PayPal DevOps Engineer Interview Questions

“In your project the service authorised payments at all hours, and even a short pause meant customers seeing failures at checkout. I set up deployments that started new instances alongside the old, sent them a small share of traffic, and only then moved more, with old instances draining their in-flight requests before shutting down. During each step I watched the payment success rate and the time per request, compared with the version still running. A drop of even a small amount would have stopped and reversed the rollout automatically. We deployed many times a week without a customer-visible pause, and your result.”

“One evening a bank's system started answering very slowly. Our service waited on those calls, threads piled up, and soon payments that had nothing to do with that bank were failing too. I contained it by lowering the timeout for calls to that bank and limiting how many could be in flight at once, so the rest of the traffic recovered. Afterwards we gave every outside dependency its own pool and timeout, added a circuit breaker that stops calling a failing party for a short time, and a dashboard per party. The result was your result.”

“I would never change the table in one step. First I add the new column or table alongside the old one, which is safe. Then the code writes to both, and a background job copies existing rows into the new structure in small batches, so the database is never locked for long. Once the backfill is done, I compare old and new for a sample and then for everything, and only then switch reads to the new structure, behind a flag I can turn back. After a period with no problems, the old structure is dropped. For a payments table, every step also has a rehearsal on a copy of production data.”

“Money changes are the hard part. I would not let two regions change the same balance at once, because reconciling conflicting balances afterward is a nightmare. Each account would have a home region that owns its balance changes, with replication to another region in order. Reads, history and most of the interface can be served from any region. If a home region fails, its accounts fail over to the replica after we confirm it is caught up, accepting a short pause for those accounts. If we cannot confirm, I would rather refuse payments briefly than risk a balance that is wrong. Everything else stays up throughout.”

“Secrets would live in a vault service, injected into services at start-up, never in code, configuration files or container images. Each service gets only the secrets it needs. Encryption keys are versioned, so rotating a key does not break reading older data, and rotation runs on a schedule with no human handling the key. The services that touch card and bank data would run in their own network segment and cloud accounts, with separate pipelines and very few people able to reach them. Every access to a secret is logged. I would also run regular checks that nothing else can reach those services.”

“The main signal is the share of payment attempts that succeed, but a single overall number hides a failure that hits one country or one bank. So I would break it down by country, payment method, currency and type of payment, such as checkout against sending to a friend. Each segment gets its own baseline from the same hour on previous days, because a Sunday morning looks different from a Friday evening. Alerts fire when a segment drops well below its baseline for more than a few minutes. I would also watch the count of payments stuck in an unknown state, which often shows a problem first.”

“My first check is the buyer side: are checkout payments succeeding within their usual time? That is what must not break, so I would make sure the payout workers are not competing with it for the database or the network. Then I would look at the payout queue itself. If jobs are simply waiting, that is a delay, not a loss, and sellers can be told their payouts will arrive later that day. I would add workers only if the payout job is safe to run in parallel without paying anyone twice. Afterwards, I would review why the capacity plan did not include this day.”

“I want to run systems where reliability is not a slogan. In payments there is no quiet hour, every failure is visible to a buyer at a checkout or a seller waiting for money, and the other side of each transaction is a bank we do not control. Those constraints make operations work sharper. I have worked on your project with zero-downtime deployments and monitoring, and I want to apply that where the stakes are higher. PayPal moves money for buyers, sellers and friends around the world, all day, in many currencies. I want to learn how that is kept running.”