System design for cybersecurity services

Compare forward, reverse, and transparent proxy architectures and identify their use cases in security products.

Design a generic rule/policy engine supporting pattern matching, rule chaining, and priority-based evaluation.

Contrast inline (synchronous) vs. out-of-band (asynchronous) analysis, evaluating their latency and security trade-offs.

Compare agent-based vs. agentless architectures for security data collection, identifying deployment and visibility trade-offs.

Evaluate fail-open vs. fail-close strategies for inline security products and their availability implications.

Design the collection and transport layer of a security telemetry pipeline, addressing backpressure, buffering, and delivery guarantees.

Design a security event processing pipeline for normalization, enrichment with threat intelligence, and routing to consumers like SIEMs.

Analyze multi-tenant isolation trade-offs in security products across data, configuration, and performance dimensions.

Architect the data flow and component placement for reverse proxy, transparent bridge, and cloud-hosted WAF deployment modes.

Evaluate trade-offs across WAF deployment modes for different enterprise use cases and threat models.

Design the request interception and parsing component of a reverse-proxy WAF, including HTTP connection handling and request normalization.

Design a modular inspection pipeline that chains multiple security modules (e.g., signature, anomaly) with configurable execution order.

Architect a signature-based detection engine, including rule storage strategies and string matching algorithm selection (e.g., Aho-Corasick).

Design performance optimization strategies for a signature engine, such as caching, rule compilation, and hardware acceleration.

Design an anomaly scoring engine that combines multiple weak signals into a cumulative risk score for a request.

Design a session tracking system for stateful WAF inspection and multi-request attack correlation.

Architect a global traffic ingestion system for DDoS mitigation using BGP anycast and distributed scrubbing centers.

Design detection mechanisms for common Layer 3/4 DDoS attack vectors such as SYN and UDP floods.

Design a SYN proxy and flow analysis system for mitigating Layer 3/4 attacks while preserving legitimate connections.

Design Layer 7 DDoS detection using behavioral baselining and adaptive rate limiting to distinguish floods from legitimate traffic.

Architect a multi-layer traffic scrubbing pipeline that sequences inspection stages and fast-paths clean traffic.

Compare rate limiting algorithms (e.g., token bucket, leaky bucket) and select appropriate ones for different attack profiles.

Design mechanisms for returning cleaned traffic to origin servers, considering latency, security, and protocol transparency.

Evaluate trade-offs between always-on vs. on-demand DDoS mitigation and design reactive auto-scaling mechanisms.

Design a data collection pipeline for an IP reputation system using honeypots, threat intelligence feeds, and application logs.

Design a scoring model and low-latency, real-time lookup architecture for an IP reputation system.

Design passive device fingerprinting techniques using TLS and HTTP header analysis.

Design active device fingerprinting using JavaScript-based challenges and evaluate advanced techniques like canvas fingerprinting.

Design a telemetry collection system for behavioral analysis, efficiently capturing user interactions like mouse movements and keystrokes.

Design a feature engineering pipeline and compare heuristic vs. ML-based approaches for behavioral bot detection.

Compare challenge mechanisms (e.g., CAPTCHA, proof-of-work) and design risk-based escalation logic to apply them.

Design a bot classification and adaptive response system that synthesizes detection signals into verdicts and enforces actions.

Design the user store for an Identity Provider (IdP), covering data modeling, secure credential storage, and scaling strategies.

Architect the credential verification flow, including password hashing, MFA integration, and timing attack protection.

Design a session management system, comparing stateful (session ID) vs. stateless (JWT) approaches for secure issuance, validation, and revocation.

Design the SAML assertion generation process, including attribute mapping and XML digital signature creation.

Design the SAML assertion validation process, including signature verification, timestamp checks, and audience restriction enforcement.

Design the core architecture of an OAuth 2.0 authorization server, handling Authorization Code and Client Credentials grant flows.

Design the token issuance and validation pipeline for an OAuth 2.0 server, including JWT structure, signing, and public key distribution.

Design scope and consent management within an OAuth 2.0 authorization server.

Design the OIDC layer on top of OAuth 2.0, including ID token generation, claims management, and the UserInfo endpoint.

Design advanced session management for federated identity, including single sign-on/sign-off and channel-bound tokens.

Compare RBAC and ABAC policy models and design their data structures for efficient evaluation.

Architect a low-latency policy evaluation engine for authorization, including caching and distribution strategies.

Design token caching and session replication strategies for a highly available, distributed identity system.

Design a high-throughput audit logging pipeline for critical identity events to support security investigations.

Design an anomaly detection system that consumes identity audit logs to identify suspicious behavior like impossible travel.

Architect a cross-region federation model for a global identity platform to handle data residency and latency.

Design the end-to-end connection flow for a ZTNA service, contrasting the data and control planes with a traditional VPN architecture.

Design the ZTNA policy engine, showing how it integrates identity and device signals into a dynamic trust score for access decisions.

Design the architecture of ZTNA connectors, focusing on outbound-only connectivity and secure registration with the control plane.

Design the reverse proxy and secure tunnel establishment for the ZTNA data plane, evaluating protocol trade-offs (e.g., TLS vs. WireGuard).

Design a device posture assessment system, including agent health checks, a signal collection pipeline, and compliance scoring.

Design a continuous authentication mechanism involving session risk scoring and real-time policy re-evaluation on signal changes.

Design a micro-segmentation enforcement model for ZTNA using identity-aware proxies and dynamic network policies.

Architect for high availability and observability in a distributed ZTNA solution, considering connector placement and key metrics.

Design the high-level architecture of a scan orchestration engine for target management, scheduling, and distributed worker management.

Compare SYN, connect, and UDP port scanning techniques, analyzing their network mechanisms and stealth trade-offs.

Design a modular port scanning engine with parallelism, state management, and timeout handling.

Design a service detection and version identification engine using banner grabbing and probe-response matching.

Design the data model and ingestion pipeline for a vulnerability knowledge base from sources like the NVD.

Design a system for versioning and distributing vulnerability signature updates to distributed scanners.

Architect a vulnerability matching engine that correlates discovered services and versions against the knowledge base.

Design authenticated scanning capabilities, including secure credential storage and privilege management for deep host inspection.

Design the system architecture of a SAST pipeline, from code ingestion and language parsing to intermediate representation (e.g., AST/CFG).

Architect a rule-based and taint analysis engine for SAST, focusing on how rules are applied to the intermediate representation.

Design a DAST crawling engine capable of link discovery, SPA handling, and authenticated attack surface mapping.

Design a DAST fuzzing engine, comparing mutation-based and generation-based approaches for test case generation.

Design a Software Composition Analysis (SCA) engine, including dependency tree resolution and vulnerability correlation via version matching.

Design a findings management system for AST tools, including deduplication, severity scoring, and integration with bug trackers.

Evaluate the architectural trade-offs across SAST, DAST, and SCA regarding coverage, accuracy, and CI/CD integration speed.

Architect a multi-cloud abstraction layer to normalize resource representations across AWS, Azure, and GCP.

Design a cloud resource discovery system, comparing polling vs. event-driven approaches via cloud provider APIs.

Design the core evaluation logic of a policy engine that runs rules against discovered cloud resource configurations.

Architect a rule authoring subsystem and a process for mapping rules to external benchmarks like CIS.

Design a compliance mapping system that links CSPM findings to regulatory frameworks such as SOC 2 and PCI-DSS.

Design a drift detection system to track configuration changes over time and trigger alerts on policy violations.

Design a findings pipeline including severity classification, notification routing, and a secure auto-remediation framework.

Architect CSPM data storage using a graph-based model to represent resource relationships and enable attack path analysis.

Architect RASP instrumentation approaches, comparing bytecode modification, language-level hooks, and library interposition.

Design a runtime context capture system to collect data like HTTP parameters and SQL queries via instrumented hooks.

Design a vulnerability detection engine that analyzes captured runtime context for threats like SQL injection and command injection.

Design a RASP agent for minimal performance overhead using selective instrumentation, sampling, and caching strategies.

Design the data output and integration points for a RASP agent to interoperate with SIEM and WAF systems.

Compare RASP vs. WAF architectures, evaluating the trade-offs between inline app-level vs. network-level protection.

Design a centralized management console for configuring RASP policies and deploying them to a fleet of agents.

Architect a unified security platform at the network edge, integrating WAF, Bot Management, and DDoS mitigation.

Design a system for distributing security policies to global edge nodes, addressing consistency and latency.

Architect a distributed logging pipeline for a CDN edge network, focusing on high-throughput collection and centralized aggregation.

Design a metrics aggregation and real-time alerting system that integrates data from distributed edge nodes.

Design edge-to-origin security mechanisms, including mutual TLS, origin IP concealment, and connection pooling.

Compare DNS-based vs. anycast-based traffic steering for routing requests to the nearest edge PoP.

Design a system for orchestrating security responses across multiple layers (e.g., blocking an IP at the DDoS layer based on a WAF signal).