Design Malware Scanning - System Design | WinJob

Problem Statement: Multi-Tenant Malware Scanning

Interview prompt: Design Malware Scanning for a VirusTotal/CrowdStrike-class platform. Objects arrive from uploads, email gateways, and partner APIs. The platform must hash, queue, scan with multiple engines, quarantine malicious payloads, and emit auditable verdicts before any downstream system serves bytes to users.

Why interviewers ask this

Upload paths are the number-one malware entry vector. A credible answer separates control plane (policies, tenants, appeals) from data plane (bytes in quarantine, ephemeral sandboxes). You must explain consensus across engines, how you avoid serving files while status is PENDING, and how signature feed lag is surfaced—not hidden.

Personas

Security engineer tunes YARA packs and engine weights. Application owner integrates scan callbacks into product flows. SOC analyst triages SUSPICIOUS verdicts and campaigns.

Invariants (state these early)

No download or share link activation until verdict=CLEAN (or explicit risk-accepted override with audit).
Quarantine objects are encrypted per-tenant; analysts access via gated sample vault.
Scan jobs are idempotent on (tenant_id, content_sha256, policy_version).

Section-specific depth (order 1)

Section 1 note 1: platform scope — Ingest API invariant for tenant 4.
Section 1 note 2: platform scope — Scan queue invariant for tenant 5.
Section 1 note 3: platform scope — Verdict store invariant for tenant 6.
Section 1 note 4: platform scope — SOC console invariant for tenant 7.
Section 1 note 5: platform scope — Uploader invariant for tenant 8.
Section 1 note 6: platform scope — Ingest API invariant for tenant 9.
Section 1 note 7: platform scope — Scan queue invariant for tenant 10.
Section 1 note 8: platform scope — Verdict store invariant for tenant 11.
Section 1 note 9: platform scope — SOC console invariant for tenant 12.
Section 1 note 10: platform scope — Uploader invariant for tenant 13.
Section 1 note 11: platform scope — Ingest API invariant for tenant 14.
Section 1 note 12: platform scope — Scan queue invariant for tenant 15.

javaOne Dark Pro

1 public record ScanContext(String tenantId, String sha256, int policyVersion) {}

pythonOne Dark Pro

1 @dataclass(frozen=True)
2 class ScanContext:
3     tenant_id: str
4     sha256: str
5     policy_version: int

typescriptOne Dark Pro

1 export interface ScanContext {
2   tenantId: string;
3   sha256: string;
4   policyVersion: number;
5 }

Why interviewers care

Malware Scanning interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement: Multi-Tenant Malware Scanning that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Uploader is a first-class component
•Verdict path must stay auditable for platform scope
•Tenant isolation applies to Ingest API and storage

1	@dataclass(frozen=True)
2	class ScanContext:
3	tenant_id: str
4	sha256: str
5	policy_version: int

1	export interface ScanContext {
2	tenantId: string;
3	sha256: string;
4	policyVersion: number;
5	}