Design malicious IP blocking at an API gateway
PremiumSecurity systemHard
- IP blocklist
- API gateway
- Detection vs enforcement
Quick answer
This security system interview question asks you to design malicious IP blocking at an API gateway. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design malicious IP blocking at an API gateway: the system that spots abusive client IPs and blocks them at the edge of a public API, first on one gateway fleet and then across every data center. The hard parts are keeping detection separate from enforcement and not blocking real users who share an IP.
A credential-stuffing run hits the login endpoint from 40,000 IPs at 3 requests per minute each, while a mobile carrier sends 8,000 real users through one NAT address. The design must stop the first and keep the second working. Detection decides which IPs are bad; the gateway only looks up a local list and applies the action it is told.
What must the system do?
- Separate detection and enforcement: A detection service scores IPs from gateway signals; gateways only apply decisions from a signed local list, so detection can fail without stopping traffic.
- Graduated actions: Each entry has an action (rate limit, challenge, block), a scope (one route class or all routes) and an expiry; no entry is permanent by default.
How well must it do it?
- Latency: The lookup adds at most 1 ms at p99 to a request; the gateway never calls a remote service in the request path.
- Propagation: A new entry is enforced in its own data center within 2 seconds and in every data center within 10 seconds at p99.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- IP blocklist
- API gateway
- Detection vs enforcement
- Carrier grade NAT
- False positives
- Credential stuffing
How you’ll practise
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design malicious IP blocking at an API gateway and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Hard. It suits engineers preparing for senior interviews, where you are expected to drive the discussion and go deep on trade-offs.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team