Interview question

You mentioned Kafka Streams for computing trade volumes, averages, and detecting anomalies in real time. Can you describe how you would structure that aggregation specifically? What kind of time window would you use and why?