A public API is exposed straight to the internet through a load balancer, with no filtering. Malicious traffic — bad IPs, SQL-injection probes, and L7 floods — reaches the API tier and consumes capacity. Add a protective edge layer.
A WAF/firewall at the edge inspects and filters traffic before it reaches the application — blocking bad IPs, known injection patterns, and L7 floods. Placed in front of the load balancer, it drops malicious requests before they consume any backend capacity. It complements, rather than replaces, authentication and per-endpoint authorization deeper in the stack.
Evaluation criteria and weights will be revealed after you submit your solution. This ensures a fair assessment of your design skills.
Draw your architecture diagram, explain your design decisions, and get AI-powered feedback.
For the best experience, design challenges on a desktop or tablet — drawing the architecture on a phone is hard.