A checkout service calls an inventory service synchronously. When inventory slows down, checkout threads wait until they time out, and within minutes every service on the platform stops responding. Which set of design changes MOST effectively contains this failure?
Show answer and explanation
Answer: D
The failure comes from threads blocking while they wait on a slow dependency. A circuit breaker with short timeouts stops calls to the failing inventory service and returns a fallback, so waiting threads are released quickly. Separate pools per caller, known as bulkheads, stop one dependency from consuming every thread. Queues absorb non-urgent work so the checkout path is decoupled from inventory latency. Extra capacity and extra balancers do not stop threads from blocking.
Why the other options are wrong
- A. Doubling capacity lets slow calls wait longer, and threads still pile up when inventory degrades, so the outage only arrives later.
- B. Extra load balancers distribute requests, but they still forward calls to the slow inventory service, so threads still block while waiting.
- C. Read replicas relieve database-bound latency, but this failure comes from synchronous service-to-service calls, so replicas do not stop threads from piling up.