devops-interview-handbook

Networking Interview Questions

Table of Contents

TCP/IP Fundamentals

Q1: Explain the OSI model and TCP/IP model.

Difficulty: Junior

Answer:

OSI Model (7 Layers):

  1. Physical: Electrical signals, cables
  2. Data Link: Frames, MAC addresses, switches
  3. Network: IP addresses, routing, routers
  4. Transport: TCP/UDP, ports, reliability
  5. Session: Session management
  6. Presentation: Data encryption, compression
  7. Application: HTTP, FTP, SMTP

TCP/IP Model (4 Layers):

  1. Link: Physical + Data Link (Ethernet, WiFi)
  2. Internet: Network layer (IP, ICMP)
  3. Transport: TCP, UDP
  4. Application: Application + Presentation + Session (HTTP, DNS)

Key Differences:

Real-world Context: HTTP request: Application layer → TCP segments (Transport) → IP packets (Internet) → Ethernet frames (Link).

Follow-up: What layer does a router operate at? (Network layer - Layer 3, routes IP packets)

Q2: What is the difference between TCP and UDP?

Difficulty: Junior

Answer:

TCP (Transmission Control Protocol):

UDP (User Datagram Protocol):

Key Differences:

Real-world Context: Web browsing uses TCP (need reliable delivery). Video streaming uses UDP (speed more important than perfect delivery).

Follow-up: When would you choose UDP over TCP? (Real-time applications where speed > reliability: gaming, live video, DNS queries)

Q3: Explain the TCP three-way handshake.

Difficulty: Mid

Answer:

Three-way handshake establishes TCP connection before data transfer.

Process:

  1. SYN: Client sends SYN (synchronize) packet with initial sequence number
  2. SYN-ACK: Server responds with SYN-ACK (acknowledges client’s SYN, sends own SYN)
  3. ACK: Client sends ACK (acknowledges server’s SYN)

State Transitions:

Why Three-Way?

Connection Termination (Four-Way Handshake):

  1. FIN from one side
  2. ACK
  3. FIN from other side
  4. ACK

Real-world Context: Browser connects to web server. Three-way handshake establishes connection, then HTTP request sent over TCP connection.

Follow-up: What is SYN flood attack? (Attacker sends many SYN packets, doesn’t complete handshake, exhausts server resources)

Q4: What are ports and how do they work?

Difficulty: Junior

Answer:

Ports are 16-bit numbers (0-65535) that identify specific processes/services on a host.

Port Ranges:

How it Works:

Example:

Real-world Context: Server runs web (80), SSH (22), database (5432). Client connects to specific port to reach specific service.

Follow-up: What’s the difference between source and destination port? (Destination: service port, Source: client’s ephemeral port)

Q5: Explain subnetting and CIDR notation.

Difficulty: Mid

Answer:

Subnetting:

CIDR (Classless Inter-Domain Routing):

Common CIDR Blocks:

Subnetting Example:

Real-world Context: VPC with 10.0.0.0/16. Create subnets: 10.0.1.0/24 (public), 10.0.2.0/24 (private). Each subnet has 254 usable IPs.

Follow-up: How do you calculate number of hosts in a subnet? (2^(32-prefix) - 2, subtract 2 for network and broadcast addresses)

DNS

Q6: How does DNS resolution work?

Difficulty: Mid

Answer:

DNS (Domain Name System) translates domain names to IP addresses.

Resolution Process:

  1. Check Local Cache: Browser/OS cache
  2. Check Hosts File: Local file override
  3. Query Recursive Resolver: ISP’s DNS server
  4. Query Root Nameservers: “.” (13 root servers)
  5. Query TLD Nameservers: “.com” nameservers
  6. Query Authoritative Nameservers: Domain’s nameservers
  7. Return IP Address: Cached and returned

DNS Record Types:

Example:

Query: www.example.com
1. Recursive resolver → Root: "Where is .com?"
2. Root → ".com nameservers"
3. Recursive → .com: "Where is example.com?"
4. .com → "example.com nameservers"
5. Recursive → example.com: "Where is www.example.com?"
6. example.com → "192.0.2.1"
7. Return to client

Real-world Context: Browser requests www.google.com. DNS resolves to 142.250.191.14. Browser connects to that IP.

Follow-up: What’s the difference between recursive and authoritative nameservers? (Recursive: queries on behalf of clients, Authoritative: owns domain records)

Q7: What is DNS caching and TTL?

Difficulty: Mid

Answer:

DNS Caching:

TTL (Time To Live):

TTL Values:

Caching Layers:

  1. Browser cache (minutes)
  2. OS cache (hours)
  3. Recursive resolver cache (respects TTL)
  4. Authoritative server (no cache)

Example:

A record: www.example.com → 192.0.2.1 (TTL: 3600)
- Cached for 1 hour
- After 1 hour, new query made
- If IP changes, takes up to TTL to propagate

Real-world Context: Change website IP. Set low TTL (300s) before change. After change, old IP cached for max 5 minutes. Then new IP used.

Follow-up: What happens if you set TTL too low? (More DNS queries, higher load on nameservers, slower resolution)

Q8: Explain DNS record types: A, AAAA, CNAME, MX, TXT.

Difficulty: Mid

Answer:

A Record:

AAAA Record:

CNAME Record:

MX Record:

TXT Record:

Common Use Cases:

Real-world Context: Website: A record. Email: MX record. Subdomain: CNAME to main domain. SPF: TXT record.

Follow-up: Why can’t you use CNAME on root domain? (Root domain needs other records like MX, NS. CNAME conflicts with them)

Load Balancing

Q9: What is load balancing and what are the different types?

Difficulty: Mid

Answer:

Load balancing distributes incoming traffic across multiple servers to improve performance and availability.

Types:

1. Layer 4 (Transport Layer) Load Balancing:

2. Layer 7 (Application Layer) Load Balancing:

Algorithms:

Real-world Context: 3 web servers behind load balancer. L7 LB routes /api to API servers, /static to static servers. L4 LB just distributes by IP/port.

Follow-up: What’s the difference between L4 and L7 load balancing? (L4: IP/port based, L7: HTTP content based, more features)

Q10: Explain health checks in load balancing.

Difficulty: Mid

Answer:

Health checks determine if backend servers are healthy and can receive traffic.

Types:

1. Active Health Checks:

2. Passive Health Checks:

Health Check Parameters:

Example:

Health check: GET /health
Interval: 30s
Timeout: 5s
Healthy: 2 consecutive successes
Unhealthy: 3 consecutive failures

Real-world Context: Load balancer checks /health every 30s. If server fails 3 times, removed from pool. When healthy again, added back.

Follow-up: What happens if health check endpoint is slow? (May cause false negatives, use separate lightweight endpoint, adjust timeout)

Q11: What is session affinity (sticky sessions) and when to use it?

Difficulty: Mid

Answer:

Session affinity (sticky sessions) ensures client requests go to same backend server.

How it Works:

Use Cases:

Implementation:

Drawbacks:

Alternatives:

Real-world Context: E-commerce site with shopping cart stored in server memory. Use sticky sessions so cart persists. Better: Store cart in Redis.

Follow-up: What are the problems with sticky sessions? (Uneven load, lost sessions on server failure, doesn’t scale well)

CDN & Caching

Q12: What is a CDN and how does it work?

Difficulty: Mid

Answer:

CDN (Content Delivery Network) is a distributed network of servers that cache content closer to users.

How it Works:

  1. User requests content (e.g., image)
  2. Request routed to nearest CDN edge server
  3. If cached (cache hit), serve immediately
  4. If not cached (cache miss), fetch from origin, cache, serve
  5. Subsequent requests served from cache

Benefits:

CDN Providers:

Use Cases:

Real-world Context: Website serves images from S3. Use CloudFront CDN. Images cached at edge locations worldwide. Users get faster loads.

Follow-up: What content should you put on CDN? (Static assets, public content. Not: dynamic content, private content, frequently changing data)

Q13: Explain cache invalidation strategies.

Difficulty: Mid

Answer:

Cache invalidation removes or updates cached content when it changes.

Strategies:

1. TTL (Time To Live):

2. Cache Invalidation:

3. Versioning:

4. ETags:

5. Cache-Control Headers:

Real-world Context: Update website CSS. Use versioning: style.css?v=2. CDN caches new version. Old version expires naturally.

Follow-up: What’s the difference between TTL and manual invalidation? (TTL: automatic but may be stale, Manual: immediate but requires action)

Network Security

Q14: What is a firewall and how does it work?

Difficulty: Mid

Answer:

Firewall is network security device that filters traffic based on rules.

Types:

1. Packet Filtering Firewall:

2. Stateful Firewall:

3. Application Firewall (WAF):

Firewall Rules:

Example Rules:

Allow: TCP port 80 (HTTP) from any
Allow: TCP port 443 (HTTPS) from any
Allow: TCP port 22 (SSH) from 10.0.0.0/8
Deny: All other traffic

Real-world Context: Web server firewall: Allow 80/443 from internet, Allow 22 from office IP, Deny everything else.

Follow-up: What’s the difference between stateful and stateless firewall? (Stateful: tracks connections, allows return traffic. Stateless: inspects each packet independently)

Q15: Explain VPN and how it works.

Difficulty: Mid

Answer:

VPN (Virtual Private Network) creates encrypted tunnel over public network.

How it Works:

  1. Client connects to VPN server
  2. Encrypted tunnel established
  3. All traffic routed through tunnel
  4. VPN server decrypts and forwards to destination
  5. Response encrypted and sent back

Types:

1. Site-to-Site VPN:

2. Remote Access VPN:

3. SSL/TLS VPN:

4. IPsec VPN:

Benefits:

Real-world Context: Employee connects to company VPN. All traffic encrypted. Can access internal servers as if on office network.

Follow-up: What’s the difference between VPN and proxy? (VPN: encrypts all traffic, routes all traffic. Proxy: only specific traffic, may not encrypt)

Q16: What is DDoS and how do you mitigate it?

Difficulty: Senior

Answer:

DDoS (Distributed Denial of Service) overwhelms target with traffic from multiple sources.

Types:

1. Volume-Based:

2. Protocol-Based:

3. Application-Based:

Mitigation Strategies:

1. CDN/DDoS Protection:

2. Rate Limiting:

3. Firewall Rules:

4. Scaling:

5. Monitoring:

Real-world Context: Website under DDoS attack. Use Cloudflare to filter traffic. Rate limit per IP. Scale infrastructure. Block malicious IPs.

Follow-up: What’s the difference between DDoS and DoS? (DoS: single source, DDoS: multiple sources, harder to block)

Cloud Networking

Q17: Explain VPC, subnets, and routing in cloud.

Difficulty: Mid

Answer:

VPC (Virtual Private Cloud):

Subnets:

Routing:

Example Architecture:

VPC: 10.0.0.0/16
  ├── Public Subnet: 10.0.1.0/24
  │   └── Route: 0.0.0.0/0 → IGW
  └── Private Subnet: 10.0.2.0/24
      └── Route: 0.0.0.0/0 → NAT Gateway

Security:

Real-world Context: AWS VPC with public subnets for load balancers, private subnets for application servers and databases.

Follow-up: What’s the difference between public and private subnet? (Public: route to IGW, Private: route to NAT, no direct internet)

Q18: What is VPC peering and when would you use it?

Difficulty: Mid

Answer:

VPC peering connects two VPCs using private IP addresses.

Characteristics:

Use Cases:

Setup:

  1. Request peering connection
  2. Accept peering connection
  3. Update route tables in both VPCs
  4. Update security groups

Limitations:

Alternative:

Real-world Context: Development VPC needs access to shared services VPC (databases, monitoring). Peer VPCs, update routes.

Follow-up: How do you connect 3 VPCs? (Need 3 peerings: A-B, A-C, B-C. Or use Transit Gateway with one attachment per VPC)

Q19: Explain load balancing in cloud (ALB, NLB, GLB).

Difficulty: Mid

Answer:

AWS Application Load Balancer (ALB):

AWS Network Load Balancer (NLB):

AWS Gateway Load Balancer (GLB):

GCP Load Balancer:

Azure Load Balancer:

Real-world Context: Web app → ALB (path-based routing, SSL termination). High-performance API → NLB (low latency). Security inspection → GLB.

Follow-up: When would you use ALB vs NLB? (ALB: HTTP routing, SSL termination. NLB: TCP/UDP, low latency, static IPs)

Q20: What is service mesh and how does it relate to networking?

Difficulty: Senior

Answer:

Service mesh is infrastructure layer for microservices communication, handling service-to-service communication.

Components:

Features:

Service Mesh Solutions:

How it Works:

Real-world Context: Microservices architecture. Service mesh handles: service discovery, load balancing, mTLS, metrics, without changing application code.

Follow-up: What’s the difference between service mesh and API gateway? (Service mesh: service-to-service, API gateway: external-to-service, north-south traffic)

Summary

Networking is fundamental to DevOps. Understand TCP/IP, DNS, load balancing, security, and cloud networking. Practice troubleshooting network issues and designing network architectures.

Next Steps:

This site is open source. Improve this page.