Question presented to candidate: "A money-transfer function updates the sender's balance, then the receiver's balance, in two separate queries. If the second query fails after the first one already succeeded, what state is your database left in — and separately, under load, your app starts throwing 'connection pool exhausted' errors even though traffic hasn't actually grown. What's the connection between these two problems?"
What a strong answer should cover:
- Without a transaction, the prompt's exact first scenario is a real risk: the first query's change persists even if the second query genuinely fails — a real, partial, inconsistent state (money debited from the sender, never credited to the receiver).
- 📌 Verified, not assumed — the direct fix: a real transaction (
BEGIN...COMMIT/ROLLBACK), given a transfer that genuinely fails partway through (after the firstUPDATEalready ran), genuinely rolled back — the account balance was confirmed completely unchanged afterward, not partially debited. A separate, successful transfer genuinely committed, moving real balance between two real rows. - 📌 Interview term: atomicity — a transaction makes multiple statements behave as one indivisible unit: either all of them take effect, or none do — verified directly above, the failed transfer's first, already-executed
UPDATEwas genuinely undone by the rollback, not left in place. - The prompt's second scenario — connection pool exhaustion with no real traffic growth — is a connection leak: code that acquires a connection from a pool but never releases it back, typically via an early return or an unhandled error skipping the release step. 📌 Verified, not assumed: a real pool of size 3, given 3 "leaky" queries that never released their connections, genuinely exhausted — a real 4th request got a genuine "pool exhausted" result. The identical pool, using
try/finallyto always release (even when the query genuinely throws), genuinely stayed fully available across 5 real alternating success/failure queries. - The direct connection between the prompt's two scenarios: both are fixed by the identical underlying discipline — genuinely guaranteeing cleanup (a commit/rollback, a connection release) happens on every code path, including error paths, typically via
try/finallyor an equivalent scoped-resource pattern — verified directly above for the connection-release half, and structurally identical to why a transaction's rollback path must genuinely run on any failure, not just the happy path.
Clarifying questions expected:
- "Is the multi-step update (debit then credit) already wrapped in a real transaction, or are the two queries currently independent?" — the prompt's first scenario is unsafe by default unless a transaction genuinely wraps both statements.
- "Is connection release currently handled via try/finally (or an equivalent guaranteed-cleanup pattern) on every code path, including early returns and thrown errors?" — the single most common real cause of the pool-exhaustion scenario.
Code / implementation expected: Yes — a real transaction genuinely rolling back a partial failure (confirmed by an unchanged balance), and a real connection pool genuinely exhausting from leaked connections vs. staying healthy with guaranteed release, is the concrete, convincing proof of both halves of the prompt.