Interview Q&A · 40 questions · 21 answered publicly
Networking Interview Questions
Ordered by how often they're asked. Sign in free to see every answer, rate your confidence and run timed mock interviews.
-
Most asked What happens, at the network level, when you type a URL into a browser and press Enter?
Summary
The browser resolves the host name with DNS, opens a TCP connection (or QUIC over UDP for HTTP/3) to the server's IP and port 443, performs a TLS handshake that verifies the certificate, sends an HTTP request and renders the response, fetching further resources over the same connection.
Longer Answer
In more detail: the OS checks its cache and asks a recursive resolver, which may walk root, TLD and authoritative servers. The route to the server's IP goes via the default gateway and many routers; NAT may rewrite the source address. TCP's three-way handshake costs one round trip and TLS 1.3 another, which is why connection reuse, HTTP/2 multiplexing and CDNs near users matter. The response may come from a CDN edge cache rather than the origin.
Key Points
- DNS lookup, possibly cached at several levels.
- TCP handshake (or QUIC) to port 443.
- TLS handshake and certificate validation.
- HTTP request/response, then more requests on the same connection.
Deep dive: Networking Tutorial: Networking Introduction
-
Most asked What's the difference between TCP and UDP, and when would you choose UDP?
Summary
TCP provides a reliable, ordered byte stream with connection setup, retransmission, flow and congestion control. UDP sends independent datagrams with no handshake or delivery guarantees. Choose UDP for small request/response exchanges (DNS), real-time media where late data is useless, or when a protocol implements its own reliability (QUIC).
Longer Answer
UDP's 8-byte header and lack of state make it cheap, but firewalls and NAT must track UDP flows by timeouts, and many networks block it. QUIC (under HTTP/3) runs over UDP to get independent streams, faster connection setup and connection migration, while implementing reliability and encryption itself.
Key Points
- TCP: reliable, ordered, connection-oriented.
- UDP: datagrams, no guarantees, no handshake.
- UDP for DNS, media, games, QUIC.
- UDP is often blocked or rate-limited on corporate networks.
Deep dive: Networking Tutorial: UDP
-
Most asked What is CIDR notation? How many usable addresses are in a /26, and in an AWS /26 subnet?
Summary
CIDR writes a block as a base address plus the number of fixed prefix bits. A /26 leaves 6 host bits, so 64 addresses; 62 are usable in classic networking (minus network and broadcast), and 59 in an AWS subnet, which reserves 5 addresses.
Longer Answer
Each extra prefix bit halves the block: /24 = 256, /25 = 128, /26 = 64. Cloud providers reserve addresses for the router, DNS and future use (AWS and Azure 5, Google Cloud 4). Subnets can't be resized, so sizing them for growth (especially for Kubernetes pods) matters.
Key Points
- 2^(32 - prefix) addresses.
- /26 = 64 addresses.
- AWS reserves 5 per subnet: 59 usable.
- Subnets can't be resized later.
Deep dive: Networking Tutorial: Subnets and CIDR
-
Most asked How does DNS resolution work, and what does a record's TTL control?
Summary
A stub resolver asks a recursive resolver, which (if not cached) queries a root server, then the TLD server, then the domain's authoritative server, and caches the answer for the record's TTL. The TTL controls how long resolvers and clients may reuse an answer, and therefore how quickly changes propagate.
Longer Answer
Before migrations, lower TTLs at least one old-TTL period in advance. Negative answers (NXDOMAIN) are cached too, per the SOA record. Applications can cache beyond the TTL (JVM settings, connection pools that never reconnect). Cloud DNS adds private zones, split horizon and routing policies (weighted, latency, failover).
Key Points
- Recursive resolver walks root -> TLD -> authoritative.
- Answers cached for the TTL.
- Lower TTLs before changes.
- Negative caching and client caches extend staleness.
Deep dive: Cloud Networking in Production: The Migration That Took Two Days
-
Most asked What does TLS provide, and how does certificate validation work?
Summary
TLS provides encryption, integrity and server authentication. The server presents a certificate for its name, plus intermediates; the client checks the name, validity dates and that the chain leads to a trusted root CA, and the server proves it holds the private key during the handshake.
Longer Answer
TLS 1.3 completes the handshake in one round trip and only allows forward-secret key exchange. Common failures: expired certificates (automate renewal with ACME, ACM or Key Vault), hostname mismatch, missing intermediates (browsers may cope, other clients fail) and private CAs not trusted by clients. mTLS adds client certificates for service-to-service authentication.
Key Points
- Encryption, integrity, authentication.
- Name, dates and chain to a trusted root.
- Serve the full chain.
- Automate renewal and monitor expiry.
Deep dive: Networking Tutorial: HTTPS and TLS
-
Most asked What do 502, 503 and 504 errors from a load balancer usually mean?
Summary
502 Bad Gateway: the load balancer got an invalid or no response from the target (connection closed, reset, crashed process). 503 Service Unavailable: no healthy targets or the service is shedding load. 504 Gateway Timeout: the target didn't respond within the load balancer's timeout.
Longer Answer
Compare load balancer error counts with the app's own 5xx: 502s without app errors point at connection handling (keep-alive timeout mismatch), 504s at slow requests or timeouts set too low, 503s at health checks or capacity. Access logs show target processing times and whether a target responded.
Key Points
- 502: bad/no response from the target.
- 503: no healthy targets or overload.
- 504: target too slow.
- Compare LB errors with app errors.
Deep dive: Cloud Networking in Production: Random 502s Behind the Load Balancer
-
Most asked How does NAT work, and what are its limits?
Summary
Source NAT rewrites a private source address and port to a public address and port, records the mapping, and reverses it for replies. Its limits: hosts behind it can't receive unsolicited inbound connections, and each public IP has a finite number of ports per destination, so many connections to one destination can exhaust it. Mappings also expire after an idle timeout.
Longer Answer
AWS NAT gateways support about 55,000 simultaneous connections per unique destination per IP and up to 8 IPs;
ErrorPortAllocationshows exhaustion. Idle TCP connections are dropped after 350 seconds. Fixes include connection reuse, more NAT IPs, splitting traffic, or private connectivity.Key Points
- Rewrites source IP/port; tracks mappings.
- No unsolicited inbound connections.
- Per-destination port limits.
- Idle timeouts drop long-idle connections.
Deep dive: Cloud Networking in Production: Timeouts to One Partner API
-
Most asked What's the difference between stateful and stateless firewalls? Give cloud examples.
Summary
A stateful firewall tracks connections and automatically allows reply traffic; a stateless one evaluates every packet independently, so replies need explicit rules to the initiator's ephemeral ports. AWS security groups, Azure NSGs and Google Cloud firewall rules are stateful; AWS network ACLs are stateless.
Longer Answer
Stateless rules must allow return traffic on a wide ephemeral range (1024-65535 on AWS, because Linux, Windows, NAT gateways and load balancers use different ranges). Most teams use security groups for real filtering and keep NACLs as coarse guardrails.
Key Points
- Stateful: replies allowed automatically.
- Stateless: replies need explicit rules.
- SGs/NSGs/GCP firewall = stateful; NACL = stateless.
- Allow 1024-65535 for return traffic in NACLs.
Deep dive: Cloud Networking in Production: The Network ACL That Broke Some Clients
-
Most asked A service is unreachable. How do you troubleshoot it systematically?
Summary
Work up the layers from the client: does DNS resolve to the expected address; is there a route; does a TCP connection open (timeout suggests filtering, 'connection refused' suggests nothing listening); does TLS validate; what does HTTP return; is the app listening on the right address? Then use flow logs and reachability tools to find the blocking rule.
Longer Answer
Commands:
dig,ip route get,nc -vz host port,openssl s_client,curl -v,ss -tlnp,tcpdump. Cloud: VPC Flow Logs, Reachability Analyzer, Azure Network Watcher, Google Cloud Connectivity Tests. Don't rely on ping; ICMP is often blocked.Key Points
- DNS -> route -> TCP -> TLS -> HTTP -> app.
- Timeout vs refused tells you a lot.
- Flow logs show accepts and rejects.
- Ping alone proves nothing.
Deep dive: Networking Tutorial: Network Troubleshooting
-
Most asked Design a VPC for a three-tier web application on AWS.
Summary
A /16 from the central address plan, spread over three availability zones. Public subnets hold the load balancer and NAT gateways (one per zone); private app subnets hold compute; private data subnets hold databases. Security groups chain ALB -> app -> database by group reference. Add gateway endpoints for S3/DynamoDB, interface endpoints for other AWS APIs, and flow logs.
Longer Answer
Size app subnets for growth (/20 or larger for containers). Route tables: public subnets default to the internet gateway, private ones to the NAT gateway in the same zone. No public IPs on instances; administrative access through Session Manager rather than SSH bastions. Azure: VNet with subnets, NSGs, NAT gateway and Application Gateway; GCP: VPC with regional subnets, firewall rules, Cloud NAT and an Application Load Balancer.
Key Points
- Three AZs, public/app/data tiers.
- NAT per zone; IGW for public subnets.
- Security groups by reference.
- Endpoints and flow logs.
-
Most asked Security groups versus network ACLs: how do they differ and how would you use them together?
Summary
Security groups attach to network interfaces, are stateful, allow-only and can reference other security groups. Network ACLs attach to subnets, are stateless, evaluated in rule-number order and support deny. Use security groups for application-level least privilege; keep NACLs simple (allow-all plus a few deny rules as guardrails).
Longer Answer
Restrictive NACLs must allow return traffic on ephemeral ports in both directions, and are easy to get wrong. Security group references (app-sg -> db-sg) keep working as instances scale and are tighter than CIDR rules.
Key Points
- SG: stateful, ENI-level, allow-only.
- NACL: stateless, subnet-level, ordered, allow/deny.
- SG references for tiers.
- NACLs as coarse guardrails.
Deep dive: Networking Tutorial: Security Groups and Network ACLs
-
Most asked Explain the OSI and TCP/IP models. Why do engineers still talk about 'layer 4' and 'layer 7'?
Summary
The TCP/IP model has four layers (link, internet, transport, application); the seven-layer OSI model is mostly used as vocabulary. 'Layer 4' means transport (TCP/UDP ports) and 'layer 7' means application (HTTP), so a layer 4 load balancer routes by IP and port while a layer 7 one can route by host, path or header.
Longer Answer
Each layer encapsulates the one above: an HTTP request inside a TCP segment, inside an IP packet, inside an Ethernet frame. Layer 3 is IP addressing and routing, layer 2 is MAC addresses and switches. Knowing the layer tells you which device or rule can affect a problem: security groups act on layers 3-4, a WAF on layer 7.
Key Points
- TCP/IP: link, internet, transport, application.
- OSI numbers are the common vocabulary.
- L4 = IP and port; L7 = HTTP content.
- Encapsulation adds a header per layer.
Deep dive: Networking Tutorial: OSI and TCP/IP Models
-
Most asked Walk through the TCP three-way handshake and connection teardown. What is TIME_WAIT and why can it cause problems?
Summary
The client sends SYN, the server replies SYN-ACK and the client sends ACK; both sides then agree on initial sequence numbers. To close, each side sends FIN and acknowledges the other's FIN. The side that closes first stays in TIME_WAIT (60 s on Linux) so late packets aren't mistaken for a new connection. Clients that open and close many short connections can run out of ephemeral ports while sockets sit in TIME_WAIT.
Longer Answer
Each new connection costs a round trip before data flows (plus TLS). Connection pools and keep-alive avoid both the latency and the TIME_WAIT build-up. Tuning such as
tcp_tw_reusehelps outbound connections, but the real fix is reusing connections. Behind NAT, the same pattern exhausts NAT ports to one destination.Key Points
- SYN, SYN-ACK, ACK.
- FIN in each direction to close.
- TIME_WAIT holds the 4-tuple for a while.
- Many short connections exhaust ports; reuse connections.
Deep dive: Networking Tutorial: TCP
-
Most asked Compare HTTP/1.1, HTTP/2 and HTTP/3.
Summary
HTTP/1.1 is text-based with one request at a time per connection. HTTP/2 uses binary frames and multiplexes many streams over one TCP connection with header compression. HTTP/3 does the same over QUIC (UDP), removing TCP head-of-line blocking and combining transport and TLS setup into one round trip.
Longer Answer
Browsers open around six HTTP/1.1 connections per host; HTTP/2 needs one. A lost packet stalls all HTTP/2 streams because TCP delivers in order; QUIC delivers streams independently and supports connection migration. gRPC requires HTTP/2 end to end. Typically you enable HTTP/2 and HTTP/3 at the CDN or load balancer and keep HTTP/1.1 to backends.
Key Points
- 1.1: one request at a time per connection.
- 2: multiplexed streams over TCP.
- 3: QUIC over UDP, no TCP head-of-line blocking.
- Enable at the edge; gRPC needs HTTP/2.
-
Most asked Compare layer 4 and layer 7 load balancers. When would you use each?
Summary
Layer 4 balancers route TCP/UDP by IP and port, preserve the protocol, handle very high throughput and offer static IPs (AWS NLB, Azure Load Balancer). Layer 7 balancers understand HTTP, terminate TLS and route by host, path or headers, and integrate WAFs and authentication (AWS ALB, Azure Application Gateway, Google Cloud Application Load Balancer).
Longer Answer
Use L7 for web apps and APIs (path routing, HTTP/2 and gRPC, redirects, header manipulation). Use L4 for non-HTTP protocols, client IP preservation, fixed IPs for allow-lists, or extreme performance. Often both appear: an NLB in front for static IPs and an ALB or ingress behind it.
Key Points
- L4: IP/port, any TCP/UDP, static IPs.
- L7: HTTP-aware routing, TLS, WAF.
- Choose by protocol and features.
- They can be combined.
Deep dive: Networking Tutorial: Load Balancers
-
Most asked Why can keep-alive timeouts cause intermittent 502 errors behind a load balancer?
Summary
If the backend closes idle connections before the load balancer does, the load balancer can send a request on a connection the backend is closing at that moment and gets no response, returning 502. The backend's keep-alive timeout must be longer than the load balancer's idle timeout (60 s default on an AWS ALB; Node.js defaults to 5 s, Gunicorn to 2 s).
Longer Answer
The 502s don't appear in application logs because the request never reached the handler. ALB access logs show the target didn't respond. The same rule applies to any proxy chain (nginx to app server, Envoy to service).
Key Points
- Backend timeout must exceed the proxy's.
- Defaults are mismatched in many stacks.
- 502s without app errors are the signal.
- Applies to every proxy hop.
Deep dive: Cloud Networking in Production: Random 502s Behind the Load Balancer
-
Most asked How should you design health checks for services behind a load balancer?
Summary
Make load balancer and readiness checks answer 'can this instance serve now?' using only local state, keep liveness checks trivial, and monitor shared dependencies separately. Health checks that call the database or third-party APIs fail on every instance at once during a dependency blip, removing all targets.
Longer Answer
Use separate endpoints (/livez, /readyz). Handle dependency failures in the request path with timeouts, circuit breakers and graceful degradation. Remember an AWS ALB fails open when all targets are unhealthy, and alert on sudden drops in healthy host count.
Key Points
- LB/readiness: local ability to serve.
- Liveness: process only.
- No shared dependencies in checks.
- Degrade gracefully instead.
Deep dive: Cloud Networking in Production: The Health Check That Took Everything Down
-
Most asked What makes a subnet public or private in AWS?
Summary
Its route table: a public subnet's default route (0.0.0.0/0) points to an internet gateway, a private subnet's to a NAT gateway or nowhere. Resources in a public subnet also need a public IP to be reachable from the internet.
Longer Answer
Both use private address ranges; there's no 'public CIDR'. Azure has no public subnet concept: inbound comes via public load balancers or public IPs on resources, outbound via NAT gateway or default outbound access (being retired). In Google Cloud, VMs without external IPs use Cloud NAT.
Key Points
- The default route decides.
- Public IPs needed for inbound.
- Same private ranges for both.
- Azure/GCP model it differently.
-
Most asked How do you connect many VPCs together, and why isn't VPC peering always enough?
Summary
Peering connects exactly two VPCs and isn't transitive, so a full mesh grows quadratically and is hard to segment. A hub such as AWS Transit Gateway (Azure Virtual WAN or hub VNet, Google Cloud Network Connectivity Center) lets every VPC attach once, with route tables for segmentation and central links to on-premises.
Longer Answer
Peering is still good for a few high-bandwidth pairs (no hourly attachment or data-processing charges on the hub). All options require non-overlapping CIDRs. Shared VPC models (Google Cloud Shared VPC, AWS VPC sharing) avoid connectivity altogether by letting several projects/accounts use one network.
Key Points
- Peering: 1-to-1, non-transitive.
- Mesh = n(n-1)/2 connections.
- Transit hub with route-table segmentation.
- No overlapping ranges anywhere.
Deep dive: Networking Tutorial: Connecting Networks
-
Most asked How do private subnets reach AWS services like S3 without going over the internet?
Summary
Use VPC endpoints: gateway endpoints (free, route-table based) for S3 and DynamoDB, and interface endpoints (PrivateLink, an ENI with a private IP plus private DNS) for most other services. Azure uses Private Endpoints and service endpoints; Google Cloud uses Private Google Access and Private Service Connect.
Longer Answer
Benefits: traffic stays on the provider network, NAT data-processing costs drop, and endpoint policies can restrict access to your own buckets or accounts, which helps prevent data exfiltration.
Key Points
- Gateway endpoints for S3/DynamoDB.
- Interface endpoints for other services.
- Saves NAT cost.
- Endpoint policies limit access.
Deep dive: Networking Tutorial: Private Access to Cloud Services
-
Most asked How would you migrate a production domain to a new load balancer with no downtime?
Summary
Lower the DNS TTL to 60-300 s at least one old-TTL period in advance, bring up the new target, shift traffic with weighted records in steps while watching errors, keep the old target serving until its traffic reaches zero, then remove it and raise the TTL again.
Longer Answer
Account for client-side caches (JVM DNS cache, long-lived connection pools) and negative caching of mistakes. Make sure TLS certificates and health checks are ready on the new target before shifting any traffic.
Key Points
- Lower TTL in advance.
- Weighted shift with monitoring.
- Keep the old target until idle.
- Watch client caches.
Deep dive: Cloud Networking in Production: The Migration That Took Two Days
- What are the private IPv4 ranges, and what are 100.64.0.0/10 and 169.254.0.0/16 used for?
- How does a router choose a route when several routes match a destination?
- What is MTU, and how can it break connections?
- What happens if two networks you need to connect have overlapping CIDRs, and what can you do?
- Your EKS pods are stuck in Pending with IP assignment errors. What's happening and how do you fix it?
- Design networking for a multi-account organisation on AWS.
- Calls to one external API time out intermittently at peak, while other destinations work. What do you suspect?
- Why does IPv6 exist and what changes in practice when you adopt it?
- CNAME, A and alias records: why can't the zone apex be a CNAME, and how do cloud DNS services work around it?
- What are ephemeral ports?
- How do you get the real client IP behind proxies and load balancers safely?
- How does DNS work inside a VPC, and how do you resolve names between the cloud and on-premises?
- How would you give an application fixed outbound IP addresses for a partner's allow-list?
- What are the options for connecting on-premises networks to the cloud?
- What is a CDN and how does it improve performance and resilience?
- How do you reduce cloud networking costs?
- What's the difference between Azure VNets and Google Cloud VPCs compared with AWS VPCs?
- How do you secure administrative access to instances in private subnets?
- What are VPC Flow Logs and what can't they tell you?