← Verkada Interview Insights

Verkada·Software Engineer·Onsite - System Design / Architecture·Senior

SeniorPrefer not to say
Jun 2026

Summary

Verkada system design round, one big question the whole time. The problem was designing a health monitoring system for 10 million cameras and I thought I had a decent handle on it but the follow-ups exposed some gaps pretty fast.

Questions Asked (6)

Q1

Design a system that monitors the health of 10 million cameras and continuously reports, in near real time, how many devices are healthy versus unhealthy. A camera is healthy if a heartbeat was received within the last 2 minutes.

System DesignTechnical Trade-offs
Author's notes

My first instinct was to just scan all 10M rows every minute and recount.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and scale (10M devices, 2-minute heartbeat window, near real-time reporting). Then design a scalable ingestion pipeline that processes heartbeats and maintains health state, followed by an efficient aggregation mechanism to compute healthy vs. unhealthy counts. Discuss trade-offs between accuracy, latency, and cost, and consider failure handling and monitoring.

Pro tip: Emphasize that the 2-minute window allows for batching and approximate counting, which can drastically reduce system complexity and cost while still meeting near real-time needs. Also, mention that you would shard the state by device ID to distribute load and avoid hotspots.

1. Clarify Requirements and Scale

Ask about expected heartbeat frequency, acceptable latency for reporting, accuracy requirements, and whether historical data is needed. Confirm the scale: 10M devices, each sending heartbeats at some interval (e.g., every 30 seconds).

2. Design Ingestion Pipeline

Propose a scalable ingestion layer (e.g., load-balanced API servers or a message queue like Kafka) to receive heartbeats. Ensure it can handle the write throughput (e.g., 10M devices * 2 heartbeats/min = ~333K writes/sec).

3. Maintain Health State

Design a distributed store (e.g., Redis, Cassandra) to track last heartbeat timestamp per device. Use sharding by device ID and TTL-based expiration to automatically mark devices as unhealthy after 2 minutes.

4. Aggregate and Report Counts

Implement a near real-time aggregation system (e.g., stream processing with Flink or Spark Streaming) that computes healthy vs. unhealthy counts. Use approximate counting or windowed aggregations to reduce load, and expose via a dashboard or API.

5. Address Trade-offs and Failure Handling

Discuss trade-offs: exact vs. approximate counts, latency vs. cost, and consistency vs. availability. Outline failure scenarios (e.g., node failures, network partitions) and how to ensure system resilience and data durability.

Key Points to Mention

  • Sharding by device ID to distribute state and avoid hotspots
  • Using TTL-based expiration in a distributed cache (e.g., Redis) to automatically mark unhealthy devices
  • Stream processing for near real-time aggregation (e.g., Kafka + Flink)
  • Approximate counting techniques (e.g., HyperLogLog) to reduce memory and compute
  • Trade-offs between exact and approximate counts, and between latency and cost
  • Failure handling: replication, idempotent writes, and monitoring for data loss

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q2

How do you detect that a camera has gone unhealthy without doing a full scan of all devices? A missed heartbeat is the absence of an event, not an event itself.

System DesignAlgorithms & Data Structures
Author's notes

This is where I got stuck the longest.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Acknowledge the insight that missed heartbeats are absence of events, then propose a time-based expiration mechanism using a distributed data store with TTL or a priority queue of expected heartbeats. Explain how to efficiently detect expirations without scanning all devices, and discuss trade-offs like accuracy, latency, and scalability.

Pro tip: Emphasize that you would use a min-heap or timing wheel keyed by next expected heartbeat, and that you'd shard the structure to avoid a single point of contention. Also mention that you'd handle clock skew and network delays with a grace period.

1. Clarify requirements and constraints

Ask about scale (number of cameras), heartbeat frequency, acceptable detection latency, and whether the system is distributed. This ensures your solution fits the context.

2. Choose an efficient data structure

Propose a min-heap or timing wheel ordered by next expected heartbeat time, so you only check devices whose deadline has passed. Alternatively, use a distributed cache with TTL per device key.

3. Design the detection mechanism

Explain how heartbeats update the device's next deadline (e.g., re-insert into heap or refresh TTL). A separate process checks for expired entries and marks devices unhealthy.

4. Address scalability and fault tolerance

Shard the data structure by device ID to distribute load, and ensure the checker is replicated for high availability. Discuss how to handle missed checks or node failures.

5. Handle edge cases and trade-offs

Mention clock skew, network jitter, and false positives; propose a grace period. Compare with alternatives like polling or full scans, highlighting efficiency gains.

Key Points to Mention

  • Time-based expiration (TTL) or priority queue (min-heap) to track next expected heartbeat
  • Avoiding full scans by only checking expired entries
  • Sharding for scalability and replication for fault tolerance
  • Grace period to account for network delays and clock skew
  • Trade-offs: detection latency vs. resource usage, false positives vs. false negatives
  • Handling the absence of events as a timeout condition

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q3

How do you handle duplicate, late, or out-of-order heartbeats, especially when you may have already scheduled an expiry check that a newer heartbeat has since invalidated?

System DesignTechnical Trade-offs
Author's notes

I mumbled something about deduplication tables and the interviewer asked which timestamp I'd trust since client clocks are unreliable.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying the requirements and constraints, then propose a robust mechanism like versioning or fencing tokens to handle out-of-order and duplicate heartbeats. Discuss trade-offs between different approaches and how to handle late heartbeats that may have already triggered an expiry check.

Pro tip: Mention that you would use a monotonic sequence number or timestamp per heartbeat and only accept updates if they are newer, which prevents stale data from overwriting fresh state. Also, highlight the importance of idempotency and how to make expiry checks conditional on the latest heartbeat version.

1. Clarify Requirements and Constraints

Ask about the system's expectations: how late can heartbeats be? What is the impact of false expirations? Are there multiple sources of heartbeats? This sets the stage for choosing the right approach.

2. Choose a Versioning or Ordering Mechanism

Propose using a monotonic sequence number, timestamp, or fencing token attached to each heartbeat. This allows the system to determine the relative order of heartbeats and reject stale ones.

3. Handle Duplicates and Out-of-Order Arrivals

Explain that duplicates can be ignored if they have the same version, and out-of-order heartbeats are discarded if their version is older than the last processed one. This ensures only the latest state is considered.

4. Make Expiry Checks Conditional

When an expiry check is scheduled, it should verify that the heartbeat version it was based on is still the latest. If a newer heartbeat has arrived, the expiry check should be cancelled or rescheduled.

5. Discuss Trade-offs and Edge Cases

Talk about trade-offs: e.g., using timestamps vs. sequence numbers, handling clock skew, and the cost of storing versions. Also, consider what happens if heartbeats are delayed beyond the expiry window.

Key Points to Mention

  • Monotonic sequence numbers or timestamps to order heartbeats
  • Idempotency: processing the same heartbeat multiple times should not change state
  • Fencing tokens to prevent stale heartbeats from affecting state
  • Conditional expiry checks that validate the heartbeat version before expiring
  • Trade-offs between different approaches (e.g., complexity vs. accuracy)
  • Handling clock skew and network delays in distributed systems

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q4

How would you extend the design to report healthy and unhealthy counts broken down by region, tenant, or firmware version without blowing up counter cardinality or making the read path complicated?

System DesignData Modeling
Author's notes

Follow-up question, came near the end.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by acknowledging the cardinality problem with raw per-device metrics and propose a pre-aggregated, dimensional model where region, tenant, and firmware are bounded dimensions. Then describe a write path that aggregates counts at ingestion or via periodic rollups, and a read path that queries these pre-aggregated tables with simple filters.

Pro tip: Emphasize that cardinality is controlled by limiting the number of unique dimension combinations—use hierarchical rollups and avoid high-cardinality dimensions like device ID in the aggregation key. Also, mention that firmware version can be bucketed into major versions to reduce cardinality.

1. Identify cardinality sources

Analyze which dimensions (region, tenant, firmware) have high cardinality and how they combine. Recognize that tenant and firmware version can explode if not bounded.

2. Design pre-aggregated tables

Create summary tables that store counts of healthy/unhealthy devices grouped by combinations of region, tenant, and firmware version. Use a fixed schema with these as columns and counts as measures.

3. Implement write path aggregation

Aggregate counts either in-stream (e.g., using a stream processor) or via periodic batch jobs that roll up raw device status events into the summary tables.

4. Optimize read path

Serve queries directly from the summary tables with simple filters and aggregations. Use indexing on dimension columns and consider materialized views for common queries.

5. Handle updates and freshness

Use upserts or incremental updates to keep summary tables current. Define a freshness SLA and consider lambda architecture if real-time and batch views are needed.

Key Points to Mention

  • Cardinality control: limit dimensions to bounded sets, bucket firmware versions, and avoid per-device metrics.
  • Pre-aggregation: compute counts at write time to reduce read-time computation.
  • Dimensional modeling: star schema with region, tenant, firmware as dimensions and counts as facts.
  • Read path simplicity: query pre-aggregated tables with filters, no complex joins or on-the-fly aggregations.
  • Scalability: use distributed databases or columnar stores for fast aggregations.
  • Trade-offs: freshness vs. cost, and how to handle late-arriving data.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q5

After a consumer crash and partition rebalance, how does the new owner reconstruct in-memory state, the timer schedule, and the counters without double-counting transitions during replay?

System DesignTechnical Trade-offs
Author's notes

Short on time by this point so I gave a surface-level answer about replaying from the log and rebuilding state.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by explaining that the new owner replays the partition's log from a committed offset, using idempotent state updates keyed by transition IDs to avoid double-counting. Then describe how timers are reconstructed from scheduled events in the log and counters are derived from the replayed state, ensuring exactly-once semantics.

Pro tip: Emphasize that the key to avoiding double-counting is to make state updates idempotent and to use a deterministic replay that ignores already-applied transitions, rather than relying on external deduplication.

1. Identify the recovery starting point

Determine the last committed offset or snapshot from which the new owner should begin replay. This ensures no transitions are missed or replayed unnecessarily.

2. Replay log with idempotent updates

Process each transition event in order, applying state changes only if the transition ID hasn't been seen before. Use a set of applied transition IDs or a versioned state to deduplicate.

3. Reconstruct timer schedule

Extract timer-related events (e.g., scheduled, fired, cancelled) from the log and rebuild the timer wheel or priority queue, ensuring timers are set relative to the current time or logical clock.

4. Rebuild counters from replayed state

Derive counters (e.g., number of transitions, errors) by aggregating over the replayed events, using the same idempotent logic to avoid double-counting.

5. Validate and resume normal operation

After replay, verify that the reconstructed state matches expected invariants, then switch to live processing from the log's tail, ensuring no gaps or duplicates.

Key Points to Mention

  • Idempotent state updates using unique transition IDs or sequence numbers
  • Committed offset and log replay from a consistent snapshot
  • Timer reconstruction from log events with logical time handling
  • Counter aggregation with exactly-once semantics
  • Deterministic replay and state machine replication
  • Handling of in-flight transitions during rebalance (e.g., using fencing tokens)

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q6

How do you tell the difference between cameras actually being unhealthy versus your monitoring pipeline being the broken thing, like consumer lag making counts look stale?

Root Cause AnalysisProduct Analytics & Metrics
Author's notes

Liked this question.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by acknowledging that stale counts can stem from either the cameras or the monitoring pipeline, and propose a systematic way to isolate the fault. Emphasize checking pipeline health first (e.g., consumer lag, processing delays) before concluding cameras are unhealthy, then correlate with independent signals like device heartbeats or direct camera pings. Finally, describe how you'd use that evidence to decide whether to fix the pipeline or investigate the cameras.

Pro tip: Always validate your monitoring pipeline with a known-good control—like a synthetic camera or a canary metric—so you can distinguish between a real outage and a monitoring artifact.

1. Check pipeline health first

Inspect consumer lag, queue depths, and processing latency to see if the monitoring system is backed up or dropping data. If lag is high, the stale counts are likely a pipeline issue, not camera health.

2. Compare with independent signals

Look at other data sources that don't rely on the same pipeline, such as direct device heartbeats, SNMP polls, or camera-initiated pings. If those show cameras are online, the pipeline is suspect.

3. Correlate timing and scope

Check if the staleness aligns with pipeline incidents (e.g., a deploy, traffic spike) and whether it affects all cameras or a subset. A pipeline issue often has a global or gradual onset, while camera issues may be localized.

4. Validate with a control

Use a synthetic camera or a known-good device to test the pipeline end-to-end. If the control also appears stale, the pipeline is broken; if it's healthy, the cameras are likely the problem.

5. Decide and act

Based on evidence, either fix the pipeline (e.g., scale consumers, clear backlog) or investigate camera health (e.g., network, power, firmware). Document the root cause to improve future detection.

Key Points to Mention

  • Consumer lag and its impact on metric freshness
  • Independent health signals like device heartbeats or direct pings
  • Synthetic monitoring or canary metrics to validate the pipeline
  • Correlation between pipeline incidents and staleness patterns
  • Scope of impact (all vs. subset of cameras) to infer root cause
  • End-to-end testing with a known-good control device

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.