SevyDevy

Design a CAPTCHA verification system

FreeSecurity systemEasy

  • Beginner
  • System design
  • Security

Quick answer

This security system interview question asks you to design a CAPTCHA verification system. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.

The problem

Design a CAPTCHA verification system that creates human-verification challenges and validates user responses to reduce bot abuse.

What must a CAPTCHA verification system do?

  • Generate CAPTCHA challenges for risky user actions.
  • Support visual CAPTCHA challenges.
  • Support audio CAPTCHA alternatives for accessibility.
  • Validate user responses on the server side.
  • Expire challenges after a short duration.
  • Prevent the same challenge from being reused.
  • Allow limited retries for failed attempts.
  • Integrate with signup, login, password reset, and form submission flows.

How well must it do it?

  • Challenge generation and validation should be low latency.
  • The system should scale for high authentication and form traffic.
  • Challenges should be difficult for bots but reasonable for humans.
  • The system should support accessibility requirements.
  • The system should prevent brute-force attempts and replay attacks.
  • The system should avoid exposing answers to the client.
  • The system should remain available during traffic spikes or bot attacks.

What scale should you design for?

Use these numbers in your estimates.

AssumptionEstimate CAPTCHA requests per second from login, signup, and form traffic
AssumptionPeak traffic may be 3x to 10x average traffic during attacks
AssumptionChallenge storage is short-lived and depends on active challenge count
AssumptionBandwidth depends on challenge type, image size, audio size, and retry rate
AssumptionValidation traffic is usually close to challenge generation traffic
AssumptionAudio challenges may require more storage and bandwidth than image challenges

Key concepts

  • Beginner
  • System design
  • Security
  • Authentication
  • CAPTCHA
  • Bot prevention

How you’ll practise

6 short steps · save and come back any time
  1. Requirements and assets
  2. Threat model
  3. Identity and access
  4. Data protection
  5. Detection and response
  6. Wrap-up

Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.

What do interviewers look for?

In any security system design round.

  • Starts with a clear threat model
  • Layers defences instead of relying on one control
  • Covers authentication, authorisation and secrets
  • Plans detection, alerting and response
  • Protects data in transit and at rest
  • Balances security against usability and cost

Questions people ask about this interview question

Which design type is this question?
It is a security system question. You design a CAPTCHA verification system and explain your choices the way you would in an interview.
Is this question asked at entry level?
It is marked Easy, so it suits engineers who are new to security system interviews. It is also a good warm-up before harder questions.
What should I cover first?
Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
Can I practise it for free?
Yes. It is one of the free questions. Sign up to practise it step by step. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.

Related questions

Updated · Written by the SevyDevy team

Free questionGuided steps, hints, AI review