Cloud Engineer
Networking questions
156 questions on Networking for cloud engineers, easiest first.
Easy 44
- What makes a subnet public?easy
- Usable IPs in a /24 subneteasy
- Pointing the zone apex at a load balancereasy
- Load balancer for path-based routingeasy
- Why put a CDN in front of a siteeasy
- Which TLS versions to alloweasy
- Managed TLS certificateseasy
- Which OSI layer IP works ateasy
- What TCP adds over UDPeasy
- The TCP handshakeeasy
- Default SSH porteasy
- What ARP doeseasy
- MAC address vs IP addresseasy
- What a default gateway doeseasy
- DHCP stepseasy
- What ping useseasy
- Standard Ethernet MTUeasy
- Size of an IPv6 addresseasy
- The loopback addresseasy
- Switch vs routereasy
- Latency vs bandwidtheasy
- How big is a /16?easy
- What a recursive resolver doeseasy
- What an MX record is foreasy
- Where SPF liveseasy
- The AAAA recordeasy
- Reverse DNSeasy
- What NS records doeasy
- What a certificate authority doeseasy
- Permanent vs temporary redirecteasy
- Layer 4 vs layer 7 load balancingeasy
- Round robin load balancingeasy
- Why load balancers health-checkeasy
- A CDN cache hiteasy
- Reading Cache-Control max-ageeasy
- HTTP/2 multiplexingeasy
- Sticky sessionseasy
- Usable IPs in an AWS /28 subneteasy
- Where an AWS subnet liveseasy
- Allowing only the app tier into the databaseeasy
- Return traffic and security groupseasy
- VPN or a dedicated linkeasy
- Internal DNS names in a VPCeasy
- Google Cloud VPC scopeeasy
Medium 64
- Security groups vs network ACLsmedium
- Outbound internet from a private subnetmedium
- Cutting NAT costs for S3 trafficmedium
- AccessDenied from a VPC endpoint policymedium
- Intermittent 502s behind an ALBmedium
- Lambda in a VPC cannot reach an APImedium
- Reading VPC Flow Logs for a NACL issuemedium
- DNS failover to a DR regionmedium
- Paying for data sent to usersmedium
- Using a CDN to cut origin costsmedium
- End-to-end TLS behind a load balancermedium
- When to use mutual TLSmedium
- What HSTS doesmedium
- Data leaking through DNSmedium
- Usable hosts in a /26medium
- Do these CIDRs overlap?medium
- Which route winsmedium
- How traceroute finds each hopmedium
- Why new connections start slowmedium
- Who holds TIME_WAITmedium
- Refused vs timed outmedium
- Bandwidth-delay productmedium
- Throughput capped by the windowmedium
- How many devices share one public IPmedium
- TCP maximum segment sizemedium
- Capturing one host's HTTPS trafficmedium
- Counting TCP states on a servermedium
- A steady 40 ms delay on small writesmedium
- Idle connections that silently diemedium
- What VLANs separatemedium
- Addresses starting with fe80medium
- Testing a new server before the DNS switchmedium
- Head-of-line blocking in TCPmedium
- Ping by name fails, ping by IP worksmedium
- Following DNS delegation with digmedium
- A new record still says NXDOMAINmedium
- What "DNS propagation" really ismedium
- TLS 1.3 handshake costmedium
- Many HTTPS sites on one IPmedium
- Works in Chrome, fails in curlmedium
- Revalidating a cached file with an ETagmedium
- Certificates with short lifetimesmedium
- What mutual TLS addsmedium
- What HTTP/3 runs onmedium
- Reusing connections to a backendmedium
- When to use least connectionsmedium
- Errors during every deploymentmedium
- Every request comes from the load balancermedium
- Tracking parameters ruin the cachemedium
- The Vary headermedium
- Serving stale while refreshingmedium
- Deploying new CSS through a CDNmedium
- What an origin shield doesmedium
- Ending TLS at the load balancermedium
- Azure NSG rule ordermedium
- NACL blocks replies to outbound callsmedium
- Outbound-only IPv6medium
- Choosing NLB for a TCP servicemedium
- Uneven targets across zonesmedium
- Resolving names both waysmedium
- Speeding up a global UDP servicemedium
- Paying for public IPv4 addressesmedium
- Picking a CIDR for a new VPCmedium
- Central network, many team projectsmedium
Hard 48
- Transitive routing between VPCshard
- Unexpected data transfer billhard
- aws:SourceIp after adding a VPC endpointhard
- EKS pods cannot get IP addresseshard
- One NAT gateway for three AZshard
- CDN cache hit ratio of 4 percenthard
- App writes to old primary after failoverhard
- Connecting VPCs with the same CIDRhard
- Exposing one API to 200 customer VPCshard
- Fargate tasks cannot pull imageshard
- Pinning certificates in a mobile apphard
- Small pages load, big ones hanghard
- Return traffic through another firewallhard
- Thousands of half-open connectionshard
- Why a lost SYN costs a second or morehard
- How loss limits TCP throughputhard
- One link full, three idlehard
- A floating IP that moved but no one noticedhard
- Fixing MTU on a site-to-site tunnelhard
- Large DNS answers that vanishhard
- Latency jumps when someone uploadshard
- Connections that look alive but are nothard
- One IP announced from many citieshard
- Traffic takes a long way roundhard
- HTTP/3 on a network that blocks UDPhard
- Choppy calls with good average latencyhard
- A wildcard that does not cover a namehard
- A CA refuses to issue a certificatehard
- A domain that breaks only for some usershard
- Risk of TLS 1.3 early datahard
- Why staple OCSPhard
- Health checks that take down everythinghard
- Origin flooded when a hot object expireshard
- Static pages never cachedhard
- HTTP/3 on lossy mobile networkshard
- gRPC load lands on one podhard
- Some users still see the old certificatehard
- Geo DNS sends users to the wrong regionhard
- Clients stuck on HTTP/1.1hard
- Slow first loads after adding serviceshard
- New instances fall over on arrivalhard
- Jumbo frames that break over VPNhard
- Inspection firewall drops some flowshard
- Removing a rule did not cut the attacker offhard
- Private endpoint created, traffic still publichard
- Interface endpoint private DNS will not enablehard
- One dedicated link for a critical systemhard
- A partner wants fixed IPs for your ALBhard