Skip to content
RED SAGSkills

Computer Networks interview questions and answers

Networking questions test how data moves between systems: the layers, protocols and tools to debug a connection.

Below are 60 Computer Networks questions with the correct answer and a short explanation, grouped from fresher to experienced level. Try each one before you open the answer.

Take the Computer Networks MCQ testPractise 277+ Computer Networks questions for points

What Computer Networks interviews usually check

  • ✓OSI and TCP/IP models
  • ✓TCP vs UDP
  • ✓DNS, HTTP and TLS
  • ✓IP addressing and subnets
  • ✓Troubleshooting connectivity

Computer Networks interview questions for freshers easy

1. Spinner that never stops

On a weak signal, a payment status screen shows a spinner forever. What basic protection is missing?

  1. A.A request timeout with a clear error and retry option
  2. B.A bigger spinner so users know it is working
  3. C.A second spinner for the same request
  4. D.Disabling the back button while waiting
Show answer

Answer: A. A request timeout with a clear error and retry option

Without timeouts, a stalled connection can leave a request hanging for a long time. Setting connect and read timeouts, then showing a clear message with retry, keeps users informed. For payments, the app should also check the final status with the server rather than assume failure.

2. A record vs CNAME

What is the difference between a DNS A record and a CNAME record?

  1. A.An A record points to a mail server; a CNAME record points to a web server.
  2. B.An A record maps a name to an IPv4 address; a CNAME maps a name to another name.
  3. C.A CNAME is faster because the resolver can skip the DNS lookup completely.
  4. D.An A record is only for IPv6 addresses; a CNAME is for IPv4 addresses.
Show answer

Answer: B. An A record maps a name to an IPv4 address; a CNAME maps a name to another name.

An A record returns an IPv4 address directly (AAAA is for IPv6). A CNAME is an alias that points to another hostname, such as a load balancer name, and the resolver then looks that name up. A CNAME cannot sit at the zone apex alongside other records, which is why providers offer ALIAS or flattening.

3. 502 vs 504 errors

Users see errors from the load balancer in front of your service. What is the usual difference between 502 and 504?

  1. A.502: the user is not logged in or the session expired; 504: the requested page was not found on the server.
  2. B.Both mean the load balancer itself has run out of memory or open connections.
  3. C.502 is a client-side error caused by the browser, and 504 means DNS lookup failed.
  4. D.502: the upstream sent a bad response or reset; 504: the upstream did not answer in time.
Show answer

Answer: D. 502: the upstream sent a bad response or reset; 504: the upstream did not answer in time.

502 Bad Gateway means the proxy reached the backend but got a broken, closed or invalid response, often from a crashed or restarting app. 504 Gateway Timeout means the backend took longer than the proxy timeout to respond, pointing to slow queries or overloaded services. Both are server-side 5xx errors.

4. Why put a CDN in front of a site

What is the main reason to put a CDN such as Amazon CloudFront or Azure Front Door in front of a static website?

  1. A.To encrypt the backend database and its backups automatically
  2. B.To cache content at edge locations near users
  3. C.To replace DNS for the domain and its subdomains entirely
  4. D.To run database SQL queries in locations closer to users
Show answer

Answer: B. To cache content at edge locations near users

A CDN serves cached copies from edge locations around the world, so users get faster responses and the origin handles fewer requests. It also absorbs traffic spikes and some attacks. It does not replace DNS or encrypt your database.

5. Which OSI layer IP works at

In the OSI model, at which layer does IP (Internet Protocol) operate?

  1. A.Layer 2, the data link layer
  2. B.Layer 4, the transport layer
  3. C.Layer 3, the network layer
  4. D.Layer 7, the application layer
Show answer

Answer: C. Layer 3, the network layer

IP handles logical addressing and routing between networks, which is the network layer (3). Ethernet and MAC addresses are layer 2, TCP and UDP are layer 4, and HTTP and DNS are application-layer protocols.

6. Default SSH port

Which TCP port does SSH use by default?

  1. A.21
  2. B.22
  3. C.23
  4. D.443
Show answer

Answer: B. 22

SSH listens on TCP 22 by default. Port 21 is FTP control, 23 is Telnet (unencrypted, avoid it) and 443 is HTTPS.

7. DHCP steps

What are the four steps a client uses to get an address from DHCP?

  1. A.Request, Offer, Accept, Done
  2. B.Hello, Lease, Bind, Confirm
  3. C.Discover, Offer, Request, Acknowledge
  4. D.Query, Answer, Renew, Release
Show answer

Answer: C. Discover, Offer, Request, Acknowledge

DHCP follows DORA: the client broadcasts Discover, servers send Offers, the client Requests one, and the server Acknowledges. The address is leased for a time and the client renews before it expires.

8. Switch vs router

What is the main difference between a switch and a router?

  1. A.A switch forwards by MAC in a LAN; a router by IP between networks
  2. B.A switch connects to the internet; a router only links local devices
  3. C.A router only works with Wi-Fi devices; a switch with cables
  4. D.They do the same job; the names just differ between vendors
Show answer

Answer: A. A switch forwards by MAC in a LAN; a router by IP between networks

A layer 2 switch learns MAC addresses and forwards frames within one local network. A router reads IP addresses and forwards packets between different networks, such as your office LAN and the internet.

9. How big is a /16?

How many IPv4 addresses are in a /16 block, such as 10.20.0.0/16?

  1. A.256
  2. B.65,536
  3. C.16,777,216
  4. D.4,096
Show answer

Answer: B. 65,536

A /16 leaves 32 - 16 = 16 bits for hosts, so 2^16 = 65,536 addresses. A /24 has 256 and a /8 has about 16.7 million. Clouds reserve a few addresses in each subnet.

10. What a recursive resolver does

When your laptop looks up shop.example.in, what does the recursive resolver (for example your ISP's or 1.1.1.1) do?

  1. A.Holds the master copy of every domain's records
  2. B.Assigns IP addresses to devices on your network
  3. C.Walks root, TLD and authoritative servers, then caches
  4. D.Encrypts web traffic between you and the site
Show answer

Answer: C. Walks root, TLD and authoritative servers, then caches

A recursive resolver does the work for clients: it asks a root server, then the .in TLD servers, then the domain's authoritative servers, and caches answers for their TTL. Authoritative servers hold the actual zone records.

11. What an MX record is for

Which DNS record tells other mail servers where to deliver email for your domain?

  1. A.MX
  2. B.A
  3. C.PTR
  4. D.SRV
Show answer

Answer: A. MX

MX (mail exchanger) records list the mail servers for a domain with priorities; lower numbers are tried first. They must point to hostnames, not raw IP addresses or CNAMEs.

12. What NS records do

You move your domain's DNS hosting to a new provider. Which records at the registrar must change so the world uses the new provider?

  1. A.The MX records for the domain's email
  2. B.The A record for the www hostname
  3. C.The TXT record used for SPF
  4. D.The NS records (name servers) for the domain
Show answer

Answer: D. The NS records (name servers) for the domain

NS records delegate a domain to its authoritative name servers. Changing them at the registrar points resolvers to the new provider. Copy all existing records to the new provider first, or the site and email will break.

13. What a certificate authority does

In HTTPS, what is the role of a certificate authority (CA)?

  1. A.It vouches that a public key belongs to a domain
  2. B.It encrypts every page your site sends
  3. C.It hosts the website on its own servers
  4. D.It assigns IP addresses to secure websites
Show answer

Answer: A. It vouches that a public key belongs to a domain

A CA checks that the requester controls the domain and signs a certificate binding the domain to a public key. Browsers trust a set of root CAs, so they can verify the chain. The actual encryption is done by client and server.

14. A CDN cache hit

A user in Riyadh requests an image through a CDN, and the edge server has it cached. What happens?

  1. A.The edge serves it without contacting the origin
  2. B.The origin server sends it from scratch
  3. C.The browser downloads it from the CDN head office
  4. D.The image is resized and re-encrypted at origin
Show answer

Answer: A. The edge serves it without contacting the origin

A cache hit means the edge location near the user already has a fresh copy and returns it directly, cutting latency and origin load. On a miss, the edge fetches from origin and caches it for next time.

15. Servers flapping in and out of a pool

A health check marks servers down after one slow reply and up after one good one, so servers flap in and out under load. What reduces this?

  1. A.Need several results in a row to flip
  2. B.Check health only once a day
  3. C.Remove health checks entirely
  4. D.Mark every server always healthy
Show answer

Answer: A. Need several results in a row to flip

Using thresholds like 3 failures to mark down and 2 successes to mark up filters out one-off blips. Flapping causes traffic swings that overload the remaining servers. The check interval and timeout should fit how fast you need to detect real failures.

16. Default port for Remote Desktop

A firewall log shows many inbound connection attempts from the internet to TCP port 3389. Which service is being targeted?

  1. A.SSH
  2. B.SMB file sharing
  3. C.HTTPS
  4. D.Microsoft Remote Desktop Protocol (RDP)
Show answer

Answer: D. Microsoft Remote Desktop Protocol (RDP)

TCP 3389 is the default port for Microsoft RDP. SSH uses 22, SMB uses 445 and HTTPS uses 443. Exposed RDP is a very common entry point for ransomware groups, so these attempts should be investigated and RDP should sit behind a VPN or zero trust gateway with MFA.

17. Which port does DNS use?

Classic (unencrypted) DNS queries normally use which port?

  1. A.Port 25
  2. B.Port 443
  3. C.Port 123
  4. D.Port 53
Show answer

Answer: D. Port 53

Traditional DNS uses port 53, mostly over UDP, with TCP for large responses and zone transfers. Port 25 is SMTP, 123 is NTP and 443 is HTTPS. Knowing default ports helps an analyst spot traffic that does not fit a normal pattern.

18. Sysmon Event ID 22

Why is Sysmon Event ID 22 (DNS query) useful even when you already have DNS server logs?

  1. A.It shows the full content of every web page visited
  2. B.It shows which process on the host made the DNS lookup
  3. C.It blocks DNS queries to known bad domains
  4. D.It records DNS queries made by other hosts on the LAN
Show answer

Answer: B. It shows which process on the host made the DNS lookup

DNS server logs show which client IP asked for a name, but not which program did. Sysmon Event 22 ties the query to the process image, so you can see that, for example, rundll32.exe looked up a strange domain. It does not block anything or capture page content.

19. Bandwidth or latency

Which statement correctly separates network bandwidth from network latency?

  1. A.Bandwidth is data per second; latency is delay per trip
  2. B.They are two names for the same measurement
  3. C.Latency is data per second; bandwidth is delay per trip
  4. D.Bandwidth only matters for HTTPS traffic
Show answer

Answer: A. Bandwidth is data per second; latency is delay per trip

Bandwidth is how much data a link can carry per second; latency is how long a packet takes to travel. A page with many small requests suffers from high latency even on a fast link. Large downloads are mostly limited by bandwidth.

20. Warm introductions

Why does a warm introduction from a mutual contact usually work better than a cold message?

  1. A.It guarantees the deal will close
  2. B.It avoids the need for discovery
  3. C.The prospect trusts the person introducing you, so they are more likely to reply and listen
  4. D.It allows you to skip the CRM
Show answer

Answer: C. The prospect trusts the person introducing you, so they are more likely to reply and listen

Trust transfers from the introducer to you, which raises reply and meeting rates. Make it easy for the introducer with a short forwardable note. You still need to qualify the opportunity properly.

Computer Networks intermediate interview questions medium

21. Old CNAME to a deleted bucket

promo.example.com still has a CNAME to a cloud storage bucket that was deleted last year. What can an attacker do?

  1. A.Create that bucket name and serve their content
  2. B.Read your main production database
  3. C.Transfer your domain to another registrar
  4. D.Nothing, because the bucket no longer exists
Show answer

Answer: A. Create that bucket name and serve their content

Dangling DNS records let anyone who claims the abandoned resource control a subdomain of yours, a subdomain takeover. They can host phishing pages or abuse cookies scoped to the parent domain. Remove DNS records when you delete the resource.

22. Outbound internet from a private subnet

Instances in a private subnet must download OS updates from the internet, but must not be reachable from the internet. What is the standard solution?

  1. A.Attach an internet gateway directly to the private subnet
  2. B.Give each instance a public Elastic IP and block inbound in the security group
  3. C.Create a VPC peering connection to a public VPC
  4. D.Place a NAT gateway in a public subnet and route 0.0.0.0/0 from the private subnet to it
Show answer

Answer: D. Place a NAT gateway in a public subnet and route 0.0.0.0/0 from the private subnet to it

A NAT gateway lives in a public subnet and translates outbound connections from private instances to its own public IP. Responses come back, but no one on the internet can start a new connection to the private instances. For high availability use one NAT gateway per AZ. VPC peering does not provide internet transit.

23. DNS failover to a DR region

You want users sent to a DR region only when the primary region is unhealthy. Which Route 53 setup fits?

  1. A.Failover routing with health checks on the primary
  2. B.Weighted routing at 50/50 between regions
  3. C.Geolocation routing by user country
  4. D.Simple routing with both IPs in one record
Show answer

Answer: A. Failover routing with health checks on the primary

Failover routing answers with the primary record while its health check passes and switches to the secondary when it fails. Keep record TTLs low so clients pick up the change quickly. Weighted and geolocation routing send traffic to both regions all the time.

24. End-to-end TLS behind a load balancer

A bank's policy says traffic must be encrypted all the way to the app servers. The ALB currently terminates TLS and forwards HTTP on port 80. What change meets the policy?

  1. A.Move the TLS certificate from the ALB into an S3 bucket
  2. B.Enable HSTS on the ALB so browsers always use HTTPS
  3. C.Use HTTPS target groups so the ALB re-encrypts to the targets
  4. D.Put the targets in a private subnet and keep using HTTP
Show answer

Answer: C. Use HTTPS target groups so the ALB re-encrypts to the targets

An ALB can terminate client TLS and then open a new TLS connection to targets using an HTTPS target group, so data is encrypted on every hop. A private subnet limits exposure but traffic is still plain text inside the VPC. HSTS only affects the browser-to-ALB leg.

25. When to use mutual TLS

A UAE bank exposes an API only to five partner fintechs. They want strong proof of which client is calling, beyond an API key. What does mutual TLS add?

  1. A.The server encrypts traffic twice for stronger protection
  2. B.The client also presents a certificate that the server verifies
  3. C.Traffic is sent over two separate networks for resilience
  4. D.The server's certificate is checked by two different CAs
Show answer

Answer: B. The client also presents a certificate that the server verifies

In normal TLS only the server proves its identity. With mTLS the client must present a certificate from a trusted CA, so a stolen API key alone is not enough. API Gateway, ALB and most API platforms support mTLS with a trust store you control.

26. Do these CIDRs overlap?

Do 10.0.0.0/16 and 10.0.128.0/17 overlap?

  1. A.No; they start at different addresses
  2. B.No; a /17 is larger than a /16
  3. C.Yes; the /17 is inside the /16
  4. D.Only if they are in the same region
Show answer

Answer: C. Yes; the /17 is inside the /16

10.0.0.0/16 covers 10.0.0.0 to 10.0.255.255. 10.0.128.0/17 covers 10.0.128.0 to 10.0.255.255, which is the upper half of the /16. Overlapping ranges cause routing conflicts when networks are connected.

27. Why new connections start slow

A large file download on a fresh TCP connection starts slowly and speeds up over the first few round trips. What causes this?

  1. A.The DNS cache warming up on the client
  2. B.TCP slow start growing the congestion window
  3. C.The server CPU throttling at the start
  4. D.The receiver's disk buffers filling up
Show answer

Answer: B. TCP slow start growing the congestion window

TCP slow start begins with a small congestion window (often about 10 segments) and roughly doubles it each round trip until loss or a threshold. Reusing connections and placing servers closer to users reduce this effect.

28. Throughput capped by the window

A TCP connection has a 64 KB receive window and 100 ms RTT, with no window scaling. What is the maximum throughput, roughly?

  1. A.About 64 Mbps
  2. B.About 640 Kbps
  3. C.About 5 Mbps
  4. D.About 50 Mbps
Show answer

Answer: C. About 5 Mbps

Max throughput ≈ window / RTT = 65,536 bytes / 0.1 s ≈ 655 KB/s ≈ 5.2 Mbps. However fat the link, one connection cannot go faster. Window scaling (enabled by default on modern systems) lets windows grow far beyond 64 KB.

29. Counting TCP states on a server

What does this pipeline print on a Linux server?

  1. A.A count of TCP sockets in each state
  2. B.A list of listening UDP ports only
  3. C.Bandwidth used by each running process
  4. D.The routing table grouped by interface
Show answer

Answer: A. A count of TCP sockets in each state

ss -tan lists all TCP sockets numerically with the state in the first column. The awk, sort and uniq -c pipeline counts them per state. A huge TIME-WAIT or SYN-RECV count points to churn or a SYN flood.

30. Testing a new server before the DNS switch

You want to test https://shop.example.ae against a new server at 203.0.113.10 before changing DNS, with the correct TLS name. Which command works?

  1. A.curl -k https://203.0.113.10/ -H "Host: shop.example.ae"
  2. B.curl -x http://203.0.113.10:443 https://shop.example.ae/
  3. C.curl --resolve shop.example.ae:443:203.0.113.10 https://shop.example.ae/
  4. D.curl --dns-servers 203.0.113.10 https://shop.example.ae/
Show answer

Answer: C. curl --resolve shop.example.ae:443:203.0.113.10 https://shop.example.ae/

--resolve pins the name to an IP for that request only, so the Host header and TLS SNI still use shop.example.ae and the certificate validates. Calling the IP directly breaks SNI and certificate checks.

31. Head-of-line blocking in TCP

Several independent streams share one TCP connection. One packet is lost. What happens to the other streams?

  1. A.They all wait until the lost packet is resent
  2. B.Only the affected stream pauses
  3. C.The connection is closed and reopened
  4. D.Nothing; TCP skips the lost packet
Show answer

Answer: A. They all wait until the lost packet is resent

TCP delivers bytes strictly in order, so a single loss stalls everything behind it until retransmission arrives, even data for other streams. QUIC (used by HTTP/3) solves this by handling loss per stream.

32. Revalidating a cached file with an ETag

A browser holds a cached app.js with ETag "v42", and its max-age has expired. It sends If-None-Match: "v42", and the file has not changed. What should the server reply?

  1. A.200 OK with the full file sent again
  2. B.302 Found redirecting to the cached copy
  3. C.412 Precondition Failed, empty body
  4. D.304 Not Modified with an empty body
Show answer

Answer: D. 304 Not Modified with an empty body

If-None-Match asks the server to send the body only if the current ETag differs. When it matches, the server answers 304 Not Modified with no body, and the browser reuses its cached copy with refreshed freshness headers. 412 is for failed preconditions such as If-Match, typically on writes.

33. What mutual TLS adds

A bank's partner API requires mutual TLS. What does that add over normal HTTPS?

  1. A.Traffic is encrypted twice for safety
  2. B.The server skips sending its certificate
  3. C.The client also proves identity with a certificate
  4. D.The connection uses UDP for speed
Show answer

Answer: C. The client also proves identity with a certificate

In normal TLS only the server presents a certificate. With mTLS, the client presents one too and the server checks it against a trusted CA, giving strong machine identity. It is common in service meshes and B2B APIs.

34. The Vary header

An origin sends "Vary: User-Agent" on images. What effect does this have on CDN caching?

  1. A.Images are never cached by the CDN at all
  2. B.A copy is cached per User-Agent, splitting the cache
  3. C.Only mobile users ever get cached images
  4. D.The CDN converts every image to WebP format
Show answer

Answer: B. A copy is cached per User-Agent, splitting the cache

Vary tells caches to store separate copies for each distinct value of that header. User-Agent has thousands of values, so the hit ratio collapses. Vary on a small set like Accept-Encoding, or normalise the header at the CDN.

35. What an origin shield does

Your CDN has 300 edge locations. On a cache miss, each edge goes to your origin. What does enabling an origin shield change?

  1. A.Edges fetch via one mid-tier cache, cutting origin load
  2. B.The origin is hidden from all public DNS queries
  3. C.All edge locations stop caching dynamic pages
  4. D.Users connect straight to your origin on a miss
Show answer

Answer: A. Edges fetch via one mid-tier cache, cutting origin load

An origin shield is an extra cache layer between edges and origin. Misses at many edges collapse into a single request from the shield, protecting origin capacity and raising overall hit ratio.

36. Uneven targets across zones

An NLB has cross-zone load balancing off. AZ-a has 2 targets, AZ-b has 8. Traffic splits evenly between the two AZ nodes. What share does each AZ-a target get?

  1. A.25% each
  2. B.10% each
  3. C.6.25% each
  4. D.50% each
Show answer

Answer: A. 25% each

Each AZ node gets half the traffic and only sends it to targets in its own AZ. AZ-a's 50% is split across 2 targets (25% each), while AZ-b's 8 targets get 6.25% each. Turn on cross-zone balancing or keep target counts even.

37. Cannot assign requested address

A service that makes many short outbound HTTP calls starts failing with "connect: cannot assign requested address". ss shows about 28,000 sockets in TIME_WAIT to one upstream. What is the best fix?

  1. A.Increase the upstream server timeout
  2. B.Reuse connections with HTTP keep-alive and a connection pool instead of opening a new connection per request
  3. C.Turn off TCP entirely and use UDP
  4. D.Restart the service every hour
Show answer

Answer: B. Reuse connections with HTTP keep-alive and a connection pool instead of opening a new connection per request

Each new connection to the same destination uses a local ephemeral port, and closed connections stay in TIME_WAIT for a while. Opening a connection per request can use up the port range. Connection pooling with keep-alive removes the root cause; widening ip_local_port_range only buys time.

38. Transfers capped at 11 MB/s

File copies between two servers never exceed about 11 MB/s on a "gigabit" network. What is a good first check on each host?

  1. A.ethtool eth0, to see the negotiated speed and duplex
  2. B.ip route, to confirm the default gateway
  3. C.hostnamectl, to check the machine name
  4. D.cat /etc/hosts, to check name mapping
Show answer

Answer: A. ethtool eth0, to see the negotiated speed and duplex

About 11 MB/s is the ceiling of a 100 Mb/s link, a classic sign of a bad cable or port that fell back to Fast Ethernet. ethtool shows Speed and Duplex. A duplex mismatch also causes errors and poor throughput.

39. Reaching a private database

A database at 10.0.5.20:5432 is reachable only from a bastion host. Which command lets you connect to it as localhost:5433 from your laptop?

  1. A.ssh -R 5433:10.0.5.20:5432 user@bastion
  2. B.ssh -L 5433:10.0.5.20:5432 user@bastion
  3. C.ssh -D 5433 user@10.0.5.20
  4. D.ssh -p 5433 user@10.0.5.20
Show answer

Answer: B. ssh -L 5433:10.0.5.20:5432 user@bastion

-L opens a local port and forwards it through the SSH connection to a target reachable from the server. -R does the reverse, -D starts a SOCKS proxy and -p only sets the SSH port. Then point psql at localhost:5433.

40. How Let's Encrypt checks you own a domain

With the ACME HTTP-01 challenge, how does the CA confirm you control shop.example.in before issuing a certificate?

  1. A.It fetches a token file you place on that site
  2. B.It phones the contact number in WHOIS
  3. C.It checks your company's GST registration
  4. D.It emails a code to any Gmail address you give
Show answer

Answer: A. It fetches a token file you place on that site

The CA gives a token, your ACME client serves it at http://shop.example.in/.well-known/acme-challenge/<token>, and the CA fetches it over the internet. Only someone controlling the site can do that. DNS-01 proves control by placing a TXT record instead, and is needed for wildcards.

Computer Networks interview questions for experienced candidates hard

41. Responsive movement with an authoritative server

In a server-authoritative shooter with 100 ms ping, players complain movement feels delayed. What is the standard solution?

  1. A.Make the client authoritative for position and damage
  2. B.Send inputs less often to reduce load
  3. C.Increase the server tick rate to 1000 Hz
  4. D.Client-side prediction: apply input locally right away, then reconcile with the server state by replaying unacknowledged inputs
Show answer

Answer: D. Client-side prediction: apply input locally right away, then reconcile with the server state by replaying unacknowledged inputs

With prediction, the client moves the player immediately using the same movement code as the server. Each input has a sequence number; when a server state arrives, the client resets to it and replays inputs the server has not processed yet. This feels instant while the server stays in control and prevents cheating.

42. Friends cannot join a hosted game

In a peer-hosted co-op game, some players cannot connect to friends even with the right join code. What is the robust solution?

  1. A.Ask players to disable their antivirus
  2. B.Switch the game to TCP
  3. C.Use NAT punch-through where possible, with a relay service as fallback when direct connection fails
  4. D.Lower the tick rate to make packets smaller
Show answer

Answer: C. Use NAT punch-through where possible, with a relay service as fallback when direct connection fails

Home routers use NAT, so an unsolicited packet from outside is dropped. Punch-through via a rendezvous server works for many routers but not symmetric NATs or strict networks. Relay services like Unity Relay, Steam Datagram Relay or Epic Online Services forward traffic so everyone can play, at some latency cost.

43. Estimating server time on a client

Clients need a good estimate of server time to schedule events and interpolate. Which approach is sound?

  1. A.Use each client's system clock directly
  2. B.Send the client time to the server and trust it
  3. C.Sync once at connection and never again
  4. D.Exchange timestamped pings, estimate offset as server time plus half the round-trip time, filter out spiky samples and smooth adjustments over time
Show answer

Answer: D. Exchange timestamped pings, estimate offset as server time plus half the round-trip time, filter out spiky samples and smooth adjustments over time

Device clocks differ and can be changed by players, so they cannot be trusted. Ping exchanges give round-trip time; assuming roughly symmetric latency, the offset is server time plus RTT / 2. Taking the samples with the lowest RTT and slewing the clock gradually avoids visible jumps.

44. Transitive routing between VPCs

VPC A is peered with VPC B, and VPC B is peered with VPC C. Instances in A cannot reach C. You will soon have 30 VPCs that all need to talk to each other. What is the best design?

  1. A.Add routes in A pointing to C through the A-B peering connection
  2. B.Use a transit gateway (hub and spoke) and attach all VPCs to it
  3. C.Run a proxy instance in VPC B to forward traffic
  4. D.Merge all VPCs into a single VPC with overlapping CIDR ranges
Show answer

Answer: B. Use a transit gateway (hub and spoke) and attach all VPCs to it

VPC peering is not transitive, so A cannot route through B to C. A full mesh of peering for 30 VPCs would need 435 connections. A transit gateway acts as a regional hub with route tables for segmentation, scaling cleanly to many VPCs and on-premises links. Proxy instances add a bottleneck and single point of failure, and overlapping CIDRs break routing.

45. Unexpected data transfer bill

After spreading a chatty microservice system across three AZs for high availability, the monthly bill jumps even though instance counts did not change. What is the most likely cause and a good mitigation?

  1. A.Cross-AZ data transfer charges; use zone-aware routing so services prefer same-AZ targets while keeping multi-AZ capacity
  2. B.Internet gateway hourly charges; remove the internet gateway
  3. C.Elastic Load Balancer idle charges; delete the load balancer
  4. D.IAM API call charges; cache IAM credentials
Show answer

Answer: A. Cross-AZ data transfer charges; use zone-aware routing so services prefer same-AZ targets while keeping multi-AZ capacity

Most clouds charge for data moving between availability zones in both directions. Chatty services that call each other across AZs can create large transfer costs. Zone-aware or topology-aware routing (for example Kubernetes topology-aware routing or same-AZ preference in a service mesh) keeps most traffic local while still allowing failover. Internet gateways and IAM calls have no such charges.

46. CDN cache hit ratio of 4 percent

A CloudFront distribution has a 4 percent cache hit ratio. Its cache policy includes all headers, all cookies and all query strings in the cache key. What is the main problem?

  1. A.The origin server responds too slowly for CloudFront to cache
  2. B.Every header, cookie and query variation is a separate cache entry
  3. C.The TTLs are set too long, so objects expire unpredictably
  4. D.CloudFront only caches image files and skips other content types
Show answer

Answer: B. Every header, cookie and query variation is a separate cache entry

Anything in the cache key splits the cache, and headers like User-Agent or session cookies make almost every request unique. Include only values the origin really varies on, and forward other values with an origin request policy instead. Normalizing query strings also helps.

47. Exposing one API to 200 customer VPCs

You must expose one internal API privately to 200 customer VPCs, many with overlapping CIDRs, without giving them access to the rest of your network. What fits best?

  1. A.A separate VPC peering connection with each of the customers
  2. B.A public ALB with an IP allow-list for every customer NAT address
  3. C.A PrivateLink endpoint service behind a Network Load Balancer
  4. D.One transit gateway shared with all customers through RAM
Show answer

Answer: C. A PrivateLink endpoint service behind a Network Load Balancer

PrivateLink exposes a single service through interface endpoints in each consumer VPC, so CIDR overlap does not matter and traffic is one-way to that service. Peering and transit gateways connect whole networks and need unique CIDRs. A public ALB sends traffic over the internet, which the requirement rules out.

48. One link full, three idle

Four equal-cost paths connect two data centres. One link is saturated while the others are almost idle. A nightly backup uses one huge TCP stream. Why?

  1. A.ECMP only balances UDP traffic, never TCP
  2. B.The backup software ignores the routing tables
  3. C.Three of the four links must have failed
  4. D.ECMP hashes each flow onto a single path
Show answer

Answer: D. ECMP hashes each flow onto a single path

ECMP balances by hashing flow fields (IPs, ports, protocol) so packets of one flow stay in order on one path. A single elephant flow cannot spread out. Splitting the backup into parallel streams lets the hash spread them.

49. A floating IP that moved but no one noticed

A virtual IP moves from server A to server B during failover, but neighbours keep sending traffic to A for minutes. What should the new owner do?

  1. A.Restart the DHCP client on every neighbour
  2. B.Send gratuitous ARP so neighbours update caches
  3. C.Change the DNS TTL for the virtual IP to zero
  4. D.Lower its MTU so neighbours pick new paths
Show answer

Answer: B. Send gratuitous ARP so neighbours update caches

Neighbours cache IP-to-MAC mappings. When an IP moves, the new holder sends a gratuitous ARP announcing its MAC, so caches update at once. Tools like keepalived do this on failover; without it, stale entries expire slowly.

50. Fixing MTU on a site-to-site tunnel

An IPsec tunnel between a Dubai office and a cloud VPC adds about 70 bytes of overhead. You cannot change MTU on every laptop. What is the usual fix?

  1. A.Raise every laptop's MTU to 9,000
  2. B.Switch all traffic to UDP
  3. C.Clamp TCP MSS on the tunnel endpoints
  4. D.Disable TCP window scaling
Show answer

Answer: C. Clamp TCP MSS on the tunnel endpoints

MSS clamping rewrites the MSS value in TCP SYNs passing through the gateway, so both ends send segments small enough to fit the tunnel. It avoids fragmentation and PMTUD problems without touching every host. UDP traffic still needs care.

51. Latency jumps when someone uploads

Office video calls are smooth until someone uploads a big file; then ping times rise from 20 ms to 800 ms with little loss. What is this and the usual fix?

  1. A.Bufferbloat; use queue management like fq_codel
  2. B.DNS overload; add a second resolver for the office
  3. C.Packet loss; replace the office network cable
  4. D.IP conflict; renew every DHCP lease in the office
Show answer

Answer: A. Bufferbloat; use queue management like fq_codel

Oversized buffers in a router fill up under load, so every packet waits in a long queue, adding huge delay without much loss. Active queue management such as fq_codel or CAKE, with shaping slightly below the link rate, keeps queues short.

52. One IP announced from many cities

A DNS provider announces the same IP from Mumbai, Dubai and London. How does a user's packet reach a site?

  1. A.It is sent to all three sites at once for redundancy
  2. B.BGP routes it to the nearest site in routing terms
  3. C.DNS picks the site using the user's GPS location
  4. D.The user's router picks one of the three at random
Show answer

Answer: B. BGP routes it to the nearest site in routing terms

With anycast, many sites announce the same prefix, and BGP delivers each packet to the "closest" one by routing policy and path, which is usually but not always the nearest geographically. It suits short UDP exchanges like DNS and DDoS absorption.

53. Traffic takes a long way round

Traffic from a Mumbai office to a Dubai server goes via Europe, adding 120 ms, even though a direct link exists between the ISPs. Why can this happen?

  1. A.Routers always pick the slowest path first
  2. B.DNS sends traffic through Europe
  3. C.TCP chooses the path during the handshake
  4. D.BGP picks paths by policy and AS path, not latency
Show answer

Answer: D. BGP picks paths by policy and AS path, not latency

BGP route selection uses business policy (local preference), AS path length and other attributes, with no measure of latency. A provider may prefer a cheaper transit route. Fixes include working with ISPs, different transit or a private interconnect.

54. A domain that breaks only for some users

After changing DNS providers, your domain resolves for some users but returns SERVFAIL for users of validating resolvers like 1.1.1.1. The old DS record is still at the registry. What happened?

  1. A.The new provider does not support A or AAAA records
  2. B.Validating resolvers block new domains
  3. C.The TTL was set to zero by mistake
  4. D.The old DS no longer matches the new DNSSEC keys
Show answer

Answer: D. The old DS no longer matches the new DNSSEC keys

The DS record at the parent must match a key in the child zone. Moving providers without updating or removing the DS breaks validation, and validating resolvers return SERVFAIL. Remove the DS first, wait out TTLs, then re-enable DNSSEC with the new keys.

55. Geo DNS sends users to the wrong region

Your geo-DNS routes Indian users to Mumbai, but many Indian users of a public resolver land in Singapore. What is a likely reason?

  1. A.Indian users always prefer Singapore servers
  2. B.Geo DNS sees the resolver's location, not the user's
  3. C.DNS cannot tell countries apart at all
  4. D.The Mumbai servers are failing health checks
Show answer

Answer: B. Geo DNS sees the resolver's location, not the user's

Authoritative servers see the resolver's IP. If the resolver's nearest site is elsewhere and it does not send EDNS Client Subnet, geo decisions are based on the wrong location. Anycast-based or latency-based routing can avoid this dependency.

56. New instances fall over on arrival

When auto scaling adds instances, they immediately get a full share of traffic and time out for a minute while caches and JIT warm up. Which load balancer feature helps?

  1. A.Slow start mode that ramps traffic up gradually
  2. B.Stickiness so old users stay on old instances
  3. C.A longer deregistration delay
  4. D.Cross-zone load balancing turned off
Show answer

Answer: A. Slow start mode that ramps traffic up gradually

Slow start gives a newly healthy target a gradually increasing share of requests over a set window, letting caches, connection pools and JIT compilation warm up. Warm-up logic before passing the readiness check also helps.

57. Removing a rule did not cut the attacker off

You remove a security group rule that allowed SSH from an attacker's IP, but their existing session stays open. Why?

  1. A.Security group changes take 24 hours to apply
  2. B.Existing tracked connections are not cut by rule changes
  3. C.SSH bypasses security groups entirely
  4. D.You must also delete the subnet route table
Show answer

Answer: B. Existing tracked connections are not cut by rule changes

Security groups are stateful. Removing a rule stops new connections, but already tracked flows can continue. To cut an active session immediately, use a network ACL deny (stateless) or isolate the instance.

58. Private endpoint created, traffic still public

You add an Azure private endpoint for a storage account and disable public access. VMs now get "access denied", and nslookup shows the public IP. What is missing?

  1. A.Private endpoints only work for SQL databases
  2. B.The privatelink private DNS zone is not linked to the VNet
  3. C.The VM needs a public IP to use private endpoints
  4. D.The storage account must move to another region
Show answer

Answer: B. The privatelink private DNS zone is not linked to the VNet

Private endpoints rely on DNS: the service name must resolve to the endpoint's private IP via a privatelink.* private DNS zone linked to the VNet, or via custom DNS forwarding. Otherwise clients still resolve and use the public address.

59. Phishing on your own subdomain

Phishing pages appear at promo.company.example. DNS shows a CNAME to an old cloud app the marketing team deleted last year. What happened?

  1. A.DKIM replay against the main domain
  2. B.An open redirect on the main company website
  3. C.A homograph attack using punycode
  4. D.Subdomain takeover via a dangling CNAME
Show answer

Answer: D. Subdomain takeover via a dangling CNAME

The CNAME still points to a cloud resource name that no longer exists, so an attacker claimed that name and now serves content on your real subdomain. Users and filters trust it. Remove DNS records when services are deleted, and audit for dangling records.

60. New load balancer nodes get no traffic

During a long test, the cloud load balancer scales out and adds new IP addresses to its DNS name. The test keeps hitting only the original IPs and they overload. What is the cause?

  1. A.The new nodes are broken and must be removed
  2. B.DNS cannot return more than one IP address
  3. C.The load tool cached old DNS results; lower its DNS cache time
  4. D.The servers are rejecting new connections on purpose
Show answer

Answer: C. The load tool cached old DNS results; lower its DNS cache time

Load tools and the JVM can cache DNS answers for a long time, so they never see new addresses. Real clients resolve more often, spreading traffic. Configure the tool's DNS TTL (k6 has a dns option; JMeter has a DNS Cache Manager) so the test follows the load balancer like real users.

Ready to test yourself?

Take a 15-question Computer Networks MCQ test with a score at the end, or practise the full Computer Networks question bank and earn points on the leaderboard.

Start the Computer Networks testTake a mock interview