← SOTI Inc. Interview Insights

SOTI Inc.·Software Engineer·Onsite - Cross-functional / Panel·Intermediate

Intermediate
Jun 2026

Summary

Second round at SOTI for a Software Engineer role, panel format with two Architects each throwing one question at you. The whole thing was an hour and pretty technically focused.

Questions Asked (1)

Q1

Design an API that functions like an IP firewall blacklist.

System DesignAPI & IntegrationsTechnical Trade-offs
Author's notes

The core of this was really a cache design problem dressed up as an API question.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements: is this a standalone service or a library? What scale (requests per second, number of IPs)? Then outline the core components: data store for blacklist, API endpoints for CRUD operations, and integration points (e.g., middleware). Finally, discuss trade-offs like consistency vs. availability, and how to handle high throughput.

Pro tip: Emphasize idempotency and caching: blacklist checks are read-heavy, so use an in-memory cache with TTL and ensure that adding/removing IPs is idempotent to avoid race conditions.

1. Clarify Requirements and Scope

Ask about expected scale (QPS, number of IPs), consistency needs, and integration (e.g., as a sidecar, middleware, or external service). This shows you avoid over-engineering.

2. Design the Data Model and Storage

Choose a storage solution (e.g., Redis for speed, SQL for durability) and define the schema: IP (or CIDR), reason, expiration, created_at. Consider indexing for fast lookups.

3. Define API Endpoints and Semantics

Design RESTful endpoints: POST /blacklist (add), DELETE /blacklist/{ip} (remove), GET /blacklist/{ip} (check), GET /blacklist (list). Specify request/response formats, status codes, and idempotency.

4. Address Performance and Scalability

Discuss caching (e.g., local cache with invalidation), sharding, and read replicas. For high throughput, consider a bloom filter for quick negative checks, but note false positives.

5. Handle Edge Cases and Trade-offs

Cover IP ranges (CIDR), IPv6, expiration/TTL, bulk operations, and consistency vs. availability. Explain how to handle failures (e.g., fallback to allow if cache is down).

Key Points to Mention

  • Idempotency of add/remove operations to prevent duplicate entries or race conditions.
  • Caching strategy: local in-memory cache with TTL and pub/sub for invalidation across instances.
  • Support for CIDR ranges and IPv6, not just single IPs.
  • API security: authentication/authorization to prevent unauthorized blacklist modifications.
  • Monitoring and auditing: log all changes and provide metrics on blacklist size and hit rate.
  • Trade-offs: strong consistency vs. eventual consistency; bloom filters for memory efficiency vs. false positives.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.