POST /payments must not charge a customer twice, even if the client retries and even if two retries arrive at the same moment. Design it.
Answer it out loud before you open anything. The value of the flags below is in comparing them to what you actually said.
The situation behind the question
A mobile client on a flaky network. It sends a payment, sees a timeout, and retries — while the first request is still in flight and about to succeed.
What it is really testing
Whether the candidate can state the property precisely and then defend it against concurrency. Almost everyone says "idempotency key". The discriminator is what the key is used for, what is stored under it, when it is written relative to the work, and what happens to the second request that arrives before the first one finishes.