How the interviewer opens it
“Design a VPN service with gateways in several regions. Clients use encrypted tunnels to reach the internet. Support high throughput, gateway failure recovery, and secure key changes.”
The prompt is vague on purpose. The first minutes are for you. Reduce the prompt to the core features and agree on the numbers before you draw.
What to clarify first
- Client behavior
- Geographic scale
- Traffic volume
- Gateway capacity
- API traffic
- Response times
- Failure behavior
- Access consistency
- Key policy
- Durability and scope
The interviewer has the answers. In a SysRound round, Alex gives these answers, as a real interviewer does.
Scope of a strong answer
Core requirements
- Establish an encrypted tunnel to a regional gateway
- Route IPv4, IPv6, and DNS traffic through the tunnel
- Restore VPN access after a gateway fails
- Rotate tunnel keys and revoke device access
Usually out of scope
- Design a new cryptographic protocol
- Preserve open connections across gateway failure
- Connect private networks to each other
- Inspect or store user payloads
- Guarantee access to geographically restricted content
What interviewers ask about
- Traffic through a gateway
- Encryption, packet rate, and NAT state can limit capacity before network bandwidth does. IPv4 and IPv6 need correct return paths.
- When a gateway fails
- A failed gateway can break tunnels, return routes, and DNS access. A client must restore both IP families without exposing application traffic.
- Changes to keys and access
- Traffic keys and identity keys have different roles. Old sessions and stale authorization can preserve access after a key compromise.
Common mistakes
- Treats the VPN as an ordinary HTTP proxy and ignores IP packets.
- Sizes gateways from bandwidth alone and ignores packet rate and NAT ports.
- Promises seamless gateway failure recovery without preserving connection state.
- Blocks IPv6 during normal service or lets DNS or IPv6 traffic bypass a failed tunnel.
- Confuses traffic-key changes with identity replacement and device revocation.
- Requires fast revocation but lets gateways trust stale authorization without a time limit.
The bar by level
- Senior (L5/E5)
- Calculates gateway capacity and spare capacity. Defines failure detection, leak prevention for both IP families, device isolation, identity replacement, and bounded revocation during an outage.
- Staff (L6+/E6+)
- Defines capacity and authorization invariants across regions. Resolves stale-policy risks, correlated retry bursts, and partial failures. Explains when continuity conflicts with security or connection preservation.
Sources · 1 reference
These records explain where the question appears. A company tag or candidate report does not guarantee a future interview question.
SysRound · 1 record
No company association
Design a VPN service
Reported date not specified
Source snapshot: Nov 12, 2026
View source