. Right. P31 checks that each round has a defined test and records the variants kept.
  • Incorrect: Choose the settings by opinion in a meeting.. Choosing by opinion when it could be tested is the violation of P31.
  • Incorrect: Use one set of defaults for years and never test others.. P31 keeps the best of tested variants and repeats the cycle.
A portal team cannot predict which onboarding flow works best. Which of the following choices follow the management form of P31?

Select all that apply.

Show answer
  • Correct: A/B-test two flows with real users and keep the better one.. Right. P31 tests variants with real users and keeps the best.
  • Incorrect: Pick the flow that the most senior person likes.. Choosing by opinion when it could be tested is the violation of P31.
  • Incorrect: Roll out one flow to everyone and stop.. P31 repeats the cycle of variants and tests, not one choice.
  • Incorrect: Measure only the team's own ticket times.. Ticket times say little about the customer outcome. P32 covers end-to-end ownership of that outcome.
Two services exchange backup files, and the integrity of the data matters. Which of the following choices follow P32?

Select all that apply.

Show answer
  • Correct: Verify a checksum of each backup in the application.. Right. P32 puts the check at the end points.
  • Correct: Authenticate the services to each other with mTLS.. Right. P32 gives mTLS as an example of an end-to-end check, not only network encryption.
  • Incorrect: Rely on the network layer to deliver the data correctly.. Trusting the network without an application check is the violation of P32.
  • Incorrect: Add a second network path in place of the application checksum.. A lower layer can improve performance, but it cannot guarantee the function, which P32 says. A second path is also redundancy (P45), not an integrity check.
A platform team supports product teams. Which of the following measures follow the management form of P32?

Select all that apply.

Show answer
  • Correct: Time-to-first-deploy for a product team.. Right. P32 lets the unit closest to the customer verify the outcome.
  • Incorrect: Closure rate of the platform team's own tickets only.. This is a local result. P32 does not trust each department's local result alone.
  • Incorrect: Number of features the platform team shipped.. Output does not show that the product team's outcome is reached, which P32 checks.
  • Incorrect: Average response time of the ticket queue only.. This is another local measure. P32 checks the customer outcome end to end.
A service receives JSON messages from other teams. Which of the following practices follow P33?

Select all that apply.

Show answer
  • Correct: Every interface has a machine-checked schema in CI.. Right. This is the check of P33.
  • Correct: Invalid input is rejected and logged.. Right. P33 rejects and reports input that violates the specification.
  • Correct: Field names carry units, such as latency_ms, and timestamps are UTC with offset.. Right. P33 asks for units and time zone to be stated explicitly.
  • Incorrect: Unknown fields are silently ignored to keep senders working.. Silently ignoring defects is the violation of P33, since they become unofficial standards.
A sender adds a duration field without a unit. Some receivers read seconds, and others read milliseconds. Which of the following fixes follow P33?

Select all that apply.

Show answer
  • Correct: Rename the field to carry the unit, such as duration_ms.. Right. P33 asks to state units explicitly in every interface.
  • Correct: Reject messages that do not match the schema, and log them.. Right. P33 requires rejection and reporting of invalid input.
  • Incorrect: Let each receiver guess the unit from the size of the value.. Guessing is silent tolerance of an unstated unit. P33 asks to state the unit and to reject what does not match. P27 tolerates variation only within the specification (K3).
  • Incorrect: Make receivers retry with jitter until the value looks right.. Retries with jitter are P27 and help with timing variation. They do not remove an unstated unit.
A shared service team applies the management form of P33, explicit agreements between units. A request arrives without a cost centre. What should the team do?

Select all that apply.

Show answer
  • Correct: Return the request and point to the definition of ready.. Right. P33 returns incomplete handovers instead of silently fixing them.
  • Incorrect: Guess the cost centre from the requester's department.. Guessing is the silent fix that P33 rules out. Over time it becomes the unofficial standard.
  • Incorrect: Accept it and fix the gap quietly for this requester.. Silent fixes teach senders that incomplete requests are fine, against P33.
  • Incorrect: Hold it until the requester chases it.. P33 returns the request with the reason, and does not leave it unreported.
A team tested a storage design on 3 nodes and will run it on 300. Which of the following steps follow P34?

Select all that apply.

Show answer
  • Correct: Estimate the failure rate per component and multiply it by the planned scale.. Right. This is the check of P34.
  • Correct: Test at the target scale, or as close as possible.. Right. P34 designs and tests for the target scale.
  • Incorrect: Assume that a failure never seen in the 3-node test will not happen at 300 nodes.. This is the violation of P34. A rare failure becomes frequent in a larger system.
  • Incorrect: Treat a 3-node test as proof that the model is valid at any scale.. P12 asks to use a model only inside the range it was validated for, and P34 says scale changes failure frequency.
A company grows from 50 to 500 people. Which of the following expectations follow the management form of P34?

Select all that apply.

Show answer
  • Correct: Rare events, such as fraud or loss of a key person, happen regularly.. Right. P34 expects rare events to become frequent as the organization grows.
  • Correct: Controls need to scale with size.. Right. P34 scales controls with size.
  • Incorrect: The controls of a 50-person firm are enough.. P34 expects more events at size, so controls that fit 50 people can miss them.
  • Incorrect: A once-in-500-person-years event is still unlikely to occur in any given year.. At 500 people, that event happens about every year, as the example of P34 shows.
A company wants a system of several components, and it has several teams. Which of the following actions follow P35?

Select all that apply.

Show answer
  • Correct: Give each major component boundary one owning team.. Right. This is the check of P35.
  • Correct: Count cross-team dependencies.. Right. P35 checks that cross-team dependencies are counted.
  • Correct: Change the team boundaries when the intended component structure changes.. Right. P35 changes teams and communication paths when the intended structure changes.
  • Incorrect: Have four teams maintain one component, but without regular contact.. This is the violation of P35. The design copies the communication gaps of the teams.
  • Incorrect: Give each team a different tool so that nobody depends on another team.. P35 matches team boundaries to the intended components. Different tools do not do this, and can hurt compatibility (P29).
A platform team owns the platform API, and product teams own their own code. A product team also edits part of the platform API. Which of the following statements are correct?

Select all that apply.

Show answer
  • Correct: P35 puts the platform API with the platform team, as one owning team for the boundary.. Right. P35 gives each major component boundary one owning team.
  • Correct: P30 gives the shared property one owner instead of two.. Right. P30 applies the same idea of one owner to what two parties can set.
  • Incorrect: Both teams should edit the API, so that the design follows the people.. P35 shapes teams to the intended structure, not the other way round. Two editors also break P30.
  • Incorrect: P35 is not needed, because Conway's law applies only to teams of one person.. The counterexample of P35 is a system built by one person or one small team that communicates as one unit. Several teams are in scope.