A municipal permit portal’s checkout must still return a useful response when the optional recommendations service is down. Which design approach best isolates that failure?
Select an answer to reveal the explanation.
Short Explanation
Checkout is the main road; recommendations are a side street. When the side street floods, traffic should still move on the main road—with a simpler view—rather than closing the whole city.
Full Explanation
Checkout is the critical citizen path on the municipal permit portal; recommendations are optional enrichment. Isolating failure means the recommendations collaborator can time out, return an error, or be circuit-broken while checkout still completes with a cached or empty suggestion list. Bulkheads, short timeouts, and fail-soft defaults keep the money path alive when the side feature is dark—exactly the cloud-native resilience goal for a public portal under uneven dependency health.
Sharing one thread pool across checkout and recommendations couples their fate: a hung recommendations call can exhaust workers and starve checkout. Blocking checkout until recommendations recovers prioritizes a perfect page over a usable purchase and turns a partial outage into a full stop for permit fees. Routing recommendations through the same process as checkout collapses process isolation so a crash or memory leak in the side feature takes down the main path.
Exam caveat: fail-soft is appropriate for optional UX; do not silently degrade a legally required step such as tax calculation or payment authorization—those need hard failure or compensating control. Operational check: inject a timeout or 5xx on the recommendations endpoint in a staging environment and verify checkout still returns 200 with an empty or cached suggestions payload while metrics show the recommendations circuit open.