Mastering System Design: From Foundations to Advanced Architecture

A structured roadmap for mastering system design, covering architecture fundamentals, scalability, API design, databases, networking, security, and distributed systems. This guide is intended for developers transitioning from mid-level to senior engineering roles.

---

1. Importance of System Design Skills

System design is one of the biggest differentiators between a mid-level and senior software engineer.

A senior engineer is expected to:

• Design systems from scratch.
• Handle incomplete or ambiguous requirements.
• Make architectural trade-offs.
• Design scalable, reliable, and maintainable applications.
• Optimize performance, cost, and user experience.
• Own technical decisions across the product.

Key Insight

Companies hire senior engineers not only for coding skills but also for making architectural decisions that directly impact business success.

---

2. Starting with a Single Server Architecture

Every scalable system begins with a simple architecture.

Architecture

Users
   │
 DNS
   │
Internet
   │
Single Server
 ├── Web Application
 ├── API
 ├── Database
 └── Cache

The server hosts:

• Frontend application
• Backend APIs
• Database
• Cache

Request Flow

1. User enters a domain name.
2. DNS resolves the domain into an IP address.
3. Browser sends an HTTP request.
4. Server processes the request.
5. Server returns:
   • HTML (Web)
   • JSON (Mobile/API)

Example:

GET /products/100

Response

{
  "id": 100,
  "name": "Laptop",
  "price": 65000
}

Advantages

• Easy to build
• Easy to understand
• Minimal infrastructure
• Perfect for MVPs and small products

Limitations

• Single point of failure
• Limited hardware resources
• Difficult to scale

---

3. Scaling Strategies

3.1 Vertical Scaling (Scale-Up)

Increase the resources of one server.

Examples:

• More RAM
• More CPU
• Faster SSD

Advantages

• Very simple
• No application changes

Disadvantages

• Hardware limit
• Expensive
• Single point of failure

---

3.2 Horizontal Scaling (Scale-Out)

Instead of upgrading one server, add multiple servers.

          Load Balancer
          /     |      \
       App1   App2   App3

Advantages

• High availability
• Fault tolerance
• Easy expansion
• Better performance

Disadvantages

• Infrastructure becomes more complex
• Requires load balancing
• Session management becomes harder

---

4. Load Balancing

A load balancer distributes incoming requests across multiple servers.

Users
   │
Load Balancer
 ├── Server A
 ├── Server B
 └── Server C

Common Algorithms

Algorithm	Description	Best Use Case
Round Robin	Sequential request distribution	Equal server capacity
Least Connections	Sends request to least busy server	Long-running sessions
Least Response Time	Chooses fastest server	Mixed server performance
IP Hash	Same IP goes to same server	Session affinity
Weighted Round Robin	More requests to stronger servers	Different hardware capacities
Geographic Routing	Routes users to nearest region	Global applications
Consistent Hashing	Maps clients consistently to servers	Distributed caching

Health Checks

Load balancers continuously monitor server health.

If a server fails:

• Stop routing traffic
• Redirect requests to healthy servers

This improves system availability.

---

5. Database Selection

There are two major database categories.

• SQL (Relational)
• NoSQL (Non-Relational)

---

5.1 SQL Databases

Examples

• PostgreSQL
• MySQL
• Oracle
• SQLite

Characteristics

• Tables
• Rows
• Columns
• SQL queries
• ACID transactions

Best suited for:

• Banking
• E-commerce
• ERP
• Financial applications

Advantages

• Strong consistency
• Complex joins
• Mature ecosystem

Disadvantages

• Harder horizontal scaling
• Fixed schema

---

5.2 NoSQL Databases

Designed for flexibility and scalability.

---

Document Database

Stores JSON-like documents.

Examples

• MongoDB

Best for:

• Content Management
• User Profiles
• Dynamic Data

---

Wide Column Database

Dynamic columns optimized for massive writes.

Examples

• Cassandra
• Cosmos DB

Best for:

• Analytics
• IoT
• Logging

---

Key-Value Store

Stores simple key-value pairs.

Examples

• Redis
• Memcached

Best for:

• Caching
• Sessions
• Leaderboards

---

Graph Database

Stores relationships.

Examples

• Neo4j
• Amazon Neptune

Best for:

• Social Networks
• Recommendation Systems
• Fraud Detection

---

SQL vs NoSQL

Requirement	SQL	NoSQL
Structured data	Yes	Limited
Complex joins	Excellent	Poor
ACID transactions	Excellent	Limited
Horizontal scaling	Moderate	Excellent
JSON documents	Limited	Excellent
Massive scalability	Moderate	Excellent

---

6. API Design

What is an API?

An API (Application Programming Interface) defines how software components communicate.

It acts as a contract between:

• Client
• Server

The client doesn't need to know how the server works internally.

---

7. API Styles

REST

Characteristics

• Stateless
• Resource-oriented
• HTTP methods
• Easy to understand

Example

GET /products
POST /products
PUT /products/1
DELETE /products/1

Best for

• Web Applications
• Mobile Apps
• Public APIs

---

GraphQL

Characteristics

• Single endpoint
• Client requests exactly the required data
• Eliminates over-fetching
• Eliminates under-fetching

Example

query {
  product(id: 1) {
    name
    price
  }
}

Best for

• Complex frontends
• Mobile apps
• Dashboards

---

gRPC

Characteristics

• Uses Protocol Buffers
• Built on HTTP/2
• Extremely fast
• Strongly typed

Best for

• Internal microservices
• High-performance systems

---

8. REST API Best Practices

Resource Naming

Use nouns.

Good

/products
/users
/orders

Avoid verbs.

Bad

/getProducts
/createUser

---

HTTP Methods

Method	Operation
GET	Read
POST	Create
PUT	Replace
PATCH	Partial Update
DELETE	Delete

---

Query Parameters

Filtering

GET /products?category=laptop

Sorting

GET /products?sort=price

Pagination

GET /products?page=2&limit=20

---

Versioning

/api/v1/users

/api/v2/users

Versioning maintains backward compatibility.

---

Status Codes

Code	Meaning
200	Success
201	Created
400	Bad Request
401	Unauthorized
403	Forbidden
404	Not Found
500	Internal Server Error

---

9. GraphQL Best Practices

• Keep schemas modular
• Limit query depth
• Avoid unnecessary nesting
• Use fragments
• Use pagination
• Implement caching

GraphQL always returns:

HTTP 200

Errors are included inside the response body.

---

10. Network Communication Protocols

HTTP / HTTPS

Foundation of REST and GraphQL APIs.

HTTPS uses:

• TLS
• SSL

to encrypt communication.

---

WebSockets

Persistent bidirectional connection.

Ideal for:

• Chat
• Live dashboards
• Multiplayer games
• Notifications

---

AMQP

Advanced Message Queuing Protocol.

Supports asynchronous communication.

Used by:

• RabbitMQ

Ideal for:

• Background jobs
• Event processing
• Messaging systems

---

gRPC

Uses:

• HTTP/2
• Protocol Buffers

Ideal for:

• Internal service communication
• Microservices

---

11. Transport Layer Protocols

TCP

Characteristics

• Reliable
• Ordered delivery
• Connection-oriented

Best for:

• Banking
• Emails
• Payments
• File transfers

---

UDP

Characteristics

• Fast
• No connection
• No delivery guarantee

Best for:

• Video streaming
• Voice calls
• Gaming
• Live broadcasts

---

TCP vs UDP

Feature	TCP	UDP
Reliable	Yes	No
Ordered Delivery	Yes	No
Speed	Moderate	Fast
Connection	Required	Not Required
Best For	Critical Data	Real-Time Applications

---

12. Security

Security consists of two major concepts.

• Authentication
• Authorization

---

13. Authentication

Authentication answers:

Who are you?

---

Basic Authentication

Uses:

• Username
• Password

Credentials are Base64 encoded.

Always use HTTPS.

---

Bearer Token

Client sends:

Authorization: Bearer <token>

Advantages

• Stateless
• Scalable
• Common in REST APIs

---

OAuth2 + JWT

Allows login using:

• Google
• GitHub
• Microsoft
• Facebook

JWT contains:

• User ID
• Roles
• Permissions
• Expiration

---

Access Token + Refresh Token

Access Token

• Short lifespan
• Used on every request

Refresh Token

• Long lifespan
• Generates new access tokens

Benefits

• Better security
• Better user experience

---

Single Sign-On (SSO)

User logs in once.

Access multiple applications without re-authentication.

Common protocols:

• OAuth2
• SAML

---

14. Authorization

Authorization answers:

What are you allowed to do?

---

Role-Based Access Control (RBAC)

Permissions are assigned through roles.

Example

Role	Permissions
Admin	Full Access
Editor	Read + Write
Viewer	Read Only

Examples

• GitHub
• CMS
• Admin Panels

---

Attribute-Based Access Control (ABAC)

Access depends on:

• User attributes
• Resource attributes
• Environment

Example

Department == HR

AND

Current Time < 6 PM

---

Access Control List (ACL)

Permissions are attached directly to resources.

Example

Google Drive

Document A

User A → Read

User B → Edit

User C → Owner

---

15. Learning Roadmap

A recommended progression for mastering system design.

Phase 1 — Foundations

• HTTP
• DNS
• TCP/IP
• Client-Server Architecture
• Databases
• APIs

---

Phase 2 — Backend Design

• REST APIs
• GraphQL
• Authentication
• Authorization
• Caching
• Database Design

---

Phase 3 — Scalability

• Load Balancers
• Horizontal Scaling
• Distributed Systems
• Message Queues
• Event-Driven Architecture
• Microservices

---

Phase 4 — Cloud Platforms

Learn one major cloud platform deeply.

Examples

• AWS
• Azure
• GCP

Topics

• Compute
• Storage
• Networking
• Containers
• Kubernetes
• Serverless

---

Phase 5 — Advanced System Design

• CAP Theorem
• Consistency Models
• Distributed Caching
• Sharding
• Replication
• Event Sourcing
• CQRS
• Service Discovery
• API Gateway
• Observability

---

Key Takeaways

• System design is a critical skill for senior software engineers.
• Begin with a simple single-server architecture before introducing distributed components.
• Scale vertically for simplicity and horizontally for resilience and growth.
• Use load balancers to improve availability and distribute traffic efficiently.
• Select SQL or NoSQL databases based on consistency, scalability, and data structure requirements.
• Design APIs using REST, GraphQL, or gRPC according to application needs.
• Understand networking fundamentals, including HTTP, WebSockets, AMQP, TCP, and UDP.
• Implement secure authentication and authorization using JWT, OAuth2, RBAC, ABAC, or ACL.
• Eliminate single points of failure through redundancy, health checks, and monitoring.
• Build practical experience by designing and deploying real-world distributed systems on cloud platforms.

---

Conclusion

Mastering system design requires both theoretical understanding and hands-on implementation. By progressing from single-server architectures to scalable distributed systems, learning API and database design, implementing secure authentication and authorization, and gaining cloud experience, developers can confidently design reliable, high-performance, and maintainable software systems suitable for modern production environments and senior engineering responsibilities.