Top 8 Blast radius Interview Questions
Browse 8 real-world technical and behavioral interview questions about Blast radius. Review scenarios, edge cases, and architectural best practices.
One managed service in your primary region is having a bad day and your product is down with it. What can you do during the outage, and what should you have designed before it?
During the event your only levers are the ones already built: fail over, serve degraded from cache, or shed the dependent feature. Beforehand the work is finding your transitive dependencies on foundational services, making the running system statically stable, and choosing which features are allowed to fail alone.
A configuration change that passed review takes the entire fleet down in under a minute. What in your design should have limited the damage?
No retry policy or circuit breaker helps here, because the change was valid and the defect was already deployed. What bounds the damage is treating configuration as a rollout with stages and bake time, a kill switch whose own dependencies cannot fail with it, and a measured rollback time.
A Terraform plan in CI wants to destroy resources in production. What has to happen before anyone is allowed to approve it?
When a Terraform plan wants to destroy production, stop and identify whether the diff comes from state drift, a provider change, a renamed resource or real configuration intent. Do not approve until the blast radius is understood. It also connects IAC to the point an interviewer is testing.
How do you isolate tenants in a shared vector index?
Choose between an index per tenant, per-tenant namespaces and one filtered index by weighing recall, blast radius and per-tenant fixed cost. Partitioning turns tenant selectivity from a search-quality problem into a routing decision, which is the argument most candidates miss.
You want to prove the system survives losing a database, in production, on a Tuesday afternoon. How do you run that without being fired?
Turn it into an experiment: a steady state you can measure in under a minute, a blast radius you chose, an abort that is one command with a named person who can call it, and written approval from whoever owns the revenue. Tuesday afternoon is the right time because everyone who understands the system is awake, and the announcement goes to the channel your own alerts land in.
You are pushing a configuration change into the mobile core tonight. How do you stop one change taking the whole network down?
Blast radius is a property of the change process, not of the redundancy diagram - identical config applied to both halves of a resilient pair fails both. You need staged exposure with soak time, subscriber-visible health checks, a management path that survives the outage, and a rollback that has been executed.
Four thousand business customers share your SaaS platform. What are your tenant isolation options, and how do you make a cross-tenant data leak structurally impossible rather than merely unlikely?
Isolation runs from a tenant_id column through separate schemas and databases to a stack per tenant, trading efficiency against blast radius. Careful filtering is not an isolation model: push the predicate below the application with row-level security and scope caches and object prefixes too.
Your worker nodes take operating system and kernel updates automatically. What is the risk, and how would you make node-level change safe?
A node image change is a release of the layer underneath Kubernetes, so the control plane cannot stage it, roll it back or reliably report on it. Treat node pools as rings, replace nodes rather than patching them in place, and get the health signal from outside the cluster. It also connects node lifecycle to the point an interviewer is testing.