Module 15 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Layered system model

A description of a system as inputs feeding a processing layer, which writes to persistence, with an interface layer exposing results to consumers.

Dependency direction

Dependencies are one-way: if A depends on B, a failure in B degrades A, while a failure in A leaves B unaffected.

Idempotent operation

An operation that produces the same end state when repeated. Non-idempotent operations need deduplication keys before retries are permitted.

Single source of truth

The rule that each data field has exactly one authoritative owner, and every replica is a read-only copy with a defined synchronization interval.

Stateless component

A component that holds no durable local state between requests, so any instance can be replaced at any time without a recovery procedure.

End-to-end latency

The time from request acceptance to response completion, including all internal hops. Internal processing time alone is not a valid latency measure.

Capacity safety factor

Required capacity equals peak load multiplied by 1.5. This margin absorbs bursts and is the default unless a documented exception exists.

Design review artifacts

Three required items: the interface contract, the failure-mode table, and the capacity estimate. A design missing any of them cannot pass review.

Replication threshold rule

Replicate rather than scale vertically when the read-to-write ratio exceeds 4:1. Below that ratio, vertical scaling is the default choice.

RPO and RTO

RPO is the maximum acceptable data-loss window; RTO is the maximum acceptable downtime. Both must be stated numerically during design.

Blast radius

The set of components affected by a single failure. Designs with an unbounded blast radius require explicit sign-off before approval.

Backward-compatible schema change

A change that adds only optional fields with defined defaults. Removing or renaming a field is a breaking change requiring a major version increment.

Partition key selection

Choose the highest-cardinality key that also appears in most queries. Otherwise cross-partition joins dominate and degrade performance.

Configuration precedence order

Environment variables override config files, which override compiled defaults. A value set at a higher level always wins over a lower one.

Secret injection

Secrets are stored in a secret store and injected at runtime, referenced by name only. They never appear in config files or source control.

Retry backoff policy

Exponential backoff with jitter: base delay 1 second, multiplier 2, maximum 5 attempts. Failures beyond the cap route to a dead-letter queue.

Timeout nesting rule

Each dependency timeout must be shorter than the caller's own timeout. A longer downstream timeout creates cascading hangs during slowdowns.

Connection pool sizing

Size pools to expected concurrency rather than peak load, typically concurrency multiplied by 1.2, with a hard maximum configured.

Liveness versus readiness

Liveness checks whether the process runs; readiness checks whether it can serve traffic and must verify downstream dependencies before passing.

Log level semantics

ERROR marks failed operations, WARN marks degraded but successful ones, INFO marks state changes, and DEBUG is disabled in production environments.

Feature flag default

Flags default to off in production. Enabling one requires a named owner and a scheduled removal date to prevent permanent flag debt.

Four golden signals

Latency, traffic, errors, and saturation. Every service dashboard must display all four to support consistent triage.

Symptom-based alerting

Alert on user-affecting symptoms such as error rate and latency, not on causes like CPU or memory, except as lower-severity leading indicators.

Error budget

One minus the SLO. A 99.9 percent SLO leaves a 0.1 percent error budget over the measurement window.

Burn-rate alert

An alert that fires when the error budget is consumed faster than the window allows. A 14.4x rate over one hour signals imminent exhaustion.

Backup verification rule

Backups are verified by performing a restore, not by checking completion status. An untested backup is treated as no backup at all.

Runbook requirement

Every alert must have a runbook entry. An alert without one is downgraded to a dashboard annotation rather than paging anyone.

Triage order

First confirm scope, then check recent changes, then inspect the four golden signals before modifying any configuration during an incident.

Five whys technique

Applied to the timeline of events rather than to people. The output is a list of contributing factors, not an individual to blame.

Least privilege access

Permissions are granted per task with an expiry date. Standing access requires quarterly recertification to remain valid.

Incident severity levels

SEV1 is full outage or data loss and pages immediately; SEV2 is major degradation; SEV3 is minor degradation with a workaround and does not page.

Audit log immutability

Audit logs are append-only and retained per policy. Modifying or deleting an audit record is itself an auditable event.