A live-sports streaming platform runs its whole live path — encoders, packagers, origin, playback and entitlement APIs — in one primary cloud region, with a second region that only serves on-demand video. Peak is 25 million concurrent viewers through a CDN. Last month an 11-minute regional network fault dropped 9 million viewers mid-match, and a tournament starts in two weeks. The network team has ruled out DNS-based failover: large ISP resolvers ignore low TTLs and the last record change took 40 minutes to drain.
The interviewer asks“Design multi-region failover for the live pipeline that can ship in two weeks, without changing DNS during a failover. Tell me what you build, what you deliberately cut, and how you prove it works before the first match.”
In two weeks I'd protect only the viewer path: watching must survive a region loss; buying, chat and recommendations may degrade. Video fails over at the CDN, not in DNS: a second epoch-locked encoder and packager chain in region two produces interchangeable segments with the same DRM keys, the CDN uses an origin group with region one primary and region two secondary, and origins return 503 when their manifest goes stale so 'alive but frozen' triggers failover too. APIs sit behind one anycast global load balancer with health-checked backends in both regions, and playback tokens become self-contained so region two doesn't need region one's session store. I'd cut active-active writes and client changes, and prove it with a production drill on a test channel and then a low-stakes live match before the tournament.
A free account unlocks the rest of it, and saves your progress across every track.