How the interviewer opens it
“Design a system that records sensitive administrative and user actions across services. Auditors need records they can trust. The system must not significantly delay application requests.”
The prompt is vague on purpose. The first minutes are for you. Reduce the prompt to the core features and agree on the numbers before you draw.
What to clarify first
- Scale
- Read and write mix
- Event contents
- Source boundary
- Latency and freshness
- Consistency, durability, and outages
- Threat model
- Access
- Retention
- Interview boundary
The interviewer has the answers. In a SysRound round, Alex gives these answers, as a real interviewer does.
Scope of a strong answer
Core requirements
- Collect events from an existing durable source journal
- Search and export records within the caller's permitted tenant scope
- Expose changes and omissions in results for accepted records
- Protect authoritative records from early deletion for seven years
Usually out of scope
- Design the source transaction that captures each action
- Support legal holds or a fixed deletion deadline
- Provide cross-region disaster recovery
- Search full request bodies or replace application debug logs
What interviewers ask about
- Trust in query results
- Valid returned records do not prove a complete result. A hostile search database can hide every matching record without changing the remaining records.
- Records during an outage
- A fast asynchronous path needs finite durable capacity. Each handoff must preserve records until the next copy and its evidence become durable.
- Access to records
- Queries and exports expose sensitive facts across tenants. A worker's broad service role must not become the caller's access scope.
Common mistakes
- Treat a mutable search database as the authoritative record set
- Verify returned records without checking result coverage
- Trust mutable counts or empty search results as evidence of absence
- Describe pending or failed verification as a complete result
- Expire unarchived log records because a timer ends
- Check query access but leave exports or downloads outside those checks
The bar by level
- Senior (L5/E5)
- Connects durable handoffs, tenant checks, and locked retention. Defines verified query membership and coverage. Calculates one relevant budget. Examines one optional area if time permits.
- Staff (L6+/E6+)
- Defines exact snapshot and checkpoint limits. Explains partial exports and hostile index results. Compares verified scans with stronger index evidence. Examines one selected failure boundary without requiring every extension.
Sources · 1 reference
These records explain where the question appears. A company tag or candidate report does not guarantee a future interview question.
SysRound · 1 record
No company association
Design a tamper-evident audit logging system
Reported date not specified
Source snapshot: Nov 12, 2026
View source