Interview questions
Which clock
1What is the difference between event time, processing time and ingestion time?
Event time is stamped near where the event happened: meaningful, but you cannot verify it. Processing time is the machine's clock during computation: it breaks reproducibility. Ingestion time is stamped when data crosses your boundary: trustworthy and replayable, but it records your own outages.
Read moreThe three clocks
2Why should a streaming job produce the same output whether it is replaying old data quickly or running live?
Correctness here means the output does not depend on how fast the job runs. Any dependence on execution speed is a bug.
Watermarks
3What is a watermark?
A declared lower bound, which never decreases, on the event times of records still to arrive: "nothing older than this will come". It is asserted, not proven.
Read moreWhy a watermark is needed
4A heuristic watermark trails the latest event time seen by a delay δ. How do you choose δ?
δ is a quantile of the distribution of how late events arrive, so choosing δ is choosing the rate of late records. On a heavy-tailed distribution, each extra "nine" of completeness costs multiplicatively more delay.
Read moreHeuristic watermarks
5Why can one slow partition stall a whole streaming job?
The job's watermark is the minimum over all its input partitions, so one lagging input freezes it. No window can close, and state piles up everywhere else.
Read moreThe watermark is a min
6What does an idleness timeout on a source do, and what is the risk?
It treats a silent source as having nothing to say, so the watermark can move on. If the source was actually broken, its data later arrives late or is dropped. It trades correctness for liveness, so it needs an alarm.
Read moreIdle sources
7What is the difference between watermark lag and event-time lag?
Watermark lag is how stale your claim of completeness is; event-time lag is how stale your input is. They differ by δ plus processing delay. Both look bad while a backlog is being replayed.
Read moreTwo kinds of lag
Late data and triggers
8What can a streaming job do with a record that arrives after its window has closed?
Drop it (and count it), divert it to a side output, or re-fire the window with an updated result. Re-firing requires keeping the window's state.
Read moreLate data
9How does allowed lateness affect memory?
The number of windows kept per key is about 1 + allowed lateness ÷ window size. For short windows, doubling the lateness roughly doubles the state.
10Is an exactly-once pipeline always correct?
No. Exactly-once is about duplicates, not coverage: if late data is dropped, the totals are still wrong.
Read moreA correction that vendors blur
11How can a pipeline avoid needing to buffer and reorder records?
Use operators that are commutative and associative: sum, count, min, max, HyperLogLog, Count-Min. Order-sensitive operators, such as first and last, sessions, exact percentiles and even floating-point sums, force buffering.
Read moreDo not need order
12What is accumulation mode, and why does it matter?
It decides whether a window that fires again emits the new total or only the change. It must match the sink: totals need a keyed overwrite, deltas need an additive sink. A mismatch double-counts.
Read moreAccumulation mode
Storage and corrections
13Should a table be partitioned by event date or by ingestion date?
Event date lets queries prune, but late data keeps rewriting old partitions. Ingestion date keeps writes append-only, but every query must scan the tail of late arrivals. Usually you use both, and publish when each event-date partition is frozen.
14To publish a correction, should a stream emit retraction pairs or upserts?
The total cost is the same; who pays differs. Retractions ("minus the old value, plus the new one") let consumers keep a running total. Upserts make consumers look up the old value themselves.
15Which aggregates can be revised incrementally when a correction arrives?
Those with an inverse, such as sum and count, where you can subtract the old contribution. Max, min, first, exact distinct counts and exact percentiles need the underlying values kept.
Read moreYou need an inverse
Bitemporal data and temporal joins
16What is bitemporal data, and why is one timestamp not enough?
Valid time (when a fact was true in the world) and transaction time (when the system believed it) differ because of corrections. With one timestamp, one of the two axes is lost when the row is written, and cannot be recovered.
Read moreBitemporal modeling
17Is a type-2 slowly changing dimension bitemporal? Is a table format's time travel?
Neither. A type-2 dimension covers valid time only. Time travel covers transaction time only, and per table rather than per fact.
Read moreA common misunderstanding to correctTime travel and versioned reads
18What is future leakage?
Joining an event with the current version of a dimension instead of the version that was valid at the event's time. Reports become irreproducible, and machine-learning models that look good offline fail in production.
Read moreFuture leakage
19What is an as-of join?
For each event at time t, take the most recent feature value that was known at or before t.
Read moreThe correct join: as-of
20Why join features on when they became available, not on event time?
A value computed by a nightly batch is not usable until the batch finishes. Joining on event time gives a smaller, but real, leakage.
Read moreThe lag between event and knowledge
21Why must a feature store be append-only?
Overwriting destroys the history the as-of join needs. You need both the value and when it became known.
Read moreFeatures must be stored bitemporally
Calendars, clocks and expiry
22Why store a time zone's name rather than its UTC offset?
An offset loses the rules needed to reinterpret the time if those rules change in future or retroactively. Store the instant plus the zone name, and apply the rules when reading.
Read moreTime zones and calendars
23Which clock should a timeout use?
The monotonic clock. The wall clock can jump, because of NTP adjustments, a virtual machine migrating, or someone changing it.
Read moreMonotonic clocks and wall clocks
24How do you make a pipeline replayable?
Make the logical time an input parameter, not something read from the environment. Remove now(), processing-time triggers, and any dependence on the order in which records arrive.
Read moreReplay determinism
25What ordering must hold between a deduplication TTL, the replay horizon, allowed lateness and the watermark delay?
Deduplication TTL ≥ replay or retry horizon ≥ allowed lateness ≥ watermark delay δ. Breaking it causes duplicates or drops, and nothing checks the chain unless you do.