WAF and bot detection
Design a WAF and bot-detection system fronting an e-commerce platform that sees 3M requests/sec, including aggressive scrapers, inventory-hoarding bots, and credential-stuffing attacks. It must block malicious traffic inline with <5ms added latency, distinguish sophisticated headless-browser bots from real shoppers, and avoid blocking legitimate users (false positives cost revenue). Cover the inline filtering pipeline, the signals you use to score traffic, and the precision-vs-recall trade-off.
What a strong answer looks like
Clarify scale and constraints first. Propose a clean component breakdown, then go deep on the hard parts (data model, bottlenecks, consistency, failure modes) and name the trade-offs you are making.
Clarify5:30 left
Estimate5:30 planned
Design16:30 planned
Deep dive13:30 planned
Failure9:00 planned
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.