Medium · Government and education
Online exam
A national board runs a two-hour online exam for 200,000 students in three regions at the same time. Answers save automatically every half minute, a live heartbeat shows the student is still there, and proctoring marks suspicious events. Every saved answer matters. A minute of outage at the wrong time is a national story. Practise this medium system design problem for free with a Google or GitHub account.
The brief
A national board runs a two-hour online exam for 200,000 students in three regions at the same time. Answers save automatically every half minute, a live heartbeat shows the student is still there, and proctoring marks suspicious events. Every saved answer matters. A minute of outage at the wrong time is a national story.
Think of a timed online exam for 200,000 students.
Users, scale and requirements
- Who uses it
- 200,000 students at the same time (approx.)
- Audience in plain numbers
- 200,000 users or devices
- Normal peak
- ≈ 25,000 requests per second
- Request mix
- Message: 40%; Write: 25%; Read: 17%; Sign-in: 10%; Analytics event: 8%
- Speed for 99 of 100 requests
- Message: ≈ 400 ms; Write: ≈ 400 ms; Read: ≈ 400 ms; Sign-in: ≈ 1,500 ms
- Successful requests
- 99.95%
- Data safety
- No acknowledged write may be lost.
- Monthly budget
- ≈ $49,000
- Data at rest
- ≈ 2 TB
- Where users are
- North America: 50%; Europe: 30%; Asia Pacific: 20%
- Home region
- North America
- Waiting deadlines
- Message: 900 seconds; Write: 3,600 seconds; Read: 900 seconds; Sign-in: 900 seconds; Analytics event: 3,600 seconds
- Fresh reads
- People must see their own changes. At most 0.1% of reads may be stale in the model.
- Personal reads
- 60% of reads are private; a shared public copy cannot answer them.
- Required proofs
- Signed-in access; Tested backups; Audit trail
≈ marks an approximation, just as in the game. Waiting deadlines measure the age of queued work and are separate from interactive response time.
- Load is nearly flat during the exam window and falls to almost nothing after.
- Heartbeats are small and can be lost; saved answers cannot.
Questions that shape the design
Can the exam start late for everyone?
Yes, if it must. But students already inside cannot lose answers or time.
How often does a student's browser talk to us?
An autosave about every 30 seconds and a heartbeat about every 20 seconds, so the load is steady and large.
Is the sign-in rush at the start?
Yes. Most students sign in within a few minutes before 9 am, about three times the normal level.
What does an expired certificate do?
Browsers refuse to connect at all. Everyone is locked out until someone finds and replaces it.
The traffic day
Traffic concentrated in working hours. The clock covers 00:00 to 24:00 in the home region. Events add pressure on top of that normal traffic.
08:55 · Thundering herd
After a restart or outage, every client reconnects and signs in at the same moment.
Traffic for Sign-in, Message, Read reaches 3 times the scheduled load; rises over 10 seconds, holds for 300 seconds and eases over 300 seconds. Other request types keep their scheduled load.
09:40 · Certificate expired
The HTTPS certificate on your front door expires. Every browser refuses to connect.
Failed calls: 100%. Lasts until detected and repaired.
10:10 · Zone outage
An availability zone loses power or network access.
Duration: ≈ 1,800 seconds.
What a strong design has to handle
- Every student is far from at least one region. A global load balancer sends each to the nearest healthy one.
- Recover versioned saved answers without accepting stale autosaves or ambiguous cutoff.
- A key-value store for heartbeats is cheap and fast; sending heartbeats to the answer database would triple its cost for data nobody keeps.
- A global store spanning regions adds round-trip time for far-away students, so answers are saved in the nearest copy and replicated; a lost region costs a few seconds of replay, not an exam.
Make a prediction, run a full traffic day, then compare the result. The in-game editorial opens after a finished day and includes measured reference designs.
Concepts to practise
Related problems
- Medium
Telehealth video visits
Patients join a video visit with a doctor from their phone. Most calls go straight between the two people, but the platform runs the waiting room, chat, sign-in, the join link and a relay for the calls that cannot connect directly. A bad minute here means a patient staring at a spinner.
- Medium
Smart home
One million homes have a hub that keeps a live connection to your cloud. The hub reports its devices every few minutes, and the phone app sends commands like "lock the door". Commands must feel instant and must not be repeated. Once in a while a power cut ends and every hub reconnects together.
- Medium
Voice and video call setup
People tap a name and expect the other phone to ring in a second or two. Your job is the setup: find where the person is, ring their devices and connect the two sides. Everyone calls at the same moments, like evenings and holidays.
- Hard
Live streaming
Streamers broadcast live and thousands watch together, with a chat on the side. Everyone wants the same piece of video at the same second, so nothing can be saved for later. When a big streamer goes live, the whole audience arrives at once.