How do you choose between SQL and NoSQL databases?

Choose SQL (PostgreSQL, MySQL) for structured data requiring ACID transactions, complex JOINs, and strict schema enforcement. Choose NoSQL (MongoDB, DynamoDB, Cassandra) for flexible schemas, massive horizontal scale, high write throughput, and eventual consistency workloads.

When should you choose Vertical Scaling vs Horizontal Scaling?

Start with vertical scaling (adding CPU/RAM to one server) for simplicity. Transition to horizontal scaling (adding more servers) when hardware limits are reached, cost curves become prohibitive, or high availability is required. Horizontal scaling introduces distributed system complexity.

What is the difference between Sharding, Partitioning, and Indexing?

Indexing speeds up read queries within a single table using B-Tree or Hash structures. Partitioning splits a single table into logical physical chunks within one database instance. Sharding distributes rows across multiple distinct database servers using a shard key, scaling write throughput and storage.

How do you scale WebSockets to millions of concurrent connections?

Increase Linux file descriptor limits, use Layer 4 load balancing with sticky sessions, and implement a Redis Pub/Sub backplane so any WebSocket server can relay messages to clients connected to other servers. Pattern: Client → HAProxy → WS Servers ↔ Redis Pub/Sub.

What is the difference between LSI and GSI in DynamoDB?

A Local Secondary Index (LSI) shares the same partition key as the base table but uses a different sort key. It is limited to 10GB per item collection and supports strong consistency. A Global Secondary Index (GSI) uses a completely different partition key, spans all partitions, supports only eventual consistency, and has its own dedicated throughput capacity.

Which database should I use for transactions, user profiles, logs, and analytics?

Use PostgreSQL for financial transactions (ACID compliance). Use MongoDB for user profiles (flexible JSON). Use Cassandra for logs and high-throughput writes (LSM tree). Use Apache Druid for real-time analytics (columnar storage). Use Elasticsearch for search and catalog (inverted index). Use Redis for sessions and caching (in-memory).

How does Consistent Hashing work?

Consistent hashing maps both servers and keys onto a circular ring. A key routes clockwise to the nearest server. When a node is added or removed, only 1/N keys need to migrate (vs nearly 100% in modulo hashing). Virtual nodes (100-200 per server) ensure even distribution and prevent hotspots.

How do you design a distributed rate limiter?

Use a Token Bucket algorithm for burst-friendly limiting. For distributed enforcement across multiple API gateway instances, use Redis with Lua scripts to atomically evaluate and increment counters, preventing race conditions (dirty reads) where concurrent requests could bypass the limit.

Which authorization and session mechanisms are required in distributed microservices? — System Design Interview Answer & Trade-offs

Architectural Breakdown & AnalysisFAANG Aligned

Authenticating users across independent microservices requires moving away from single-server memory sessions.

Mechanism	How It Works	Pros	Cons
Stateful Session (Redis)	User ID is mapped to a random Session ID in Redis. Microservices call Redis to validate token per request.	Immediate revocation. High security.	Network round-trip latency to Redis on every API call.
Stateless JWT	User metadata and permissions are signed cryptographically and sent in client header. Services validate signatures locally using public key.	Zero network latency for validation. Highly scalable.	Hard to revoke before expiration without building token blacklists.
OAuth 2.0 / OIDC	Delegation framework where third-party services request access tokens issued by an identity provider (Auth0/Okta).	Industry standard separation of concerns.	Multi-step handshakes and token management complexity.

TIP — Hybrid Edge Pattern

Deploy an API Gateway at the edge. The gateway validates the client's Session ID or JWT once, strips the token, and attaches trusted headers (e.g., X-User-ID: 8472, X-User-Role: Admin) down to internal microservices.

Which authorization and session mechanisms are required in distributed microservices?

Continue Learning on Being SDE