Interview Bank
Every interview question from across the course, collected automatically at build time. Pick a level to narrow the list, then follow a question to the card on its page, where the answer and follow-ups are behind a reveal.
861 questions
The Internet & Performance
- What is the difference between latency, bandwidth and throughput?
- What are the four components of packet delay?
- Why can't 1 Gbps fix a slow page?
- What causes jitter and who cares?
- Back-of-envelope: what is the RTT floor from New York to London?
- Explain queuing delay as utilization approaches 100 percent.
- Why is the round-trip time on a geostationary satellite so high, and how does LEO change it?
- What is the difference between transit and peering, and who pays?
- What is an IXP and why would a network join one?
- What is an AS and an ASN?
- What is a Tier-1 network, and can one be depeered?
- Why is the Internet flattening, and what does it mean for CDNs?
- A single-homed company loses its only upstream. How would you fix that?
- Explain the OSI model versus the TCP/IP model.
- What layer is a switch, a router, a load balancer, a firewall, ARP and TLS?
- What is the difference between a segment, a packet and a frame?
- What changes in a packet as it crosses a router?
- What is encapsulation, and what does it cost?
- Process-to-process, host-to-host and hop-to-hop: which header serves which?
- Where do TLS, VPNs and QUIC violate the layer model?
- Why do packets get lost?
- What is the difference between bandwidth, throughput and goodput?
- What is the bandwidth-delay product and why does it matter?
- Why is my download slower than my plan?
- What is a bottleneck link and how do you find it?
- Why does a single TCP stream underperform on a long fat network?
- How does loss affect throughput quantitatively?
- What is the difference between packet switching and circuit switching, and why did the Internet choose packets?
- What is store-and-forward, and how much delay does it add?
- What is statistical multiplexing? Give the numbers.
- What is the difference between a datagram network and a virtual-circuit network?
- Why can packets arrive out of order, and who fixes it?
- What is bufferbloat and how do you fix it?
- What is the Internet?
- What is the difference between a router, a switch, a modem and an access point?
- What is the difference between the Internet and the Web?
- What happens between your laptop and your ISP at home?
- What is the edge versus the core of the network?
- Why does the Internet work with no central authority?
Application Layer
- What is a socket and what is a port?
- What are the trade-offs between client-server and peer-to-peer?
- How does a server handle many clients on a single port?
- Walk through the socket API calls on a server and a client.
- When would you use TCP sockets and when UDP sockets?
- Stateful vs stateless services: why does scaling care?
- What is the C10K problem and how is it solved?
- HTTP is stateless, so how do logins work?
- What is the difference between a cookie, a session and a token?
- Explain the same-origin policy and CORS. What is a preflight?
- What are Secure, HttpOnly and SameSite for?
- What is CSRF and how do you prevent it?
- JWT versus server sessions: what are the trade-offs?
- Why can you not use Access-Control-Allow-Origin: * with credentials?
- How do cookies interact with caching and CDNs?
- What is the difference between A, CNAME, NS, MX and TXT records?
- Compare DNS round robin, GeoDNS and anycast.
- How does DNS failover work and what are its limits?
- How do you do a zero-downtime DNS cutover?
- What does a CDN CNAME do to your DNS?
- What is DNSSEC and what does it not protect?
- DoH versus DoT versus plain DNS: what is protected and who can still see what?
- What is split-horizon DNS and where do you need it?
- Why can a CDN CNAME chain add latency, and how is each hop cached?
- What is DNS, and what happens when you resolve http://www.example.com?
- Which transport does DNS use?
- Recursive versus iterative resolution: what is the difference?
- What is a TTL, and how do the caching layers interact?
- What are glue records and why do they exist?
- NXDOMAIN versus NODATA, and negative caching?
- The Facebook 2021 outage: why did DNS fail?
- How did Kaminsky's cache-poisoning attack work, and what fixed it?
- Lookups fail with intermittent SERVFAIL, in one region only, and dig from your laptop works. How do you find the cause?
- How does an email get from sender to recipient?
- What is the difference between SPF, DKIM and DMARC?
- SMTP versus IMAP versus POP3, and how is each secured?
- How does SSH authenticate, and what is port forwarding good for?
- Why does active FTP break behind NAT, and what fixes it?
- What is the difference between GET and POST?
- What is in an HTTP request and an HTTP response?
- HTTP is stateless: what does that mean, and how do logins persist?
- PUT vs PATCH vs POST: how do they differ?
- What is the Host header and why is it required?
- What does each part of a URL do, and who consumes it?
- How do you make a POST safe to retry?
- Compare persistent and non-persistent connections for N objects, and pipelining vs multiplexing.
- How does browser caching work end to end for a repeat visit?
- What is the difference between no-cache and no-store?
- ETag or Last-Modified: which validator, and why?
- max-age versus s-maxage: what is the difference?
- How do you invalidate a cached asset?
- What does Vary do, and why is it dangerous?
- Design the caching headers for HTML, versioned JS, an authenticated API and a user avatar.
- What is a cache stampede and how do you prevent it?
- What is the difference between a reload, a hard reload and clicking a link, as far as the cache is concerned?
- What do stale-while-revalidate and stale-if-error do, and when would you use each?
- A response has Last-Modified but no Cache-Control or Expires. Will a cache reuse it, and for how long?
- What is the difference between 401 and 403?
- Explain 301, 302, 303, 307 and 308.
- What do 2xx, 3xx, 4xx and 5xx mean, and who is at fault?
- What is the difference between 502, 503 and 504, and where does each come from?
- What is idempotency, and which HTTP methods are idempotent? How do you make a POST payment retry-safe?
- What does a good REST API look like, and where does REST break down?
- How should a client behave when it gets a 429?
- Should validation errors be a 200 with an error body or a 4xx? Why does it matter?
- What is the difference between HTTP/1.1 and HTTP/2?
- What is head-of-line blocking at the HTTP layer versus the TCP layer?
- Why did domain sharding and sprites become anti-patterns under HTTP/2?
- How is HTTP/2 negotiated?
- What is HPACK, and why not just gzip the headers?
- Why is HTTP/2 worse than HTTP/1.1 on a very lossy link?
- What was HTTP/2 Rapid Reset?
- After moving from an HTTP/1.1 connection pool to HTTP/2, p99 latency got worse while average latency improved. Why, and what do you measure?
- Why does HTTP/3 use UDP instead of its own IP protocol or TCP?
- How does HTTP/3 fix head-of-line blocking?
- How many RTTs to the first byte for TCP + TLS 1.3, QUIC and QUIC 0-RTT?
- How does a browser discover that a site supports HTTP/3?
- What is connection migration and what makes it work?
- Where is QUIC slower or worse than TCP, and how do you decide whether to enable it?
- What can a network observer see on a QUIC connection?
- How does QUIC defend against amplification and spoofed addresses?
- QUIC removes head-of-line blocking between streams. What do the streams still share?
- Why does HTTP/3 need QPACK instead of HPACK?
- What is the difference between polling, long polling, SSE and WebSocket?
- How does the WebSocket handshake work?
- How would you scale WebSockets to a million connections?
- How do you authenticate a WebSocket?
- How do you detect a dead WebSocket connection?
- Design the reconnect logic for a real-time client.
- Why must WebSocket clients mask their frames?
- Design the transport layer for a chat or live-score system.
- What is the difference between REST and RPC, and what makes an API RESTful?
- When would you choose REST, gRPC or GraphQL? What are over-fetching and under-fetching?
- Why does gRPC use HTTP/2 and Protocol Buffers, and what do trailers carry?
- How do you load balance gRPC, and why does an L4 balancer fail?
- What are deadlines, and why propagate them? What about a retry budget?
- How do you design a reliable webhook receiver?
- How do you evolve a protobuf or REST API without breaking clients?
- How would you retry a payment safely across services?
- How does adaptive bitrate streaming work?
- HLS vs DASH?
- Why is streaming delivered over HTTP and not UDP?
- Throughput-based vs buffer-based ABR? What causes flapping and how do you stop it?
- Design YouTube or Netflix at the network level.
- How do you get live latency from 30 s down to 3 s?
- How do you reduce startup time?
Transport Layer
- How does TCP congestion control work?
- What is AIMD and why does it converge to fairness?
- Tahoe vs Reno vs NewReno vs CUBIC vs BBR: what differs?
- Why is TCP throughput limited by loss? Give the Mathis formula.
- What is the initial window and why is it 10? How long does a 100 KB response take?
- What is bufferbloat and how do you fix it?
- What is ECN?
- Why do short flows suffer, and how do HTTP/2 and warm connections help?
- What is the difference between flow control and congestion control?
- What happens when rwnd is 0?
- Why is my transfer slow on a high-latency link?
- What is window scaling and how do you verify it is in use?
- What are rwnd, cwnd and the send buffer, and which one limits me?
- Explain tcp_rmem and receive autotuning.
- What is silly window syndrome?
- Why is my small-request service seeing 40 ms latency spikes?
- State Nagle's algorithm exactly.
- What is delayed ACK and what are its timers?
- What is silly window syndrome and how is it avoided?
- When should you set TCP_NODELAY and when not?
- Is the Nagle plus delayed-ACK interaction a deadlock?
- Why does TIME_WAIT exist, and why 2 * MSL?
- We see "Cannot assign requested address" when calling a service at a high rate. Diagnose it.
- A server has tens of thousands of TIME_WAIT sockets. Is that a problem, and what do you do?
- Explain SO_REUSEADDR, SO_REUSEPORT and tcp_tw_reuse.
- Why was tcp_tw_recycle removed?
- Explain cloud NAT port exhaustion and how you fix it.
- How many connections can a client make to one server?
- Who ends up in TIME_WAIT, the client or the server?
- How can a server handle 100k connections on port 443?
- What is the difference between a listening socket and a connected socket? Which fd does accept() return?
- What happens when you connect to a closed port, for TCP and for UDP?
- "Address already in use": why does it happen, and what do SO_REUSEADDR and SO_REUSEPORT do?
- What is the maximum number of concurrent connections a server can accept?
- What is the difference between binding 0.0.0.0, 127.0.0.1 and a specific IP?
- How does the OS decide which socket gets an incoming packet?
- Explain Go-Back-N versus Selective Repeat.
- Is TCP Go-Back-N or Selective Repeat?
- Why is stop-and-wait slow? Compute the utilisation.
- Why must the Selective Repeat window be at most half the sequence space?
- What is a cumulative ACK?
- Why are TCP sequence numbers byte offsets?
- What do duplicate ACKs tell the sender?
- How does TCP decide when to retransmit?
- How is the RTO computed? Show an example.
- Why does Karn's algorithm exist?
- Fast retransmit vs timeout: what is the difference in cost?
- How long until TCP gives up on a dead connection?
- What are SACK, RACK and TLP?
- What is a spurious retransmission and how does DSACK help?
- Walk through the TCP three-way handshake with sequence and ack numbers.
- Why three messages and not two?
- What happens if the final ACK of the handshake is lost?
- What is a SYN flood and how do SYN cookies work?
- Explain the four-way close and half-close.
- When does a TCP stack send a RST?
- What is a half-open connection and how do you detect a dead peer?
- How long does connect() take, and what does a new connection cost?
- In syscall terms, what does a client do to open a TCP connection, and where does TLS run?
- What is the difference between TCP keepalive and HTTP keep-alive?
- A download starts normally and then stalls part-way. What do you check?
- A TCP transfer is slow. How do you diagnose it?
- What is the maximum throughput with a 64 KB window and 100 ms RTT?
- What is the bandwidth-delay product and why does it matter?
- Why is the first request on a new connection slow?
- Why do parallel connections speed up a download?
- How do CDNs reduce latency from a TCP point of view?
- How would BBR help versus CUBIC on a lossy long path?
- What are the TCP flags and what does each do?
- What is the difference between RST and FIN?
- How does TCP know the header length, and why is the maximum 60 bytes?
- What is window scaling and why is it needed?
- What does SACK add?
- What does PSH do? What is the urgent pointer?
- You are shown a tcpdump SYN-ACK line with seq 0, ack 1, win 65160 and five options. How do you read it?
- Why does a SYN consume a sequence number?
- We see CLOSE_WAIT sockets piling up on a server. What is happening and how do you find the cause?
- Sockets are stuck in FIN_WAIT_2. Why, and when do they go away?
- A server shows a growing number of SYN_RECV sockets. What does it mean?
- What do Recv-Q and Send-Q mean on a LISTEN socket versus an ESTABLISHED one?
- Draw the state path for the active closer and the passive closer.
- Which side ends up in TIME_WAIT, and why does it live there?
- How would you find which process is leaking sockets on a host?
- What happens when an application calls close() while there is still unread data in the receive buffer?
- Why is CLOSE_WAIT worse than TIME_WAIT?
- What does the transport layer do that IP does not?
- When do you choose TCP and when UDP?
- Is TCP "reliable"? What exactly does it guarantee?
- Walk through the socket calls for a TCP server and a client.
- Why does TCP not preserve message boundaries?
- What is the end-to-end argument and where does it show up?
- When would you choose UDP over TCP?
- What is the difference between a TCP stream and a UDP datagram at the socket level?
- Why does DNS use UDP, and when does it switch to TCP?
- Why was QUIC built on UDP instead of being its own protocol?
- Can you make UDP reliable? How?
- Why do idle UDP flows die behind a NAT, and how do you keep them alive?
- Does UDP have congestion control? Is that a problem?
- Explain a UDP amplification attack and how to defend against it
- What happens when a UDP datagram arrives at a closed port?
- Your UDP service drops packets under load. How do you find out where?
Network Layer: Data Plane
- Walk through DHCP DORA.
- Why is the Request a broadcast when the client has already picked a server?
- How does DHCP work across subnets?
- What are T1 and T2?
- A laptop shows a 169.254.x.x address. Why?
- What happens when you plug into a network and open a website?
- What is a rogue DHCP server and how do you stop it?
- What is a DHCP starvation attack?
- How does an IPv6 host get its address and DNS server: SLAAC or DHCPv6?
- Why do MAC-based DHCP reservations and an internal DNS server stop working on modern clients?
- What is longest-prefix match? Walk through an example.
- What is the difference between the control plane and the data plane?
- What is the difference between a router, a switch and a L3 switch?
- What is administrative distance, and how is it different from a metric?
- What is the difference between a static and a dynamic route, and how can a stale static route shadow a dynamic one?
- What is ECMP, and how are packets of one flow kept in order?
- What does a router do with a packet whose TTL is 1?
- What is a default route, and how can it black-hole traffic?
- What happens when your laptop pings 8.8.8.8?
- How does a host decide whether a destination is local or remote?
- Whose MAC address is in the frame for an internet-bound packet?
- What changes hop by hop and what stays the same?
- The local network works but the internet does not. What do you check?
- What is a default gateway?
- What are proxy ARP and an ICMP redirect?
- Given 192.168.10.77/27, what are the network address, broadcast address, usable range and host count?
- How does a host decide whether a destination is local or remote?
- How many hosts fit in a /22? A /26? A /28?
- Is 172.32.0.1 a private address? Name the RFC 1918 ranges.
- What does a 169.254.x.x address mean?
- Why can't you use the first and last address of a subnet? When does that rule not apply?
- What is CIDR and why was it introduced?
- A host is configured as /24 on a network that is really /26. What breaks?
- What fields are in the IPv4 header and what do they do?
- What is TTL and what happens when it reaches zero?
- What does the protocol field do?
- What changes at each router hop and what stays the same?
- Why does IPv4 have a header checksum and IPv6 does not?
- How do the ID, flags and fragment offset fields support fragmentation?
- What are DSCP and ECN?
- How does a host get an IPv6 address?
- How does IPv6 replace ARP?
- Why can't routers fragment in IPv6, and what is the minimum MTU?
- Compress 2001:0db8:0000:0000:0000:ff00:0042:8329
- What are link-local, ULA and global unicast addresses?
- What are Happy Eyeballs and NAT64/DNS64?
- Why has IPv6 adoption been slow, and where is it used?
- Write an IPv6 address in a URL
- Walk me through Path MTU Discovery.
- Why does SSH work but a large download hang over my VPN?
- Fragment a 4000-byte datagram over MTU 1500: give the offsets.
- What is the difference between MTU and MSS?
- What MTU would you set for VXLAN or Calico overlays?
- What are jumbo frames and what is the risk?
- How does IPv6 handle fragmentation differently?
- Why does tcpdump show packets larger than the MTU?
- Explain NAT and PAT. What is in the table?
- Why can't the internet reach my laptop?
- What is port forwarding (DNAT)?
- How do WebRTC peers connect through NAT?
- What is the difference between full cone and symmetric NAT?
- My idle SSH or gRPC connection dies after a few minutes. Why?
- What is conntrack and what happens when its table fills?
- What is CGNAT and why do P2P, gaming and VoIP fail behind it?
- Outbound connections from a NAT gateway fail intermittently. Is it conntrack or port exhaustion?
- Someone suggests tcp_tw_recycle to clear a TIME_WAIT pile-up behind a NAT. What do you say?
- Why does asymmetric routing cause trouble through a stateful NAT or firewall?
- Split 10.0.0.0/16 into 4 equal subnets.
- Subnet 10.0.0.0/16 for networks of 500, 200 and 50 hosts.
- Are 10.1.1.130 and 10.1.1.200 on the same subnet with a /25? With a /26?
- How many hosts does a /22 give?
- Summarize 10.0.0.0/24 through 10.0.3.0/24.
- What breaks when two VPCs with overlapping CIDRs are peered?
- What is the difference between CIDR, a subnet and a VLAN?
Network Layer: Control Plane
- What is an autonomous system?
- What is the difference between an IGP and an EGP?
- Why is the internet routed hierarchically?
- Trace a packet across several ASes.
- What are a stub AS, a transit AS and a multi-homed AS?
- What is hot-potato routing and who does it benefit?
- Why do private ASNs show up in data centre fabrics?
- State the Gao-Rexford export rules and what they imply.
- What does BGP do, and how is it different from OSPF?
- Walk through how a BGP session comes up.
- How does BGP prevent routing loops between ASes?
- Why does iBGP need a full mesh, and how do you avoid it?
- A route learned over eBGP is in the BGP table but is not used. Why?
- Why can a longer AS-PATH win?
- When do you need a full BGP table and when is a default route enough?
- What is the BGP best-path selection order?
- How do you steer inbound versus outbound traffic?
- What is valley-free routing and what is the export rule?
- What is the difference between a BGP hijack and a route leak?
- How does RPKI help, and what does it not do?
- Explain the October 2021 Facebook outage.
- What are hot-potato and cold-potato routing?
- Why do more-specific hijacks work, and how are they mitigated?
- A user can connect to your site but large pages hang. Where do you look?
- How does ping work?
- What is TTL, and what happens at zero?
- Explain Path MTU Discovery.
- Ping to a host fails, yet its website loads. Why?
- Why can you not block ICMPv6 like ICMP?
- Ping shows 30% loss at a middle hop but 0% at the destination. Is there a problem?
- What is the difference between link-state and distance-vector routing?
- What is count-to-infinity and how is it mitigated?
- What is the complexity of Dijkstra, and what does link-state cost per router?
- What is convergence, and which family converges faster?
- Why did the ARPANET change from distance-vector to link-state in 1979?
- Walk me through one distance-vector round for three routers.
- Why does RIP cap the hop count at 15?
- What is OSPF and what kind of protocol is it?
- How does OSPF work end to end?
- What are the DR and BDR and why do they exist?
- An OSPF neighbour is stuck in ExStart, 2-Way or Init. What are the causes and how do you debug?
- How is OSPF cost computed, and what is the default reference-bandwidth problem?
- Why must area 0 exist, and what are ABRs, ASBRs and LSA types 1 to 5?
- Compare OSPF with IS-IS, RIP and EIGRP.
- Where does OSPF run in modern data centres?
- What is the difference between the control plane and the data plane?
- What does an entry in a routing table contain?
- How does a router choose between two routes to the same destination?
- What is convergence and what goes wrong during it?
- When would you use static routing versus a dynamic protocol?
- Why can the internet not run one big OSPF?
- What is ECMP and how does it keep TCP flows in order?
- How does traceroute work?
- What does * * * mean in a traceroute?
- Traceroute versus ping versus mtr?
- Why would you choose TCP or ICMP mode over the default?
- How do you estimate distance from an RTT jump?
- Why can traceroute show a path that does not exist?
- Hop 5 shows high latency and nothing else does. Is it the problem?
- How do MPLS and firewalls change what traceroute shows?
Link Layer & LANs
- What does ARP do and why is it needed?
- How does a host decide whether to ARP for the destination or the gateway?
- Walk through ARP for a packet to 8.8.8.8.
- What is gratuitous ARP and when is it used?
- Two hosts have the same IP. What breaks?
- Explain ARP spoofing and its mitigations.
- Why is there no ARP in IPv6?
- What happens to ARP during a VRRP failover?
- Does an ARP request ever leave the local network?
- Name the three tables involved in sending one packet, and which device uses each.
- The default gateway stops answering ARP. What do you see?
- Why detect errors on a link rather than correct them?
- How does parity work and what does it miss?
- Checksum, CRC, hash, MAC: which for what?
- Why does TCP checksum when Ethernet already has a CRC?
- What does the TCP or UDP checksum cover, and what about IP?
- tcpdump on my server shows bad checksums on outgoing packets. Is the network corrupting them?
- Can a checksum miss errors? How does CRC differ?
- Walk me through computing a CRC.
- List the fields of an Ethernet frame.
- What is the difference between unicast, multicast and broadcast MAC addresses?
- Why is the minimum Ethernet frame 64 bytes?
- What is the MTU and how does it relate to frame size?
- Can two machines have the same MAC address?
- Why do phones randomise their MAC address, and what breaks?
- What is the maximum packets per second on 10 GbE for 64-byte frames?
- What does the link layer do that the network layer does not?
- What is the difference between a frame, a packet and a segment?
- Why do we need MAC addresses when we have IP addresses?
- Why does Ethernet not retransmit when Wi-Fi does?
- Where is the link layer implemented on a host?
- Hop-by-hop versus end-to-end error checking: which layer checks what?
- Can one IP packet cross links with different MTUs?
- Why are loops dangerous in Ethernet, and how does IP avoid the same problem?
- How does STP elect the root bridge?
- What are root, designated and blocked ports, and how is path cost computed?
- Compare STP and RSTP convergence.
- How would you design a redundant LAN without wasting half the links?
- A user plugged in a switch and the network melted. Why?
- How does LACP hash flows, and what is its limit?
- How does a switch learn MAC addresses?
- What is the difference between a hub, a switch and a router?
- What does a switch do with a frame to an unknown destination MAC?
- What is the difference between a collision domain and a broadcast domain?
- What is a broadcast storm and how does it start?
- What is a MAC flooding attack and how do you mitigate it?
- Explain CSMA/CD and why the minimum Ethernet frame is 64 bytes.
- Cut-through or store-and-forward?
- What is a VLAN and why would you use one?
- What is the difference between an access port and a trunk port?
- What is the difference between a VLAN, a subnet and a broadcast domain?
- How does inter-VLAN routing work?
- How many VLANs can you have, and what do you do when that is not enough?
- Explain VLAN hopping and how to prevent it.
- Why do cloud providers not use VLANs for tenants?
- Walk through the bytes of an 802.1Q tag for VLAN 20.
Wireless & Mobile
- How does a cellular network differ from Wi-Fi?
- What is frequency reuse and why use cells?
- Describe the LTE attach procedure.
- How do the 4G EPC and the 5G core differ?
- How does SIM authentication work?
- Why can't I accept inbound connections on my phone, and what do apps do instead?
- What is network slicing or MEC, and where does it matter?
- How does a phone keep its IP address while moving between towers?
- What is Mobile IP, and what are the home agent, care-of address and triangle routing?
- Why does a TCP download stall when you walk from Wi-Fi to LTE?
- What problem does handover hysteresis solve?
- Why is TCP poor on wireless links, and what mitigates it?
- Design a video-call app that survives a network switch.
- How does CGNAT affect peer-to-peer traffic and long-lived connections on mobile networks?
- What is the difference between SSID, BSSID and ESS?
- What happens when your laptop joins Wi-Fi? Give the full ordered list.
- Why does an 802.11 frame have up to four address fields?
- Passive versus active scanning? Why are 5 GHz DFS channels passive only?
- Why does one slow client hurt everyone on the same AP?
- What did Wi-Fi 6 change, and why does it matter in dense deployments?
- Mesh versus repeater versus wired backhaul?
- What is the difference between CSMA/CD and CSMA/CA, and why does Wi-Fi use avoidance?
- Explain backoff and contention window doubling, with numbers.
- What is the NAV?
- Describe the hidden terminal problem and how RTS/CTS helps. What about the exposed terminal?
- Why is SIFS shorter than DIFS?
- Why does throughput collapse as more stations join one BSS?
- How do voice and video get priority on Wi-Fi?
- What is the difference between WEP, WPA2 and WPA3?
- How do PSK and Enterprise (802.1X) differ, and how does 802.1X work?
- Walk through the 4-way handshake: what is derived and why nonces?
- Is open Wi-Fi safe if I use HTTPS?
- What is an evil twin and how do you defend against it?
- How does Wi-Fi roaming work, and why do calls drop between APs?
- Why does WPA3-SAE resist offline dictionary attacks?
- Why is wireless less reliable than wired?
- Compare 2.4, 5 and 6 GHz.
- What is the hidden terminal problem?
- Why does Wi-Fi ACK every unicast frame when Ethernet does not?
- Why is Wi-Fi half-duplex, and why can it not detect collisions?
- Your Wi-Fi advertises 1.2 Gbit/s but you measure far less. Why?
- How does TCP behave over lossy wireless, and what mitigates it?
Security
- What is the difference between authentication and authorization, and how do 401 and 403 map to them?
- Sessions versus JWTs: what are the trade-offs?
- How do you validate a JWT correctly?
- Explain the OAuth 2.0 authorization code flow and why PKCE exists.
- What is the difference between OAuth and OpenID Connect, and between an ID token and an access token?
- Where should a single-page app store its tokens, and why?
- How would you authenticate service-to-service calls?
- Design a login flow with MFA and a safe password reset.
- Why are passkeys phishing-resistant?
- What is inside a TLS certificate?
- How does a browser decide to trust a website's certificate?
- Walk through chain validation. What does a missing intermediate look like?
- CRL vs OCSP vs stapling: what is the difference, and why do browsers soft-fail?
- How does Let's Encrypt prove I own a domain, and what is the difference between HTTP-01 and DNS-01?
- What error do you get for an expired certificate versus a wrong hostname versus an untrusted root?
- What is Certificate Transparency, and what attack does it detect?
- Design certificate rotation for 10,000 services.
- What is a DDoS attack, and what is the difference between volumetric and application-layer?
- How does an amplification attack work, with numbers?
- What is a SYN flood and how do SYN cookies stop it?
- How would you defend a public API from DDoS?
- Slowloris versus an HTTP flood, and how do you stop each?
- How do you tell a flash crowd from an attack?
- What is a scrubbing centre and how does traffic reach it?
- Why is RTBH a last resort, and what is Flowspec?
- What is HTTP/2 Rapid Reset and how is it mitigated?
- What is the difference between a stateless and a stateful firewall?
- What is a DMZ and why use one?
- What is the difference between a security group and a network ACL?
- How do a firewall, a WAF and an IDS or IPS differ?
- How does iptables process a forwarded packet?
- How does a stateful firewall treat UDP and ICMP?
- Why does FTP break through firewalls and NAT?
- How would you lock down a three-tier app in a VPC?
- What is zero trust microsegmentation and what does it change?
- What is the difference between symmetric and asymmetric encryption, and why do we use both?
- Explain Diffie-Hellman using numbers.
- What is forward secrecy, and which cipher suites provide it?
- How does a digital signature work?
- ECDHE versus RSA key exchange: what is the difference, and why did TLS 1.3 drop RSA?
- Diffie-Hellman is vulnerable to a man in the middle. How does TLS fix that?
- What is harvest-now-decrypt-later, and what is the post-quantum plan?
- How do you rotate keys without downtime?
- How does ARP spoofing work, and how do you stop it?
- Explain DNS cache poisoning and why Kaminsky mattered.
- Why can a UDP source address be spoofed while TCP mostly cannot?
- What is TLS stripping, and what stops it?
- Compare a BGP hijack, a leak and a withdrawal.
- How do rogue DHCP and VLAN hopping work, and how do you defend?
- Threat-model a coffee-shop Wi-Fi user.
- How can a MITM defeat a naive mobile app, and what are the trade-offs of pinning?
- What is the difference between encryption, hashing and encoding?
- Symmetric versus asymmetric encryption: when do you use each, and why does TLS use both?
- How do you store user passwords?
- What is AEAD, and why prefer GCM over CBC?
- HMAC versus a plain hash versus a signature: how do they differ?
- Why must a MAC be compared in constant time?
- Is AES-256 broken by quantum computers?
- Design integrity for a webhook receiver.
- Explain the CIA triad with a network example for each.
- What is the difference between authentication, authorization and accounting?
- What is the difference between an on-path and an off-path attacker, and what can each do?
- What does HTTPS protect against, and what does it not?
- What is defense in depth? Give layers for a web application.
- Threat-model a public API in five minutes.
- How does perimeter security differ from zero trust, and what changes in network design?
- What does HTTPS add over HTTP?
- Walk me through a TLS 1.3 handshake.
- How does TLS 1.2 differ from TLS 1.3?
- What is SNI and why does it matter?
- What is ALPN and how does HTTP/2 get negotiated?
- Explain session resumption and 0-RTT. What is the risk?
- Where would you terminate TLS in a large system, and why?
- How does TLS stop downgrade and man-in-the-middle attacks?
- How does mTLS change the handshake?
- The TLS handshake fails for some clients only. What do you suspect and how do you test?
- An attacker records your traffic today and steals the server's private key next year. Can they read it?
- mTLS fails with "unknown authority" after a certificate rotation, for one pair of services only. Where do you look?
- What does a VPN do and what does it not do?
- Site-to-site versus remote-access VPN: what is the difference?
- How does IPsec establish a tunnel?
- Why does my VPN hang on large transfers while small requests work?
- How does IPsec work through a NAT?
- WireGuard versus IPsec versus OpenVPN: how would you choose?
- How is a VPN different from zero trust access, and what breaks with a full tunnel?
- Two offices both use 10.0.0.0/16. How do you connect them?
At Scale
- What does a CDN do, and why does it reduce latency?
- How does a CDN route a user to a nearby edge?
- Design a CDN. What are the components and how does a request flow?
- What are the ways to invalidate cached content, and when do you use each?
- What is the cache key, and what goes wrong when it is wrong?
- A popular key was just purged and the origin is melting. What is happening and how do you stop it?
- How would you improve a low cache hit ratio?
- How do you cache a page that is personalised for each user?
- Push CDN or pull CDN, and when would you choose each?
- How can a CDN be abused, and how do you defend against it?
- Your site is behind a CDN, yet the origin still serves every page view. Why?
- After putting a CDN in front, the origin logs show far fewer requests and every client IP looks the same. What changed?
- How does Netflix decide which cache a player fetches video from, and why not just use anycast or DNS?
- Why not just use hash(key) % N to pick a server?
- Explain consistent hashing and virtual nodes.
- How are replicas chosen on a ring?
- How does a client find a key's node efficiently?
- Compare rendezvous hashing, a ring and jump hash.
- Design a sharded cache for 1M requests per second.
- How do you stop one node from being overloaded on a ring?
- How does an L4 load balancer keep a connection pinned after the backend set changes?
- Anycast versus GeoDNS: how does each route a user, and what breaks?
- How does Cloudflare or Google send me to the nearest data centre?
- What breaks TCP on anycast, and how do you cope?
- A DNS TTL is 60 s. How long does failover really take?
- Active-active versus active-passive: what is the real difference?
- Explain RTO and RPO, and the DR strategies.
- Design multi-region failover for a payment service.
- How do you stop health checks from false-positive failovers and flapping?
- How long does BGP failover take, and how do you make it faster?
- What does a load balancer do?
- L4 versus L7 load balancing: when do you pick each?
- Compare balancing algorithms. When does least connections beat round robin?
- How do you keep the load balancer from being a single point of failure?
- How does the backend learn the client's IP address behind a load balancer?
- What are the trade-offs of sticky sessions, and what do you use instead?
- Design a load balancer.
- How do you deploy a new version without dropping requests?
- Why does gRPC or HTTP/2 need L7 or client-side load balancing?
- How is round-robin DNS different from a real load balancer?
- What do 502, 503 and 504 each tell you when they come from a load balancer?
- Two instances sit in one zone and four in another, with cross-zone balancing off. Does each instance get the same share?
- A route change moves a client's packets to a different site mid-connection. How does a large anycast frontend avoid resetting it?
- Why must timeouts shrink inward from client to dependency, and why is retrying a POST at the proxy dangerous?
- What is the difference between a forward proxy and a reverse proxy?
- How do a reverse proxy, a load balancer and an API gateway differ?
- How does the backend learn the real client IP?
- How does HTTPS work through a forward proxy?
- What does a service mesh add compared with a client library such as Resilience4j?
- How does a sidecar intercept traffic without the app changing?
- Compare Ingress, Gateway API and an API gateway in Kubernetes.
- How do you scale and protect an API gateway?
- What is the Backend for Frontend pattern, and when would you use it?
- What is rate limiting, and what status code do you return?
- Compare token bucket and leaky bucket.
- Explain fixed window versus sliding window and the boundary problem.
- Design a distributed rate limiter.
- Where do you enforce rate limits: edge, gateway or application?
- What is the difference between rate limiting and load shedding?
- How do you shed load without making an outage worse?
- How do you rate limit per user when users sit behind NAT or on IPv6?
- What is backpressure, and what is a bulkhead?
- How do you defend a login endpoint from credential stuffing?
- What problem does service discovery solve?
- Client-side versus server-side discovery: when do you pick each?
- How does Kubernetes resolve a service name to a pod?
- Liveness versus readiness versus startup probes?
- Why can DNS-based discovery serve stale endpoints?
- How do you deregister gracefully during a deploy?
- CP versus AP registry: how do etcd, ZooKeeper and Eureka differ under a partition?
- How does Envoy learn endpoints, and what if the control plane dies?
- Design discovery for 10,000 instances across regions.
- DNS has resolved the name to an address. What happens next, and who receives the request?
- Walk the path of a request to a globally deployed service, and say where each layer can fail.
- Where would you put caches on this path, and what would you cache at each?
- How do you compute the availability of a chain of services, and how do you improve it?
- Where do you terminate TLS, and why? Do you re-encrypt to the origin?
- Design the serving path for 1M requests per second at 99.99% availability.
- Why does p99 get worse with fan-out, and what do you do about it?
- Users report the site is slow. How do you find which hop is responsible?
- What is a timeout, and why must every network call have one?
- Implement exponential backoff with jitter.
- How do retries cause outages, and how do you prevent it?
- Describe a circuit breaker's states and the thresholds that move it between them.
- Which errors should be retried, and which should not?
- Design idempotency keys for a payment API.
- A request fans out across 5 services. How do you propagate deadlines and budget time?
- What are hedged requests, and what do they cost?
- A dependency is slow, not down. What happens to your service, and what do you do?
- What is a metastable failure, and how do you get out of one?
Tooling & Debugging
- How do you see response headers with curl?
- A page is slow. How do you tell DNS from TCP from TLS from server slowness with curl?
- How do you test one specific backend behind a hostname?
- The certificate looks fine in a browser but curl fails. What do you check?
- How do you check a certificate's expiry from the command line?
- curl from the server works, but the application times out. Why?
- What does SNI do, and what breaks if you leave out -servername?
- A user says the site is slow. Walk me through it.
- What is the difference between connection refused, timed out and reset?
- Ping fails but curl works. Why?
- How do you tell DNS slowness from network or app slowness?
- How do you debug intermittent packet loss?
- Small requests work but large ones hang. What is going on?
- It works from my laptop but fails from a pod. What do you check?
- How would you debug a connection problem with no tools installed?
- What is the difference between NXDOMAIN and SERVFAIL?
- What is the difference between a recursive resolver and an authoritative server?
- Why is DNS mostly UDP, and when does it use TCP?
- How would you run a zero-downtime DNS cutover?
- dig resolves the name but my application cannot. What do you check?
- What are the trade-offs of a low versus a high TTL?
- How do you debug a split-horizon problem?
- How would you reproduce a firewall drop versus a reject locally?
- How do you simulate packet loss and latency on a Linux host?
- How would you test your service's behaviour under a slow or lossy network?
- How would you reproduce ECONNRESET?
- A connect hangs for about two minutes then fails. What did you just reproduce?
- What does ping actually do?
- A reply shows ttl=56. What does it tell you?
- mtr shows 24% loss at hop 4 and 0% at every later hop. Is there a problem?
- How do you find the path MTU with ping?
- Why do traceroute and mtr show different paths on repeated runs?
- The forward path looks fine but users still lose packets. How do you check?
- Why might ICMP be deprioritised while TCP is fine?
- How do you find which process is using port 8080?
- How do you test from a shell that a port is open?
- What do Recv-Q and Send-Q mean on a LISTEN socket versus an ESTABLISHED one?
- You see thousands of CLOSE-WAIT sockets. Whose bug is it?
- Your service fails to restart with "address already in use". Why?
- Clients see connect timeouts under load but the server CPU is idle. What do you check?
- How do you see per-connection RTT and congestion window on a host?
- What is a pcap and when would you reach for one?
- You see a SYN go out and no SYN-ACK. What do you conclude?
- You see three duplicate ACKs in a capture. What happens next?
- A receiver advertises a zero window. Who is slow?
- How do you capture traffic between two pods?
- How do you inspect HTTPS traffic?
- Your capture shows packets larger than the MTU. Is that a bug?
Cloud & Production Networking
- What is the difference between an L4 and an L7 load balancer?
- ALB, NLB or GWLB: which for gRPC, which for firewall appliances, which for static IPs?
- Intermittent 502s appear behind an ALB. What are the causes?
- How does the application see the client IP behind a load balancer?
- Design ingress for a multi-region service with failover.
- Should cross-zone load balancing be on or off, and what does it cost?
- How does a cloud load balancer scale without being a bottleneck?
- What is a VPC and why do you need one?
- What is the difference between a region and an availability zone?
- What actually makes a subnet public?
- How big would you make a VPC CIDR and why?
- How do AWS, GCP and Azure differ on subnet scope?
- Two acquired companies both use 10.0.0.0/16 and you must connect them. What do you do?
- How would you structure CIDRs for 50 accounts?
- What is the difference between "connection refused" and "connection timed out"?
- An EC2 instance has a public IP but you cannot reach it. What do you check, in order?
- How do you tell a security group drop from a NACL drop using a flow log?
- An app can reach the internet but not S3 through a VPC endpoint. How do you debug it?
- Connections time out only under load. What do you suspect?
- An AZ has an outage. How do you know whether the cause is the network or your app?
- Prove two VPCs can or cannot talk, without sending traffic.
- Design a VPC for a 3-tier web app in 3 AZs. Draw it and give CIDRs.
- A private instance needs the internet. How, and what about HA and cost?
- Why can't I reach my EC2 instance even though it has a public IP?
- Your company and a partner both use 10.0.0.0/16. How do you connect?
- How does traffic reach S3 without crossing the internet? What controls access?
- What happens when an AZ dies, and what actually breaks?
- Scale this to 40 accounts and an on-prem data centre.
- Cut this design's network bill by 30 percent. Where would you look?
- What is a Service and why not talk to pod IPs directly?
- How does a request to a ClusterIP reach a pod?
- How does a pod reach a pod on another node?
- DNS lookups are slow inside the cluster. Why?
- Compare Ingress, a LoadBalancer Service and NodePort.
- gRPC traffic hits only one pod. Why, and how do you fix it?
- How do you lock down a namespace?
- EKS pods are stuck Pending with no IPs. Why and what is the fix?
- Why do private instances need NAT, and why not give them public IPs?
- Walk a packet through a NAT gateway with addresses.
- A private fleet sees intermittent timeouts to one external API. Diagnose it.
- The NAT bill doubled. Why, and how do you cut it?
- Compare a NAT gateway, NAT instance, egress-only IGW and IGW. How do you make egress highly available?
- How does GCP Cloud NAT differ architecturally from an AWS NAT Gateway?
- Two VPCs with overlapping CIDRs need to talk. How does NAT enter, and why not peering?
- What is VPC peering and what are its limits?
- Peering, Transit Gateway or PrivateLink: when each?
- 20 VPCs must all talk to each other. Design it and count the connections.
- VPN versus Direct Connect: what are the tradeoffs?
- A partner uses the same CIDR as you. What are your options?
- Why use BGP rather than static routes on a site-to-site VPN?
- Your Direct Connect link flaps. How does traffic fail over, and what can go wrong?
- How does an EC2 instance in a private subnet reach S3 without a NAT gateway?
- PrivateLink versus VPC peering: when do you pick which?
- You created an endpoint but traffic still goes through NAT. Why?
- Expose an internal service to a customer's VPC without sharing networks.
- On-premises must resolve names from a private hosted zone. How?
- Make a bucket reachable only from your VPC.
- What is split-horizon DNS and why does the cloud use it?
- What is the difference between a security group and a network ACL?
- What does stateful mean for a security group?
- Why do NACLs need ephemeral port rules?
- How do you let the web tier talk to the database tier?
- You created a custom NACL and everything died. Why?
- Map this to GCP and Azure. What is different, and where does a deny go in each?
- Given this rule set, does the packet pass? What changes if the connection began before a rule was removed?
- What makes a subnet public?
- An instance has a public IP but cannot reach the internet. What do you check?
- Two routes match a destination. Which one wins?
- How does an instance with a public IP send a packet to the internet?
- A private instance must reach the internet but must not be reachable from it. Design it.
- Why does an inspection VPC drop traffic with asymmetric routing?
- Walk a packet from a private instance to the internet and back, with addresses at each hop.
Reference
- REST versus gRPC: when would you pick each?
- Polling, WebSocket or SSE for a live feed?
- L4 versus L7 load balancing: what are the tradeoffs?
- How do you choose between a push and a pull CDN?
- Peering, Transit Gateway or PrivateLink for 50 VPCs?
- What is the difference between connection refused, a timeout and a reset?
- What is the difference between 502, 503 and 504?
- How do you tell a connect timeout from a read timeout?
- Users see intermittent 502s right after a deploy. What do you check?
- What is the difference between NXDOMAIN and SERVFAIL?
- A client making many outbound calls gets EADDRNOTAVAIL. What is happening?
- Users see ECONNRESET only under load. How do you investigate?
- A certificate error appears only on some clients. Why?
- What is the difference between MTU and MSS?
- Explain the bandwidth-delay product in one sentence.
- How do anycast, multicast and unicast differ?
- What is a 5-tuple, and what uses it?
- What are the smallest IPv4 and TCP headers?
- What does IHL = 5 mean?
- How does the IPv4 fragment offset work?
- Why does IPv6 drop the header checksum and router fragmentation?
- How do TTL, hop limit and DF interact with path MTU discovery?
- Why can the UDP checksum be zero in IPv4 but not in IPv6?
- Why does a request from India to a US server feel slow even on a gigabit connection?
- How long does it take to transfer 1 GB over a 100 Mbit/s link?
- Estimate the bandwidth for a service with 10 million daily active users.
- How many round trips before the first byte of a cold HTTPS request on TLS 1.2, TLS 1.3 and QUIC?
- What is the bandwidth-delay product and why does a long fat pipe underperform with a default window?
- How many concurrent connections can one machine hold?
- Cross-AZ versus cross-region: what are the tradeoffs?
- What is a port, and what are the three port ranges?
- Which ports do HTTP, HTTPS, SSH and DNS use?
- Why does a client get a random source port?
- Why does FTP break with NAT and firewalls?
- How many connections can one server IP and port accept?
- A service works from your laptop but not from another subnet. How do you use port knowledge to narrow it down?
Course-wide
- What happens when you type a URL into the browser and press Enter?
- Why is the first request to a site slow and the second fast?
- What if DNS fails?
- What changes with HTTP/3?
- Where does TLS terminate, and why does it matter?
- Does the client ARP for the server's MAC address?
- What is HSTS and why does it matter for the first request?
- How many round trips does a cold HTTPS page load need, and how do you cut them?
- A user says the site is slow. How do you find which step of the journey is the problem?
- Connection timed out versus connection refused: what is the difference?
- How does the request end up at the nearest CDN edge?
- What happens on the second request to the same site, and what about other hostnames on the page?
- Why does typing google.com end up at www.google.com?
- You said the DNS answer is cached. Cached where, and for how long?
- Has any of the journey already happened before the user presses Enter?
- What if the user typed a search term instead, or pressed Back?
- Which parts of a URL are sent to the server, and where do they go?
- Lookups inside a Kubernetes pod stall for about five seconds now and then. How do you diagnose it?
- You changed a DNS record two hours ago and some users still reach the old server. Why?
- Is a cold DNS lookup three round trips, one each to root, TLD and authoritative?
- All the root servers vanish. What still works, and for how long?
- NXDOMAIN, NODATA and SERVFAIL: what does each mean and how is it cached?
- Does DNS use UDP or TCP?
- How does DNS cache poisoning work, and what stopped the Kaminsky attack?
- Why does the same URL resolve to different addresses for different users?
- How does a request to google.com reach a server at Google's scale?
- A user's page is slow only in India. How do you find the layer?
- At each router hop, what changes in the packet and what stays the same?
- SYN timeouts are reported but the access log is empty. What do you suspect?
- The final ACK of the three-way handshake is lost. What happens?
- You see 10,000 new connections per second to one backend and connect starts failing. Do the maths.
- Writes of small messages stall for 40 ms. What is happening?
- A fresh connection takes several round trips to fetch a 200 KB response. Why?
- Large responses hang but small ones work. What is your first suspect?
- What does each TLS round trip buy, and what did 1.3 change?
- How does HTTPS stop someone on the same wifi reading your traffic, and what still leaks?
- curl accepts the certificate but Chrome rejects it, or the reverse. What does the direction tell you?
- At midnight UTC, traffic to the API drops 90% and CPU is idle. Walk through it.
- TLS hangs after the ClientHello for some clients only. What could cause it?
- Why is HTTP/3 usually not faster on the first request to a new site?
- Intermittent 502s behind the load balancer, under 1% of requests, and the backends look healthy. What is the usual cause?
- The load balancer shows all targets green but users get 503s. How?
- Behind an L4 balancer, one gRPC backend is hot and nine are idle. Why?
- Latency has risen but CPU and request rate are flat. Where do you look?
- APM says 45 ms, but users see 3 seconds. Where did the time go?
- Ping works, dig +trace works, the link looks fine, and the site is down. What next?
- Facebook went offline in October 2021. Was BGP the cause, and why did DNS die with it?
- A DNS provider is under DDoS. How do you design so one provider cannot take you down?
- After 30 September 2021, old clients failed on Let's Encrypt certificates while browsers worked. Why?
- In October 2025 a DNS record for DynamoDB in us-east-1 went empty. What does that teach?
- A config file doubled in size and every edge proxy returned 5xx, but responders suspected a DDoS. What went wrong?