Skip to content

E. Capacity and continuity quiz

Read the examples first.

A team sizes a worker pool for the average load of 500 jobs per second. Peak days reach 900 jobs per second. Which of the following changes follow the margin rule?

Select all that apply.

Show answer
  • Correct: State the design load as a probability per period, such as the 1-in-100-day peak, and size above it.. Right. P44 asks for the design load as a probability per time period, with capacity above it.
  • Correct: Keep the average utilization of the pool well below 100 %, for example under 70 %.. Right. P44 keeps queued resources well below 100 % utilization because delay rises sharply near it.
  • Incorrect: Size the pool exactly to the average, so that no capacity sits idle.. Wrong. Sizing exactly to the average load is the violation named in P44. Real load exceeds the estimate.
  • Incorrect: Run a second pool at a different provider, and keep both sized to the average.. Wrong. Different providers are diversity (P46), which protects against a common cause. It adds no margin to the load (P44).
  • Incorrect: Skip the load test, because the margin is already stated in the design.. Wrong. The P44 check is a load test that shows capacity at or above the design load times the chosen factor.
A service has 30 % headroom on paper and runs in three availability zones. Which of the following pieces of evidence show that the margin rule is met?

Select all that apply.

Show answer
  • Incorrect: Last week's average CPU use was 40 %.. Wrong. An average does not show capacity at the design load. P44 needs a load test at that load.
  • Incorrect: The service survives the removal of any one node in a test.. Wrong. That test shows N-1 redundancy (P45). It does not show capacity above the design load (P44).
  • Correct: A load test at the stated design load times the factor, with queue delay within its target.. Right. This is the P44 check, capacity at or above the design load times the chosen factor, with queue delay within target.
  • Incorrect: The design document says that headroom is 30 %.. Wrong. A stated figure is not a measurement. P44 requires a load test to confirm it.
A team lead plans each person at 100 % for the sprint, although the team also handles unplanned support requests. Every sprint misses its goal. Which of the following changes follow the rules?

Select all that apply.

Show answer
  • Correct: Plan about 70 % of capacity and keep the rest free for unplanned work.. Right. The management form of P44 keeps free capacity and does not plan people near 100 % utilization.
  • Incorrect: Start more work items in parallel, so that nobody waits for work.. Wrong. More parallel work lengthens lead time for every item (P52), and it removes slack (P44).
  • Correct: Set a visible limit on items in progress, and finish items before starting new ones.. Right. P52 limits work in progress. It shortens lead time and fits with keeping slack under P44.
  • Incorrect: Keep planning at 100 %, but add a stretch goal to each sprint.. Wrong. A stretch goal adds load. P44 says to keep slack and not to plan near 100 %.
A critical service must survive the loss of any single node. Which of the following designs meet the redundancy rule?

Select all that apply.

Show answer
  • Correct: Three replicas in three zones behind a tested load balancer with health checks.. Right. P45 needs copies and a reliable switch-over mechanism, so that the loss of one element does not stop the function.
  • Incorrect: One large replica with a very high hardware specification.. Wrong. A single replica is the P45 violation. Better hardware does not remove the single point of failure.
  • Incorrect: Two replicas, with a failover script that nobody has ever run.. Wrong. P45 requires that each copy and the switch-over mechanism are reliable enough for the redundancy to help.
  • Correct: Two replicas on separate nodes, with a switch-over that is tested in practice.. Right. Two copies and a tested switch-over keep the function running after one loss (P45). P46 may add further diversity.
A team wants to prove that its service meets the N-1 rule. Which of the following tests do that?

Select all that apply.

Show answer
  • Correct: Remove each node in turn in a test and check that requests keep succeeding.. Right. The P45 check is that removing any single element in a test keeps the function running.
  • Incorrect: Count the replicas in the deployment file.. Wrong. The count shows copies exist. P45 asks for a test that the function survives the loss of an element.
  • Correct: Remove the load balancer in a test and check that requests keep succeeding.. Right. The switch-over mechanism is an element too. P45 says any single element, so it must be tested as well.
  • Incorrect: Raise the load to twice the design load and check the response times.. Wrong. That is a margin test (P44). It does not test the loss of a single element.
Three replicas of a login service run in different zones, but all use one TLS certificate that expires next week. What does the diversity rule say?

Select all that apply.

Show answer
  • Correct: The replicas share a dependency that can hit all copies at once, so the copies should differ there.. Right. P46 applies when one cause can hit all copies at once. A shared certificate is such a cause.
  • Incorrect: Three replicas already meet the redundancy rule, so no further change is needed.. Wrong. Identical copies fail together. P45 needs reliable copies, and P46 deals with the shared cause.
  • Incorrect: Add a fourth replica that uses the same certificate.. Wrong. Another identical copy fails with the others (P46). More copies do not help against a common cause.
  • Correct: List the shared dependencies and justify each one that stays.. Right. The P46 check is a list of shared dependencies of redundant copies, with each one justified.
  • Incorrect: Move all replicas into one zone to simplify the certificate.. Wrong. That adds a shared dependency and removes zone redundancy (P45, P46).
An engineer reviews a design with two DNS providers, two regions and one shared container base image. Which of the following statements fit the diversity rule?

Select all that apply.

Show answer
  • Correct: The base image is a shared dependency, so it must be listed.. Right. P46 lists the shared dependencies of redundant copies.
  • Incorrect: Having two providers means no shared dependency needs a justification.. Wrong. Diverse DNS and regions do not cover the shared image. Each shared dependency that remains needs a justification (P46).
  • Correct: The shared image stays only if the team justifies it.. Right. P46 allows a shared dependency if it is justified.
  • Correct: The two DNS providers are an example of diversity.. Right. Different providers for the same function are the P46 example for DNS.
A shop expects demand to exceed capacity during a sale. Which of the following plans follow the degradation rule?

Select all that apply.

Show answer
  • Correct: Switch off recommendations first and keep checkout running for as long as possible.. Right. P47 defines in advance which lower-priority functions switch off first, so that critical functions keep running.
  • Incorrect: Let every function slow down evenly, so that nobody is treated unfairly.. Wrong. All functions slowing together until everything fails is the P47 violation.
  • Correct: Add rate limiting for low-priority endpoints.. Right. Rate limiting is a P47 example of limiting low-priority load.
  • Incorrect: Raise the margin, and assume demand never exceeds it.. Wrong. Margin (P44) helps, but P47 applies exactly when demand can exceed capacity.
A team writes a plan for an overload test. Which of the following results show that the degradation rule is met?

Select all that apply.

Show answer
  • Incorrect: Response times grow for all functions evenly, and none fails.. Wrong. Even slowing is the P47 violation pattern. The check is that low-priority functions stop first.
  • Correct: Low-priority functions stop first, and critical functions keep running.. Right. This is the P47 check, shown in an overload test.
  • Incorrect: Critical functions stop first, so that the cause is easy to see.. Wrong. P47 keeps critical functions running. They switch off last.
  • Incorrect: All functions stop together and restart after a minute.. Wrong. A full stop is the cascading failure that P47 is meant to prevent.
An autoscaler scales up above 60 % CPU and down below 60 % CPU. It adds and removes workers every minute. Which of the following fixes follow the damping rule?

Select all that apply.

Show answer
  • Correct: Add a cooldown of several minutes between scaling actions.. Right. P48 adds a delay or cooldown so that the loop does not switch back and forth.
  • Correct: Add a deadband, for example up above 75 % and down below 45 %.. Right. A deadband is a P48 remedy for oscillation.
  • Incorrect: Shorten the measurement interval, so that it reacts faster.. Wrong. Faster reaction increases the switching. P48 asks for damping.
  • Incorrect: Give every downstream stage the end demand signal.. Wrong. That is P51. It reduces amplification along a chain, but this loop's problem is missing damping (P48).
A team reviews the control loops in its platform. Which of the following findings meet the damping check?

Select all that apply.

Show answer
  • Correct: Each automatic loop has a documented deadband, delay or cooldown.. Right. This is the first part of the P48 check.
  • Correct: A test with noisy input shows no repeated switching.. Right. The P48 check includes a test that shows no repeated switching.
  • Incorrect: The loops react as fast as possible to every measurement.. Wrong. Reacting to every measurement without damping causes oscillation (P48).
  • Incorrect: Loops that change state on every measurement are accepted, if they scale back the same minute.. Wrong. Repeated on-off cycles waste resources and destabilize the system (P48).
  • Incorrect: An autoscaler that scales up and down every minute is reported as a finding.. Wrong. This finding shows the P48 violation, so the check is not met. The review is right to flag it.
A CI cluster is congested. The team doubles its size, and it is full again a month later. What should the team have done?

Select all that apply.

Show answer
  • Correct: Forecast that demand grows into the new capacity before the increase.. Right. P49 expects demand to grow into new capacity, and the check requires a forecast.
  • Correct: Add a quota per team or a priority scheme with the capacity.. Right. P49 also manages demand, with quotas, priorities or pricing.
  • Incorrect: Double the cluster again, because the margin was too small.. Wrong. Margin (P44) does not fix induced demand. P49 says more capacity lowers the cost of use and use grows.
  • Incorrect: Conclude that the first doubling was not enough and stop measuring the demand.. Wrong. Without a forecast and a demand control, P49 predicts the same result again.
  • Correct: Charge teams for runner minutes.. Right. Pricing is one of the demand controls named in P49.
A department receives a larger budget for a late project, with the instruction to do more of the same. Which of the following responses follow the rule on added capacity?

Select all that apply.

Show answer
  • Incorrect: Spend the budget as work comes up, and review at the end.. Wrong. Work and spending expand to fill the budget. This is Parkinson's law, the management form of P49.
  • Correct: Agree an explicit scope and end date with the budget.. Right. The management form of P49 manages demand as well as capacity, here by an explicit scope.
  • Incorrect: Add people to the project to use the budget quickly.. Wrong. Adding people to late work is limited by P53, and it does not manage demand (P49).
  • Incorrect: Refuse the budget, because extra capacity never helps.. Wrong. P49 does not reject capacity. It says to manage demand along with it.
Changes take three days from first commit to release. Lint takes 2 minutes, tests take 40 minutes, and changes wait two days in the review queue. Which of the following actions follow the bottleneck and work-in-progress rules?

Select all that apply.

Show answer
  • Correct: Measure and name the review queue as the constraint first.. Right. The P50 check is that the current constraint is measured and named before an improvement.
  • Incorrect: Halve the lint time, because it is the easiest thing to change.. Wrong. Speeding up a step that is not the constraint does not raise output (P50).
  • Correct: Add review capacity at the review queue.. Right. P50 improves the constraint first.
  • Correct: Limit the number of changes waiting for review.. Right. A limit on work in progress (P52) shortens each change's wait at the same throughput. It does not raise output; P50 does that at the constraint.
  • Incorrect: Run the tests on faster machines.. Wrong. Tests are not the constraint here, so P50 does not support this first.
A company wants faster launches. Every launch needs a review by the one security specialist. Which of the following responses follow the management form of the bottleneck rule?

Select all that apply.

Show answer
  • Incorrect: Hire more developers to produce more launch candidates.. Wrong. More developers do not raise output when the security review is the limit (P50).
  • Correct: Add review capacity at the security review step first.. Right. P50 improves the step that limits output, often an approval or a specialist.
  • Correct: Start measuring how long launches wait for the review.. Right. P50 needs the constraint to be measured and named.
  • Incorrect: Skip the review for small launches without a risk assessment.. Wrong. Dropping a security check to save time puts schedule above safety (P1). P50 improves the constraint step; it does not delete it.
A request passes through a front end, an API and a worker service. Each autoscaler reacts to its own queue, and swings grow along the chain. Which of the following changes follow the rule on shared demand?

Select all that apply.

Show answer
  • Correct: Publish the front-end traffic as an end-demand signal.. Right. P51 shares the real end demand with every stage.
  • Correct: Let the API and worker scale on that signal as well as on their own queue.. Right. The P51 example scales upstream services on front-end traffic, not only on their own delayed queue.
  • Incorrect: Make each stage react faster to its own queue.. Wrong. Faster reaction to the stage below amplifies the swings (P51), and it may cause oscillation (P48).
  • Incorrect: Give each stage a longer cooldown and nothing else.. Wrong. A cooldown (P48) reduces switching in one loop, but the stages still cannot see the end demand (P51).
A platform team supports several product teams and sees only the tickets that arrive. Its workload swings with every launch. Which of the following follow the rule?

Select all that apply.

Show answer
  • Incorrect: Hire people for each swing, and release them afterwards.. Wrong. This reacts to the swings. P51 removes their cause by sharing the real end demand.
  • Incorrect: Ask product teams to submit tickets earlier.. Wrong. Earlier tickets still show only the next stage's orders. P51 asks for the real end demand.
  • Correct: Give the platform team the product teams' roadmaps.. Right. The management form of P51 gives every stage the real end demand, not only the order of the next stage.
  • Incorrect: Add a buffer of unused capacity.. Wrong. A buffer is margin (P44). It does not give the stage the demand signal (P51).
A team has 23 epics open and six people. Nothing finishes, and every epic waits weeks. Which of the following steps follow the work-in-progress rule?

Select all that apply.

Show answer
  • Correct: Set a visible limit, such as four epics in progress.. Right. The P52 check is a visible limit on work in progress.
  • Correct: Finish items before starting new ones.. Right. P52 says to finish items before starting new ones.
  • Incorrect: Start work on every epic at once, so that all of them progress.. Wrong. Everything in progress and nothing finished is the P52 violation.
  • Incorrect: Speed up the first step of the process, whatever it is.. Wrong. Without finding the constraint (P50) this may add only more waiting items. P52 limits work in progress.
A manager asks why a limit on work in progress should shorten waiting times when the team's throughput stays the same. Which of the following explanations are correct?

Select all that apply.

Show answer
  • Correct: At a given throughput, average lead time is proportional to average work in progress.. Right. This is Little's law, the reason given in P52.
  • Correct: Less work in progress lowers the average lead time for every item.. Right. P52 follows from the proportion, so fewer parallel items means shorter waits.
  • Incorrect: More parallel work shortens waiting, because nobody is idle.. Wrong. More parallel work means longer waiting for every item (P52).
  • Incorrect: Lead time does not depend on work in progress.. Wrong. P52 gives the dependency, the proportion in Little's law.
A cluster migration is two weeks late, with a deadline two weeks away. The lead considers adding five engineers. Which of the following actions follow the rule on late work?

Select all that apply.

Show answer
  • Correct: Cut or move scope first.. Right. P53 cuts or moves scope before expecting a recovery from added people.
  • Incorrect: Add the five engineers now, since more hands finish sooner.. Wrong. New people need training and add communication paths, so output drops at first (P53, Brooks's law).
  • Correct: Add people at the start of the next migration, where work can be split.. Right. P53 adds people early, and only where the work can be split.
  • Incorrect: Add two engineers, as a spare in case someone is absent.. Wrong. Spare people for redundancy are P45 for a standing function. They do not rescue late coordinated work (P53).
A lead must decide on adding people to late work. Which of the following pieces of evidence meet the check of the rule on late work?

Select all that apply.

Show answer
  • Correct: A record of the expected training and coordination cost, made before the people are added.. Right. This is the P53 check.
  • Incorrect: A promise by the new people to work extra hours.. Wrong. This does not address training and coordination cost (P53).
  • Incorrect: A chart showing that the team needed fewer people last year.. Wrong. P53 asks for the cost of adding people to this work now.
  • Incorrect: A schedule that shows the old team finishing at the same speed.. Wrong. P53 expects the existing team's output to fall at first, not stay the same.
Only one person knows how to restore the billing batch job. A manager wants to remove this single point of failure. Which of the following actions fit the rules?

Select all that apply.

Show answer
  • Correct: Name a deputy and train a successor for the function.. Right. The management form of P45 keeps every critical function alive after the loss of one person.
  • Correct: Document the knowledge so that others can act on it.. Right. Documented knowledge is part of the management form of P45.
  • Incorrect: Wait until a failure happens, then hire an extra person at once.. Wrong. A new hire must first learn the job, the training cost P53 names, so the function stays down meanwhile. P45 puts the deputy in place before the loss.
  • Incorrect: Ask the one person never to take leave.. Wrong. This keeps the single point of failure. P45 needs the function to survive the loss of one person.