Log live tail streaming
Design the real-time 'live tail' feature of a log platform: an engineer opens a filtered stream (e.g. service=checkout AND level=error) and sees matching log lines appear within ~1s of being emitted, while terabytes/day are still being ingested for storage. During an incident, hundreds of engineers open live tails with different filters simultaneously. Design how live matching works without scanning storage, how you fan results out to many concurrent subscribers, and how you protect ingest.
What a strong answer looks like
Clarify scale and constraints first. Propose a clean component breakdown, then go deep on the hard parts (data model, bottlenecks, consistency, failure modes) and name the trade-offs you are making.
Clarify4:00 left
Estimate4:00 planned
Design11:30 planned
Deep dive9:30 planned
Failure6:00 planned
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.