You've joined the platform team of a regulated equities and derivatives broker. It runs an order management system connected to two exchanges over FIX, a market-data fan-out to about 40,000 client terminals, and an end-of-day settlement batch; peak load is 8,000 orders per second at the open. An outage during market hours costs roughly $250k a minute in lost flow and client compensation, and the regulator's last inspection found that production changes could not be traced end to end.
The interviewer asks“Design the infrastructure so order flow stays available for the whole trading session, and so that for any change — infrastructure, config, code or access — we can show an auditor who made it, who approved it, and prove the record hasn't been altered.”
I split the platform by state. Stateless edges like client gateways and market-data fan-out run active-active; the order path runs as a deterministic sequencer with a replicated journal, one leader and hot standbys, so failover takes seconds with identical state and no duplicate orders. For audit, Git is the change record and the pipeline is the only identity that can write to production; every event from Git, CI, Kubernetes, the cloud control plane, the privileged-access tool and the database is shipped to WORM storage in a separate account and hash-chained so missing or altered records are detectable. Market-hours changes are blocked by policy, with a two-person, time-boxed, recorded break-glass path that is reviewed the next day.
A free account unlocks the rest of it, and saves your progress across every track.