Networking interview prep

• Anycast Routing — Same IP announced from multiple PoPs, BGP selects closest, DDoS resilience, and how 1.1.1.1 and 8.8.8.8 work.
• AWS Network ACLs — Stateless rule evaluation, numbered rules, explicit allow and deny, ephemeral port ranges, and differences fro
• AWS PrivateLink — Interface VPC endpoints, NLB-backed endpoint services, private connectivity without internet traversal, and en
• AWS Security Groups — Stateful filtering, inbound/outbound rules, port ranges, security group references as sources, and no-deny-rul
• BGP Routing — AS numbers, iBGP vs eBGP, path selection attributes (MED/LocalPref/AS_PATH), route aggregation, and BGP hijack
• CDN Architecture — Edge PoPs, cache hierarchies, cache invalidation, origin shield, and CloudFront vs Fastly.
• CNI Plugin Comparison — Calico, Flannel, Cilium, Antrea CNI plugins — routing modes, NetworkPolicy support, performance, and selection
• Diagnosing Connectivity Failures — Interpreting ping and traceroute output, firewall drop vs reject behavior, MTU black holes, and asymmetric rou
• Direct Connect & Site-to-Site VPN — Dedicated circuits, hosted connections, virtual interface types (public/private/transit), BGP over Direct Conn
• DNS Caching & TTL — TTL mechanics, negative caching, NXDOMAIN propagation, stale-while-revalidate, cache poisoning attacks, and re
• DNS over HTTPS & TLS (DoH/DoT) — DoH vs DoT vs classic DNS, RFC 7858 and RFC 8484, privacy guarantees, enterprise interception challenges, and
• DNS Record Types — A, AAAA, CNAME, MX, TXT, SRV, NS, PTR, SOA — use cases and common configuration mistakes.
• DNS Resolution — DNS hierarchy, recursive resolution, caching, TTL, negative caching, and DNSSEC validation.
• DNSSEC — DNSSEC chain of trust, ZSK/KSK key pairs, RRSIG/DNSKEY/DS records, validation process, and real-world adoption
• eBPF Networking & XDP — eBPF program types, XDP packet processing pipeline, Cilium eBPF dataplane, BPF maps, and bpftrace for network
• Envoy Proxy & xDS API — Envoy listener-filter-cluster pipeline, the xDS dynamic configuration protocol, circuit breaking, outlier dete
• gRPC vs REST — Protocol Buffers vs JSON serialization, streaming modes (unary/server/client/bidirectional), HTTP/2 multiplexi
• Health Checks and Circuit Breaking — Active vs passive health checks, HTTP 200 probes, TCP checks, intervals and thresholds, and circuit breaker pa
• HTTP/2 & HTTP/3 — Multiplexing streams, HPACK/QPACK header compression, server push, QUIC UDP transport, and 0-RTT connection re
• HTTP/HTTPS & TLS — HTTP/1.1 keep-alive and pipelining, request/response structure, TLS certificate chain validation, and HTTPS se
• Hybrid Cloud Connectivity — Site-to-site VPN architecture, SD-WAN to cloud integration, Transit Gateway with Direct Connect, and latency c
• IP Addressing & CIDR — CIDR notation, subnetting, private RFC 1918 ranges, IPv6 basics, and calculating usable hosts per subnet.
• IPSec & VPN Deep Dive — IPSec transport vs tunnel mode, IKEv1 vs IKEv2, ESP vs AH, AWS Site-to-Site VPN, and debugging phase 1/2 failu
• iptables and nftables — Netfilter chains (INPUT/OUTPUT/FORWARD/PREROUTING/POSTROUTING), tables (filter/nat/mangle), rule evaluation or
• IPv6 Addressing & Dual Stack — IPv6 address format, address types, SLAAC vs DHCPv6, NDP, dual-stack vs NAT64, and Kubernetes dual-stack clust
• Kubernetes Network Policies — NetworkPolicy spec, ingress/egress rules, podSelector and namespaceSelector, and CNI support (Calico/Cilium).
• L4 vs L7 Load Balancing — Layer 4 TCP/UDP forwarding vs Layer 7 HTTP routing, when to use each, and hybrid architectures.
• Latency Diagnosis — Diagnosing network vs application latency, p99 vs average, cross-region trade-offs, and queuing theory.
• Load Balancing Algorithms — Round-robin, weighted, least-connections, IP hash, random, power-of-two-choices, and consistent hashing with v
• MPLS — Label switching, Label Switched Paths, LDP and RSVP-TE signaling, MPLS VPN services, and traffic engineering c
• mTLS & SPIFFE/SPIRE Workload Identity — mTLS handshake mechanics, SPIFFE workload identity, SPIRE attestation, Istio PeerAuthentication, and certifica
• MTU & IP Fragmentation — Ethernet 1500-byte MTU, jumbo frames at 9000 bytes, Path MTU Discovery, DF bit, VPN encapsulation overhead, an
• NAT & PAT — SNAT vs DNAT, connection tracking, port forwarding, NAT traversal techniques, and why NAT breaks peer-to-peer
• Network Chaos Engineering — tc netem for latency/loss injection, Toxiproxy, chaos mesh network faults, testing circuit breakers and timeou
• Network Debugging Toolkit — Layered debugging methodology, tcpdump, Wireshark, mtr, netstat, and cloud-specific tools.
• Network Observability & Flow Analysis — NetFlow/sFlow/IPFIX, VPC flow logs, Hubble, Prometheus network metrics, East-West traffic visibility, and anom
• nginx and HAProxy Configuration — nginx upstream blocks and proxy_pass directives, HAProxy ACLs and backend pools, stats page, and connection li
• OSI & TCP/IP Models — Seven-layer OSI model, four-layer TCP/IP stack, encapsulation, and how HTTP maps to each layer.
• OSPF & EIGRP — Link-state vs distance-vector algorithms, OSPF areas and DR/BDR election, EIGRP DUAL algorithm, and enterprise
• Overlay vs Underlay Networking — Underlay is the real physical network. Overlay is a virtual network built on top using encapsulation (VXLAN, G
• Packet Capture & Analysis — tcpdump syntax and BPF expressions, Wireshark display filters, pcap format, and decoding protocol layers from
• QUIC Protocol & Transport — QUIC over UDP, 0-RTT handshake, multiplexed streams without HOL blocking, connection migration, and HTTP/3.
• Rate Limiting Algorithms — Token bucket, leaky bucket, sliding window counter, fixed window -- tradeoffs, boundary bursts, and Redis-base
• Route 53 & DNS Routing Policies — AWS Route 53 hosted zones, routing policies (simple/weighted/latency/failover/geolocation), health checks, and
• Router vs Switch — Router operates at Layer 3 (Network) using IP addresses to connect DIFFERENT networks. Switch operates at Laye
• SD-WAN — Underlay vs overlay separation, intelligent path selection, WAN optimization, and SD-WAN vendor landscape (Cis
• Service Discovery — Consul service mesh, CoreDNS in Kubernetes, headless services, SRV records, and client-side vs server-side dis
• Service Mesh — Envoy sidecar, Istio vs Linkerd, mTLS between services, traffic management, observability, and eBPF alternativ
• Split-Horizon DNS — Internal vs external DNS views for the same domain, use in VPCs and split-tunnel VPNs, and private hosted zone
• Sticky Sessions — Cookie-based affinity, source IP hashing, JSESSIONID pinning, and how sticky sessions conflict with horizontal
• TCP Congestion Control — Slow start, congestion avoidance, CUBIC and BBR algorithms, congestion window vs receive window, and tuning TC
• TCP vs UDP — Reliability vs speed tradeoffs, head-of-line blocking, QUIC protocol, and choosing the right transport for eac
• TCP/IP Stack & Handshake — TCP 3-way handshake, SYN/ACK/FIN/RST flags, TCP state machine, congestion control algorithms, and Nagle algori
• TLS Handshake & Certificates — TLS 1.2 vs 1.3 handshake, certificate chain, mTLS, certificate rotation, and SNI.
• Transit Gateway — Hub-and-spoke topology for VPCs, centralized routing tables, TGW peering across regions, and comparison with V
• VLAN & VXLAN — 802.1Q tagging, trunk vs access ports, VXLAN encapsulation over UDP port 4789, VTEP endpoints, and NVO3 overla
• VPC Design — Subnet design, CIDR planning, route tables, internet gateway, NAT gateway, and multi-tier architectures.
• VPC Peering — Transitive peering limitations, non-overlapping CIDR requirement, inter-region peering, and routing table conf
• WAF and DDoS Protection — WAF rule sets (OWASP CRS), rate limiting, AWS Shield Standard vs Advanced, Cloudflare Magic Transit, and scrub
• WebSockets & Real-Time Protocols — WebSocket upgrade handshake, full-duplex frames, ping/pong heartbeat, and comparison with SSE and long-polling
• WireGuard VPN Protocol — WireGuard cryptographic design, configuration, kernel integration, Kubernetes use (Cilium/Flannel encryption),
• Zero Trust Networking — BeyondCorp identity-based access, microsegmentation, ZTNA architecture, mTLS everywhere, and never-trust-alway

Start free on Cariara · Coding problems · System design studio