Design a DDoS protection system
PremiumSecurity systemMedium
- Anycast
- SYN cookies
- XDP
Quick answer
This security system interview question asks you to design a DDoS protection system. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design a DDoS protection system for a network in front of customer websites, APIs and game servers, like the protection services large CDNs run. It must absorb floods of several terabits per second and keep serving real users. The hard parts are telling an attack from a real traffic spike and stopping it within seconds without blocking customers.
Attacks come in three shapes: volumetric floods (often reflected and amplified UDP), protocol attacks such as SYN floods that exhaust connection state, and HTTP floods that look like real page loads from hundreds of thousands of infected devices. Mitigation must start on its own; people review and tune it.
What must a DDoS protection system do?
- Absorb floods: Drop volumetric and protocol attack traffic at the edge while forwarding real traffic to customer origins.
- Automatic mitigation: Detect an attack on any customer IP or hostname and start filtering within 10 seconds, with no human in the loop.
How well must it do it?
- Time to mitigate: Detection within 3 seconds and filtering live within 10 seconds of an attack starting.
- Collateral damage: Under 0.1% of legitimate requests dropped or challenged during a mitigated attack.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- Anycast
- SYN cookies
- XDP
- BGP
- Traffic scrubbing
- Rate limiting
How you’ll practise
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design a DDoS protection system and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Medium. Entry-level engineers can practise it, but it expects you to reason about requirements and trade-offs, not only list components.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team