Networking Interview Questions and Answers

An ALB receives web traffic (HTTP and HTTPS) on listeners and sends it to target groups based on rules. Each target group holds the real backends (EC2 instances, IPs, Lambda or ECS tasks) and runs health checks.

• Listener: port and protocol (80, 443). Rules match on host header, path, headers or query string.
• Rules: api.example.com goes to the API target group, /images/* goes to another, and the default action handles the rest. This is how one ALB serves several domains or services.
• Target group: only healthy targets get traffic. ECS services register their tasks automatically.
• DNS: the ALB gets an AWS DNS name. In Route 53, create an alias A record from your domain to that name. In other DNS providers, use a CNAME for names that are not the root domain.
• Security: put the ALB in public subnets and the backends in private subnets. Let the backend security groups accept traffic only from the ALB security group.

What they are checking: Whether you understand listener rules, target groups, health checks and how DNS points to the ALB

A security group is a stateful firewall on an instance or network interface. A network ACL is a stateless firewall on a subnet. Stateful means the firewall remembers connections.

Use security groups as the main control (for example, DB group allows 5432 only from the app group). Use NACLs as a rough extra layer, such as blocking a bad IP range. Remember that a NACL needs the temporary ports (1024-65535) open for return traffic.

What they are checking: Whether you know the difference between stateful and stateless, and where each is used

A public subnet has a route to an Internet Gateway (IGW). A private subnet has no direct route to the internet.

• Public subnet: route table has 0.0.0.0/0 -> igw-xxxx. Instances need a public or Elastic IP to be reachable. Used for load balancers, bastion hosts and NAT gateways.
• Private subnet: route table has no IGW route. Used for application servers and databases.
• Internet Gateway: a managed AWS part that scales by itself. It allows two-way internet traffic for resources with public IPs.
• NAT Gateway: lives in a public subnet. Private subnets route 0.0.0.0/0 -> nat-xxxx, so instances can start outbound connections (updates, API calls) but cannot be reached from the internet.

What makes a subnet public or private is its route table, not its name.

What they are checking: Whether you know that routing, not a name, decides the subnet type

A bastion host is a locked-down server in a public subnet. It is the only entry point for SSH into private instances.

• Bastion: the security group allows port 22 only from known IPs. Private instances allow port 22 only from the bastion's security group. Use SSH agent forwarding or ssh -J bastion private-host (ProxyJump). Never copy private keys onto it.
• AWS Systems Manager Session Manager: no open ports, no keys and no public IP. IAM controls access, and it is logged to CloudTrail or S3. It is often the best choice today.
• Site-to-site VPN or Direct Connect: connects your office or data center network to the VPC.
• Client VPN / Tailscale / WireGuard: gives engineers private network access without opening SSH to the internet.

If port 22 is blocked by a NACL or security group, fix the rule (and open the NACL's return ports) or switch to Session Manager.

What they are checking: Whether you prefer safe access with records over open SSH

DNS turns names that people can read, such as example.com, into IP addresses. It uses port 53, UDP for normal queries and TCP for large answers and zone transfers (copying DNS data between servers).

How a name is resolved: first the browser cache, then the OS resolver, then a recursive resolver. The recursive resolver asks the root servers, then the TLD (.com) servers, then the domain's own name server. It then keeps the answer in its cache for the TTL (the time the answer stays valid).

Check with dig example.com A +short.

What they are checking: Whether you understand how a name becomes an IP and know the basic record types

CIDR notation a.b.c.d/n means the first n bits are the network part. The other 32 - n bits are for hosts.

• /24 has 8 host bits: 256 addresses (10.0.1.0 - 10.0.1.255), 254 can be used in a classic network.
• /16 has 65,536 addresses, /28 has 16 addresses.
• Usable hosts = 2^(32-n) - 2 in a traditional network, so /28 gives 14. AWS reserves 5 addresses per subnet, so a /28 gives 11 usable in a VPC.
• Subnetting means splitting a big block into smaller ones. For example, split 10.0.0.0/16 into 10.0.0.0/24, 10.0.1.0/24 and so on. Usually you make one for each tier in each AZ.

Each extra bit in the prefix cuts the block size in half.

What they are checking: Whether you can do CIDR math quickly and know the AWS reserved addresses

Nginx and Apache are web servers. Nginx is event-driven and very good at static files, reverse proxying and load balancing. Apache uses processes and threads, and has rich .htaccess and module support.

The main config is /etc/nginx/nginx.conf, with sites in /etc/nginx/conf.d/ or sites-enabled/.

upstream app {
    server 10.0.1.10:3000;
    server 10.0.1.11:3000;
}
server {
    listen 80;
    server_name example.com;

    location /static/ { root /var/www; }          # static content

    location / {                                   # reverse proxy + LB
        proxy_pass http://app;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Test with nginx -t and apply with systemctl reload nginx. For HTTPS add listen 443 ssl; with ssl_certificate and ssl_certificate_key (Let's Encrypt via certbot).

What they are checking: Whether you have really set up Nginx and know how its config is organized

A NAT Gateway lets instances in private subnets start connections to the internet. It blocks connections that start from outside.

• It sits in a public subnet with an Elastic IP. Private route tables send 0.0.0.0/0 to it.
• An outside site sees the NAT Gateway's Elastic IP as the source, not the instance's private IP. This helps when a partner needs to allow one fixed IP.
• Traffic from an instance to RDS stays inside the VPC on private IPs and does not use NAT.
• A normal auto-assigned public IP is released when the instance is stopped, and a new one is given when it starts. An Elastic IP stays with you until you release it.
• For high availability, create one NAT Gateway in each AZ.

What they are checking: Whether you know how NAT works and the difference between auto-assigned IPs and Elastic IPs

VPC peering is a private network link between two VPCs. A VPC endpoint is a private path from your VPC to an AWS service, without using the internet.

• Peering: traffic flows over the AWS backbone using private IPs. CIDR ranges must not overlap. It is non-transitive: if A is linked to B and B is linked to C, A is not linked to C. You must add routes and allow the traffic in security groups. It works across accounts and regions.
• Gateway endpoints: free, only for S3 and DynamoDB. You add them as a route in the route table.
• Interface endpoints (PrivateLink): a network interface with a private IP in your subnet, for services like SQS, ECR, Secrets Manager or your own service. They cost money for each hour and each GB.
• Endpoints let private subnets reach AWS services without a NAT Gateway.

What they are checking: Whether you know how to connect VPCs and reach AWS services in private

A three-tier design puts the web, application and data layers into different subnets across at least two Availability Zones.

Pick ranges that are big enough and private (RFC 1918). They must not overlap with other VPCs, office networks or future peers.

An IP address is a number that identifies a network interface (IPv4 is 32 bits, IPv6 is 128 bits). On Linux, packet filtering and NAT are done with iptables or nftables (netfilter).

A security group has allow rules only. Each rule has a protocol, a port range, and a source (inbound) or destination (outbound). It is stateful.

The TCP/IP model has four layers (Link, Internet, Transport, Application). It squeezes the seven OSI layers into them. OSI is used for teaching. TCP/IP is what the internet really runs.

The browser asks a recursive resolver. The resolver goes through the DNS levels until it finds the IP, then saves the answer in its cache.

HTTPS is HTTP inside a TLS-encrypted connection. The traffic is encrypted, the server is proven to be real, and nobody can change the data on the way. HTTP uses port 80, HTTPS port 443.

Subnetting takes host bits to make smaller networks. For /26 there are 26 network bits and 6 host bits.

NAT (Network Address Translation) changes IP addresses in packets as they cross a router or firewall. Private hosts can then reach the internet through a public address.

A VLAN is a virtual Layer 2 network made inside one physical switch. Devices in different VLANs cannot talk to each other directly, even if they are plugged into the same switch.

Use them in layers, from basic reachability up to the application.

The usual default ports are:

TCP sets up a connection first and is reliable. UDP has no connection and is fast, but it does not promise delivery.

The three-way handshake is how TCP sets up a reliable connection before it sends data.

DHCP gives hosts an IP address, subnet mask, default gateway and DNS servers automatically. Nobody has to set them by hand.

You point the domain's nameservers to Cloudflare. You create DNS records with the proxy (orange cloud) turned on. Then you secure the link from Cloudflare to the origin.

The OSI model has seven layers, from bottom to top:

Firewalls filter traffic by rules. They differ in how much of the traffic they understand.

A forward proxy sits in front of clients and talks to the internet for them. A reverse proxy sits in front of servers and talks to clients for them.

The first need is CIDR ranges that do not overlap. For many VPCs, the alternative is AWS Transit Gateway.

Use a public hosted zone for names on the internet. Use a private hosted zone for names that work only inside your VPCs.

Add an HTTP listener whose only action is a permanent redirect to HTTPS. For end-to-end TLS, encrypt the traffic again on the way to the backends.

Static routes are typed in by hand and never change on their own. Dynamic routing protocols let routers share routes and adjust when something fails.

A Layer 4 balancer routes by IP and port and does not read the content. A Layer 7 balancer reads the HTTP request, so it can route by host, path, header or cookie.

You publish DNS records so receivers can check the sender. The mail server also signs outgoing messages.

Use country blocking at the edge or in a WAF, so blocked traffic never reaches the app.

First connect the networks. Then expose services in a controlled way.

IPsec has two phases. In IKE phase 1, the two sides prove who they are and build a secure channel. In phase 2, they create the IPsec tunnel that carries the traffic.

A public IP is given automatically and can change. An Elastic IP is a fixed public IPv4 address that you keep until you release it.

The simplest options are to go through S3, or to connect the VPCs and use scp or rsync over private IPs.

• S3 as a middle step: the source instance runs aws s3 cp file s3://bucket/ and the destination downloads it. Both use IAM roles and a gateway endpoint, so no internet or keys are needed. Best for one-time or large transfers.
• VPC peering (or Transit Gateway): add routes in both directions, and allow port 22 in the destination security group from the source. Then:

scp -i key.pem /data/file.tar.gz [email protected]:/tmp/
rsync -avz /data/ [email protected]:/data/

• Via a bastion: scp -J bastion ... when no direct path exists.
• SSM: use Session Manager port forwarding if SSH is not allowed.

The CIDR ranges of the two VPCs must not overlap for peering.

What they are checking: Whether you can pick a safe transfer path without exposing servers

Start from the user and move outward, checking one layer at a time.

Run the ETL job inside the VPC (or connected to it), so it can reach the private database. Send the data to the warehouse over a secure channel.

Split the network into zones by trust level. Let a firewall control all traffic between the zones, and deny everything by default.

The pod subnets have no free IPs left. You need more address space, or you need to use it better.

Only the load balancer is public. The application instances stay in private subnets with no public IPs.

Resolvers and clients keep the old answer in their cache until its TTL runs out, so the change is not instant everywhere. This is DNS caching. People often wrongly call it propagation.

A 502 Bad Gateway means the load balancer got a bad answer, or no answer, from a backend. A 504 Gateway Timeout means the backend did not answer within the idle timeout.

Renew and install the certificate right away. Then add automation and alerts, so it cannot expire without notice.

The likely cause is running out of source ports on the NAT device. Each connection through PAT uses its own source port on the shared public IP. Each destination IP and port pair can use only about 55,000 ports at once.

This pattern usually means a path MTU problem. MTU is the biggest packet size a link allows. Packets bigger than some link's MTU are dropped. The ICMP "fragmentation needed" message that should tell the sender never arrives, because ICMP is blocked.

Split the request time into DNS, connect, TLS, wait for the first byte and download. Then see which part is big.