Design Data Loss Prevention - System Design | WinJob

Problem Statement and DLP Mission

Design an enterprise Data Loss Prevention platform (Symantec / Microsoft Purview / McAfee class) for section 1: problem statement and dlp mission.

Design anchors (1)

Separate policy authoring (classification, rules, exceptions) from enforcement (inline inspection, quarantine, encrypt) so legal can iterate without redeploying edge agents.
Treat false-positive budget as an SLO: block actions must stay below help-desk capacity; monitor-only policies absorb noisy detectors.
Never persist full content for monitor-only hits—store fingerprints, hashes, and redacted snippets only.

Mechanism

Enterprise DLP watches data-in-motion (email, web, APIs) and data-at-rest (SharePoint, S3, laptops). A central policy service compiles rules; enforcement points stream metadata to an incident bus while applying allow/block/quarantine/encrypt actions inline.

Failure drills

If policy CDN is stale >5 minutes, inspectors pin last-good bundle and raise Sev2—never fail-open on PCI tier. If Kafka lag >90s, shed monitor-only metadata first, then sample 1% duplicates. If quarantine KMS throttles, queue encrypted uploads with backpressure and page crypto ops. If classifier GPU pool saturated, bypass ML for monitor-only policies and alert detection engineering.

Cost and capacity

Right-size Protected users at 850K before adding ML GPUs—regex/EDM dominate SMTP CPU. Chargeback tenants on inspected GB and blocked incident volume.

Signal	Target
Protected users	850K
Inspection events/day	4.2B
Policy eval p95	120ms
Block SLA	99.9%

javaOne Dark Pro

1 public record PolicyDecision(String policyId, Action action, String contentHash) {
2   public enum Action { ALLOW, MONITOR, QUARANTINE, BLOCK, ENCRYPT }
3 }

pythonOne Dark Pro

1 def should_sample(event_id: str, rate: float = 0.01) -> bool:
2     return (hash(event_id) % 10_000) < int(rate * 10_000)

typescriptOne Dark Pro

1 export type DlpAction = "ALLOW" | "MONITOR" | "QUARANTINE" | "BLOCK" | "ENCRYPT";
2 export interface PolicyHit { policyId: string; action: DlpAction; fingerprint: string; }

Why interviewers care

Data Loss Prevention interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement and DLP Mission that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Separate policy authoring (classification, rules, exceptions) from enforcement (
•Metrics: Protected users, Inspection events/day, Policy eval p95, Block SLA
•Enterprise DLP watches data-in-motion (email, web, APIs) and data-at-res

1	public record PolicyDecision(String policyId, Action action, String contentHash) {
2	public enum Action { ALLOW, MONITOR, QUARANTINE, BLOCK, ENCRYPT }
3	}

1	def should_sample(event_id: str, rate: float = 0.01) -> bool:
2	return (hash(event_id) % 10_000) < int(rate * 10_000)

1	export type DlpAction = "ALLOW" \| "MONITOR" \| "QUARANTINE" \| "BLOCK" \| "ENCRYPT";
2	export interface PolicyHit { policyId: string; action: DlpAction; fingerprint: string; }