Design a Cloud Vulnerability Scanner
Last updated: December 9, 2025
Quick Overview
Design an agentless system that continuously scans cloud environments across AWS, Azure, and GCP for vulnerabilities, misconfigurations, and compliance violations at scale.
Wiz
December 9, 202515
4
1,602 solved
Design an agentless system that continuously scans cloud environments across AWS, Azure, and GCP for vulnerabilities, misconfigurations, and compliance violations at scale.
Wiz's core product is an agentless cloud security platform that scans millions of resources across multi-cloud environments. System design questions at Wiz expect candidates to think about security, multi-tenancy, and scale from the start. The interviewer wants to see you proactively address data isolation, encryption, and least privilege access.
What the Interviewer Expects
- Design a multi-cloud connector architecture that abstracts provider-specific APIs
- Address scan scheduling, prioritization, and rate limiting per tenant
- Explain data isolation and encryption strategies for multi-tenant scan results
- Discuss how to correlate findings across different resource types and cloud providers
- Handle scale challenges of scanning millions of resources with acceptable latency
Key Topics to Cover
How to Approach This
- Start by clarifying functional and non-functional requirements with the interviewer.
- Estimate the scale: QPS, storage, bandwidth. This drives your design decisions.
- Draw a high-level architecture first, then deep dive into 1-2 critical components.
- Discuss trade-offs explicitly (e.g., consistency vs availability, SQL vs NoSQL).
- Address failure scenarios, monitoring, and how the system handles 10x traffic spikes.
Possible Follow-up Questions
- How would you handle a cloud provider API rate limit during a large scan?
- What happens if a scan fails midway through? How do you ensure consistency?
- How would you prioritize which resources to scan first for a new customer onboarding?
- How do you handle the security of stored scan credentials?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice System Design ProblemsSample Answer
Requirements
- Functional Requirements:
- Continuous, agentless scanning of resources across AWS, Azure, and GCP.
- Detection of vulnerabilities, misconfigurations, and compliance violations.
- Multi-ten...
Capacity Estimation
To estimate capacity, let's consider the following:
- Assumptions:
- Each cloud provider (AWS, Azure, GCP) has approximately 1 million resources scanned.
- Each scan takes an average of 5 sec...
Submit Your Answer
