Which design type is this question?

It is a security system question. You design two-factor authentication and explain your choices the way you would in an interview.

Is this question asked at entry level?

It is marked Easy, so it suits engineers who are new to security system interviews. It is also a good warm-up before harder questions.

What should I cover first?

Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.

Can I practise it for free?

It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.

Design two-factor authentication

PremiumSecurity systemEasy

TOTP
RFC 6238
MFA

Quick answer

This security system interview question asks you to design two-factor authentication. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.

The problem

Design two-factor authentication (2FA) for a consumer marketplace app, like the authenticator-code step many apps show after the password. Users enrol an authenticator app, SMS or recovery codes. The hard parts are stopping code guessing and replay, and recovering accounts without opening a back door.

The app already has email and password login with sessions. Account takeovers from reused passwords are rising, so 2FA becomes optional for every user and required for sellers who receive payouts.

What must the system do?

Enrol an authenticator app: Show a QR code with a new secret, and turn 2FA on only after the user types one valid code.
Check at login: After a correct password, ask for a code before creating a full session.

4 more requirementsUnlock to see all

How well must it do it?

Guessing resistance: An attacker who knows the password must have under a 1 in 1,000 chance of passing 2FA in 30 days of trying.
Secret safety: A copy of the database alone must not reveal any TOTP secret.

2 more requirementsUnlock to see all

What scale should you design for?

Use these numbers in your estimates.

The scale numbers unlock with this questionUnlock

Key concepts

TOTP
RFC 6238
MFA
SMS OTP
Recovery codes
Rate limiting

How you’ll practise

6 short steps · save and come back any time

Requirements and assets
Threat model
Identity and access
Data protection
Detection and response
Wrap-up

Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.

What do interviewers look for?

In any security system design round.

Starts with a clear threat model
Layers defences instead of relying on one control
Covers authentication, authorisation and secrets
Plans detection, alerting and response
Protects data in transit and at rest
Balances security against usability and cost

Questions people ask about this interview question

Which design type is this question?: It is a security system question. You design two-factor authentication and explain your choices the way you would in an interview.
Is this question asked at entry level?: It is marked Easy, so it suits engineers who are new to security system interviews. It is also a good warm-up before harder questions.
What should I cover first?: Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
Can I practise it for free?: It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.

The problem

What must the system do?

How well must it do it?

What scale should you design for?

Key concepts

How you’ll practise

What do interviewers look for?

Questions people ask about this interview question

Related questions