Compare instance-loss and zone-loss capacity requirements.

Question

A fictional stateless service runs six identical instances. Load tests support 80 requests per second per instance at the required latency when operated at the chosen safe utilization. Current peak is 320 requests per second; plan for 25% growth and the loss of one instance. Traffic divides evenly, there are no shared bottlenecks, and the per-instance figure already includes the agreed utilization margin. Required second stage: the six instances currently occupy three zones equally. A proposed launch also requires surviving loss of any whole zone at the same planned peak, before new capacity starts. Compare equal placement with a permitted unequal layout. The safe throughput and even post-failure load-distribution assumptions still apply.

Accepted Answer

Example Answer

Planned peak is 320 times 1.25, or 400 requests per second. After losing one instance, five instances provide 400 requests per second, so six is the mathematical minimum under these assumptions. The current fleet meets that specific N+1 requirement exactly, with no additional spare capacity beyond the margin already embedded in the 80-per-instance figure.

I would keep six as the minimum rather than automatically add a seventh, then validate failover, traffic distribution and startup time. The proposed zone requirement changes the decision: six in a 2/2/2 layout cannot meet it. Equal placement needs nine; eight in a 3/3/2 layout is sufficient if uneven placement is permitted and verified.

Worked reasoning

Let N be total instances. The condition is (N − 1) × 80 ≥ 400, giving N ≥ 6.

Do not apply the same utilization margin twice: the prompt's 80 already incorporates it. Also do not use average daily load in place of the stated peak. Test loss at peak with the actual routing, connection behavior and dependency capacity.

A six-instance result is conditional, not an availability guarantee. Autoscaling can help sustained growth but new capacity has detection, provisioning and warm-up delay. State what happens during that interval, including admission control or degraded behavior.

Required zone analysis: the current 2/2/2 layout loses two instances, leaving 4 × 80 = 320 requests/s, so it fails the 400 requests/s target. Equal placement needs three instances per zone: nine total, with six surviving instances and 480 requests/s. An allowed 3/3/2 placement uses eight total: losing either largest zone leaves five × 80 = 400. Seven cannot suffice across three zones, since at least one zone contains three and its loss leaves at most four. Capacity must already be ready before the failure; neither arithmetic result proves network or dependency independence.

What the interviewer is assessing

Core checks (1 point each):

Calculates 400 requests per second and six total instances.
Shows why 2/2/2 fails a zone loss and derives nine equally placed or eight in 3/3/2.
Keeps both results conditional on measured safe throughput, ready capacity, post-failure routing and dependency independence.

Stronger (+1 after all core checks): Avoids double-counting margin and separates startup delay from steady-state capacity.

Acceptable alternatives: Seven or more can be justified by an additional explicit uncertainty or failure requirement, not by changing the arithmetic.

Red flags: Uses five total instances for N+1 or assumes autoscaling supplies instantaneous capacity.

Follow-up

The measured safe throughput drops to 70 per instance. What is the new minimum?

Example response: We need N − 1 at least ceil(400/70), which is six surviving instances, so seven total. Recheck the cause of the lower throughput and any shared bottleneck before assuming linear scaling.

Pressure test

The six instances are evenly spread over three zones and must survive one whole zone failing. What changes?

Example response: Losing a zone removes two instances, leaving four × 80 = 320, below the 400 requirement. With equal placement across three zones, nine total gives six survivors and 480 requests per second. Eight with a 3/3/2 layout could meet 400 after losing a largest zone, if unequal placement is permitted; state the placement constraint explicitly.

Cost extension

For this service, compare ten instances at $90/month each with eight in a permitted 3/3/2 layout. Is the cheaper plan defensible?

Example response: Monthly cost falls from $900 to $720, saving $180 (20%). Eight instances still provide 400 requests/s after losing a largest zone, exactly the stated requirement. Approve the reduction only after verifying placement, routing, ready capacity and the already embedded utilization margin. If equal placement or extra growth headroom is required, this eight-instance proposal is not sufficient. Cost reduction can be justified; inventing another mandatory margin would change the assumptions.