How do you choose between SQL and NoSQL databases?

Choose SQL (PostgreSQL, MySQL) for structured data requiring ACID transactions, complex JOINs, and strict schema enforcement. Choose NoSQL (MongoDB, DynamoDB, Cassandra) for flexible schemas, massive horizontal scale, high write throughput, and eventual consistency workloads.

When should you choose Vertical Scaling vs Horizontal Scaling?

Start with vertical scaling (adding CPU/RAM to one server) for simplicity. Transition to horizontal scaling (adding more servers) when hardware limits are reached, cost curves become prohibitive, or high availability is required. Horizontal scaling introduces distributed system complexity.

What is the difference between Sharding, Partitioning, and Indexing?

Indexing speeds up read queries within a single table using B-Tree or Hash structures. Partitioning splits a single table into logical physical chunks within one database instance. Sharding distributes rows across multiple distinct database servers using a shard key, scaling write throughput and storage.

How do you scale WebSockets to millions of concurrent connections?

Increase Linux file descriptor limits, use Layer 4 load balancing with sticky sessions, and implement a Redis Pub/Sub backplane so any WebSocket server can relay messages to clients connected to other servers. Pattern: Client → HAProxy → WS Servers ↔ Redis Pub/Sub.

What is the difference between LSI and GSI in DynamoDB?

A Local Secondary Index (LSI) shares the same partition key as the base table but uses a different sort key. It is limited to 10GB per item collection and supports strong consistency. A Global Secondary Index (GSI) uses a completely different partition key, spans all partitions, supports only eventual consistency, and has its own dedicated throughput capacity.

Which database should I use for transactions, user profiles, logs, and analytics?

Use PostgreSQL for financial transactions (ACID compliance). Use MongoDB for user profiles (flexible JSON). Use Cassandra for logs and high-throughput writes (LSM tree). Use Apache Druid for real-time analytics (columnar storage). Use Elasticsearch for search and catalog (inverted index). Use Redis for sessions and caching (in-memory).

How does Consistent Hashing work?

Consistent hashing maps both servers and keys onto a circular ring. A key routes clockwise to the nearest server. When a node is added or removed, only 1/N keys need to migrate (vs nearly 100% in modulo hashing). Virtual nodes (100-200 per server) ensure even distribution and prevent hotspots.

How do you design a distributed rate limiter?

Use a Token Bucket algorithm for burst-friendly limiting. For distributed enforcement across multiple API gateway instances, use Redis with Lua scripts to atomically evaluate and increment counters, preventing race conditions (dirty reads) where concurrent requests could bypass the limit.

How does OAuth 2.0 PKCE secure Single Page Applications (SPAs) & Mobile Apps? — System Design Interview Answer & Trade-offs

Architectural Breakdown & AnalysisFAANG Aligned

Public clients (React SPAs, Mobile Apps) cannot securely store Client Secrets. Standard Authorization Code Grant exposes them to interception attacks.

How PKCE Prevents Interception

Code Verifier Generation: App generates a random high-entropy string (code_verifier).
Code Challenge Creation: App hashes the verifier using SHA-256 (code_challenge = Base64(SHA256(code_verifier))).
Authorization Request: Client sends user to Auth Server with code_challenge and code_challenge_method=S256.
Token Exchange: When Auth Server returns the authorization_code, the app sends the original code_verifier. Auth Server hashes it and verifies match before issuing JWT tokens.

TIP — Security Standard

OAuth 2.0 Security Best Practices mandate PKCE for all SPA and mobile application authentication flows.

Key Architectural Comparison

OAuth 2.0 Flow	Security Vulnerability	Client Type	Token Exposure Risk	Modern Status
Implicit Grant	Access token returned directly in URL hash.	SPAs & Mobile.	High (Token leaked in browser history/logs).	Deprecated & Banned.
Auth Code (with Secret)	Secret cannot be hidden on public clients.	Backend Web Apps.	Low (Token exchanged backchannel).	Standard for server-side apps.
Auth Code + PKCE	Cryptographic code verifier / challenge.	SPAs & Mobile.	Zero (Intercepted auth codes cannot be exchanged).	Current Industry Standard.

How does OAuth 2.0 PKCE secure Single Page Applications (SPAs) & Mobile Apps?

How PKCE Prevents Interception

Key Architectural Comparison

Continue Learning on Being SDE