Backend Architecture
Circuit breakers: multiple-choice review
Crux Multiple-choice synthesis across the circuit-breaker unit — fast-fail, the three-state machine, trip thresholds, bulkheads, fallbacks, and fleet-scale failure modes.
Your altitude — climbing toward senior
ZeroJuniorMiddleSenior
You are at senior altitude — in orbitSix questions that cut across the whole unit. Each mirrors a call you make in a real incident — not a definition to recite, but a tradeoff to weigh when a downstream is sick and your threads are filling.
Goal
Confirm you can connect fast-fail, the state machine, trip thresholds, bulkheads, fallbacks, and the fleet-scale failure modes — the synthesis the individual lessons built toward.
Quiz
Completed
A payment provider slows from 50 ms to 5 s but never returns errors. Within seconds the whole service — including routes that never touch payments — stops responding. Why is the slow case worse than an outright outage, and what is the breaker's role?
Heads-up Nothing is corrupted — the harm is resource occupancy, every caller pinned on a slow call. A breaker frees resources by fast-failing; it does not roll back data.
Heads-up The parked threads come from a shared pool, so unrelated routes starve too. The breaker narrows the blast radius, it does not widen it.
Heads-up A slow success costs everything a real success would plus the wait; it pins resources for the full timeout. Slow is the dangerous state precisely because callers keep waiting.
Quiz
Completed
A breaker is set with a cooldown (resilience4j waitDurationInOpenState) of 1 s in front of a dependency that takes about 20 s to restart after it falls over. What goes wrong?
Heads-up A cooldown shorter than the dependency's real recovery time guarantees the probe lands on a still-broken service; the breaker flaps instead of recovering. The cooldown should track real recovery time.
Heads-up It leaves open every second to probe — that is the problem. It re-enters open because the probe fails, not because it is stuck.
Heads-up The cooldown is just how long open lasts before half-open; a short one still goes half-open, just too soon.
Quiz
Completed
A low-traffic admin endpoint sees about 10 requests/minute. One transient timeout at 3 a.m. trips its breaker for the full cooldown, fast-failing every later request over a single blip. Which setting is the right fix, and why not just raise the failure-rate threshold?
Heads-up A shorter cooldown only reduces the damage of a false trip; it does not stop the breaker tripping on a single call. The volume floor is what prevents the trip.
Heads-up Slow-call detection is unrelated — the false trip came from a failure rate computed on too few calls, not from a slow call.
Heads-up The window type changes how 'recent' is defined, but a single failure still produces a 100% rate within either window. Only a minimum-volume floor guards against the single-call trip.
Quiz
Completed
Three downstreams — payments, recommendations, search — share one 50-thread pool. Recommendations (the least important) slows to 5 s and the whole service fails, even though its breaker eventually trips. What does a bulkhead add that the breaker alone cannot?
Heads-up A faster window trips the breaker sooner but the pool can still drain before it reacts; only partitioning the budget contains the failure. The bulkhead is the missing isolation, not faster reaction.
Heads-up Retries add load to an already-sick dependency; they do not isolate. A bulkhead partitions the concurrency budget per dependency.
Heads-up Per-dependency breakers still draw from one shared thread pool, so a slow dependency drains the shared budget before its breaker reacts. Isolation requires capping concurrency per dependency, which is the bulkhead.
Quiz
Completed
A team wraps a flaky recommendations service in a breaker and ships it. During the next incident the breaker never trips and the homepage hangs — the recommendations calls do not error, they take 30 s each. What is the missing piece, and what second piece do they still need once it trips?
Heads-up A threshold cannot help when zero failures are being counted — the hangs never register as failures without a timeout. The timeout is what converts a hang into a countable failure.
Heads-up A bigger pool delays starvation but the breaker still never counts the hangs. The timeout is what makes a hang look like a failure.
Heads-up Retrying a 30 s hang multiplies the damage. The breaker needs a timeout to bound and count each call, plus a fallback for what to return once open.
Quiz
Completed
Service A calls B calls C, each retrying up to 4 times on failure, across a fleet of fifty instances. C wobbles briefly. The wobble becomes a sustained, self-inflicted outage. What is the dominant mechanism, and which fix bounds it?
Heads-up Breakers do not corrupt data, and the harm here is multiplicative load, not correctness. The 64x retry amplification is the mechanism.
Heads-up Shared state buys a shared view at the cost of a hot-path network call and a new dependency; it does not address the retry storm beneath the breaker. The storm is bounded by capping retries and keeping the breaker above them.
Heads-up Backoff spreads one client's attempts but clients that failed together re-synchronize into waves; jitter is what breaks the correlation, and a breaker above the retries is what bounds the multiplier.
Recap
The unit’s through-line is one decision chain: a slow dependency starves a shared pool, so a breaker fast-fails it (closed counts failures, open rejects instantly, half-open probes), tripping on a failure rate over a sliding window gated by a minimum-volume floor, with slow counted as failure. A bulkhead isolates the budget per dependency so one sick downstream cannot drain the whole pool before the reactive breaker trips; a timeout converts a hang into a countable failure and a fallback decides what to return when open; and at fleet scale the real danger is retry amplification (4×4×4 = 64), tamed by keeping the breaker above the retries, capping the absolute retry rate, and jittering both retries and half-open probes. Every per-instance safety device needs a fleet-level story.