Top 30 Networking Interview Questions and Answers
30 multiple-choice questions on Networking, drawn from 30 bites out of the 137 tagged Networking on Tezvyn. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
When bursting compute into the public cloud from on-prem, which factor most often becomes the real bottleneck?
Show the answer
Answer: d · Data gravity and the latency or cost of reaching on-prem data
Compute scales quickly, but the data the workload needs usually lives on-prem, so latency and egress dominate. Instance variety and quotas are minor and easily addressed by comparison.
Read the full bite: Hybrid cloud bursting from a VMware footprint
Question 2 of 30
To prevent data loss in a client-side event batching system when a user closes the tab, which approach best balances reliability and user experience?
Show the answer
Answer: b · Use `navigator.sendBeacon()` within a `pagehide` event listener to send the final batch asynchronously without blocking the page unload.
`navigator.sendBeacon()` is designed for this exact use case, reliably sending data without blocking the unload process. A standard `fetch()` is not guaranteed to complete, and synchronous XHR is a deprecated practice that harms user experience.
Read the full bite: Design a Client-Side Event Batching System
Question 3 of 30
For multi-service applications on a single host, why are user-defined bridge networks preferred over the default bridge network?
Show the answer
Answer: b · They provide an internal DNS service for containers to resolve each other by name.
The card explicitly states that user-defined bridge networks are superior because they provide an internal DNS service, allowing containers to find each other by name, which is essential for multi-service applications. The default bridge network lacks this feature, making it brittle due to changing IP addresses.
Read the full bite: Docker Networking: How Containers Talk to Each Other
Question 4 of 30
What is the main trade-off of placing latency-sensitive VMs in a tight cluster placement group?
Show the answer
Answer: d · It reduces fault isolation since instances share the same rack or zone
Packing instances physically close for low latency concentrates them, so a single hardware or zone failure can take down many at once. Placement groups do not cap instance size or disable enhanced networking.
Read the full bite: Optimizing low-latency VM-to-VM networking
Question 5 of 30
When an application scales by adding new servers, how does a cloud load balancer ensure these new servers are utilized?
Show the answer
Answer: b · It detects the new servers via health checks and includes them in its traffic distribution.
The card states that the load balancer "automatically detects these new instances, passes its health checks, and begins routing a share of the incoming HTTP requests to them." This ensures new servers are utilized. Option C is incorrect because the load balancer manages the backend server pool internally, not by updating DNS for individual backend servers.
Read the full bite: Cloud Load Balancer: Your App's Traffic Cop
Question 6 of 30
In a Compose project, why does the web app use db (the service name) rather than localhost to reach the database?
Show the answer
Answer: d · From inside the web container, localhost is the web container itself; db resolves via Docker DNS to the database
Each container's localhost refers to itself, so the web container must use the database's service name, which Docker's embedded DNS resolves to the right container; the localhost-blocking and protocol claims are false.
Read the full bite: How Compose services reach each other by name
Question 7 of 30
Why can Compose services resolve each other by name on the default network but containers on Docker's legacy default bridge cannot?
Show the answer
Answer: a · Compose creates a user-defined bridge, which includes embedded DNS, unlike the legacy default bridge
Compose's per-project network is a user-defined bridge with embedded DNS enabling name resolution, whereas Docker's legacy default bridge lacks automatic DNS; Compose neither disables DNS nor uses host networking by default.
Question 8 of 30
Which approach correctly places a one-time network request and a bounds-dependent layout update in a UIViewController?
Show the answer
Answer: d · Start the request in viewDidLoad and update frames in viewDidLayoutSubviews
viewDidLoad runs once after the view is created, making it the right place for an initial network request, while viewDidLayoutSubviews fires after Auto Layout resolves final bounds so frames are accurate there. Updating frames in viewDidLoad is a common mistake because safe area insets and final bounds are not yet guaranteed at that point.
Read the full bite: UIViewController lifecycle states: network vs geometry updates
Question 9 of 30
In a Docker Compose application, how should one service (e.g., 'web') typically refer to another service (e.g., 'database') to establish a connection?
Show the answer
Answer: d · By using the service name 'database' as the hostname.
Docker Compose creates a private network with a built-in DNS service, allowing services to communicate by using their defined service names as hostnames. The card explicitly states that using 'localhost' is a footgun, as it refers to the container itself, not other services.
Read the full bite: Docker Compose Networking: How Services Talk to Each Other
Question 10 of 30
What most fundamentally keeps a database in a private subnet unreachable from the internet?
Show the answer
Answer: c · The private subnet's route table has no route to an internet gateway
Without an internet-gateway route, no inbound internet path exists to the subnet, providing network-level isolation. Security groups add a layer but routing is the structural control, and NAT only enables outbound, not encryption.
Question 11 of 30
A service exposes a custom binary protocol over TCP that needs maximum throughput and source IP preservation. Which load balancer fits best and why?
Show the answer
Answer: d · Layer 4, because it routes on IP and port without reading payload, adding minimal overhead
L4 routes purely on IP and port, so it handles arbitrary protocols at high throughput with low overhead. L7 must terminate and parse HTTP, which it cannot do for a custom binary protocol.
Question 12 of 30
Why might a freshly changed DNS record not take effect immediately for all users worldwide?
Show the answer
Answer: b · Cached answers persist in resolvers until the previous record's TTL expires
Resolvers cache records for the TTL set before the change, so old answers linger until that timer expires. Root servers do not approve individual records, and browsers do cache DNS.
Question 13 of 30
A company expects to grow from two VPCs to forty, all needing to reach shared services. Which approach avoids an unmanageable connectivity mesh?
Show the answer
Answer: d · A Transit Gateway acting as a central hub-and-spoke router
A Transit Gateway centralizes routing so each VPC attaches once, avoiding the N-squared peering mesh. Pairwise peering scales poorly and is non-transitive.
Question 14 of 30
SSH to an instance works and the app process is running, yet the load balancer reports it unhealthy. Which is the LEAST likely useful first check?
Show the answer
Answer: d · Rebooting the entire instance before reading any probe response
Rebooting blindly discards diagnostic state and rarely addresses a probe mismatch. The productive steps reproduce the probe to find a path, port, status, or firewall mismatch.
Read the full bite: Process running but load balancer says unhealthy
Question 15 of 30
A workload needs predictable single-digit-millisecond latency and steady multi-gigabit throughput to the cloud. Which is the strongest choice and its main cost?
Show the answer
Answer: a · Dedicated interconnect, with higher recurring cost and weeks of lead time
A dedicated interconnect bypasses the public internet for consistent low latency and high bandwidth, but costs more and takes weeks to install. VPNs inherit variable internet latency, so they cannot guarantee it.
Read the full bite: Site-to-Site VPN vs dedicated interconnect
Question 16 of 30
Why is assigning public IPs directly to autoscaling instances a poor way to satisfy a partner's IP allowlist?
Show the answer
Answer: a · Instance public IPs change as the fleet scales, so the allowlist becomes stale
Autoscaling cycles instances and reassigns ephemeral IPs, so an allowlist built on them breaks. Routing through NAT gateways with allocated static IPs gives a stable, whitelistable source set.
Read the full bite: Stable egress IPs for multi-region outbound traffic
Question 17 of 30
Which approach correctly enables an iOS app to complete a large file download after the user backgrounds the app?
Show the answer
Answer: a · Configure a background URLSession with a unique identifier, enqueue a download task, and invoke the saved completion handler after the delegate finishes processing the transfer.
A background URLSession with a download task allows the system to continue the transfer even when the app is suspended, and you must call the saved completion handler within about 30 seconds after handling delegate messages. The most tempting distractor mixes the correct background session with beginBackgroundTask, but that API only provides a short CPU extension for cleanup and cannot sustain a long-running download.
Read the full bite: How do you complete a file download after the app backgrounds?
Question 18 of 30
What fundamental problem does a storage gateway primarily solve in a hybrid cloud setup?
Show the answer
Answer: d · Bridging the protocol gap between on-premise applications and cloud storage APIs.
A storage gateway's core function is to translate traditional on-premise storage protocols (like NFS or iSCSI) into cloud-native API calls (like REST), allowing legacy applications to use cloud storage without modification. It does not eliminate all local storage, nor is it suitable for latency-sensitive applications.
Read the full bite: Storage Gateway: Your On-Prem to Cloud Translator
Question 19 of 30
A subnet-level filter allows inbound port 443 but connections still fail. Which property most likely explains the broken return traffic?
Show the answer
Answer: d · The NACL is stateless, so outbound ephemeral-port traffic must be explicitly allowed
A NACL is stateless, so the inbound allow does not auto-permit the reply; you must allow outbound traffic on the ephemeral port range. Security groups, by contrast, are stateful and handle returns automatically.
Question 20 of 30
Why is a Service needed in front of the Deployment's Pods for external access?
Show the answer
Answer: c · Pod IPs are ephemeral, so a Service provides a stable endpoint and load-balances across them
Pods get new IPs when rescheduled; a Service gives a durable virtual IP and balances traffic across current healthy Pods. The Deployment creates Pods regardless of any Service.
Read the full bite: Minimal objects to expose a stateless app
Question 21 of 30
What is the fundamental benefit a Virtual Private Cloud (VPC) provides within a public cloud?
Show the answer
Answer: a · It creates a logically isolated network space, giving you control over traffic and resource separation.
A VPC's core purpose is to provide a logically isolated network environment, allowing you to define network rules and separate resources like web servers from databases. While security is enhanced, automatic encryption of all resources is not its primary function, nor does it guarantee dedicated physical hardware or bypass the public internet for external communication.
Read the full bite: VPC: Your Private Slice of the Public Cloud
Question 22 of 30
Which CIDR block represents the largest number of IP addresses?
Show the answer
Answer: b · 10.0.0.0/8
The card explains that a smaller number after the slash (prefix length) indicates a larger network. A /8 block has the smallest prefix length among the options, meaning it reserves the fewest bits for the network portion and the most for host addresses, resulting in the largest number of available IPs. A common misconception is that a larger number after the slash means a larger network, but it actually means a smaller network.
Question 23 of 30
What is the main purpose of partitioning a Virtual Private Cloud (VPC) into multiple subnets?
Show the answer
Answer: d · To create distinct, isolated network segments for better organization and security management.
The card explains that subnets partition a VPC into "smaller, manageable, and isolated segments" for "logical grouping, security boundaries, and controlled traffic flow." Option B is incorrect because subnets divide the IP range, not unify it. Options B and D describe other network features not directly related to the core purpose of subnet partitioning.
Read the full bite: Cloud Subnets: Your Virtual Network's Neighborhoods
Question 24 of 30
Which statement accurately describes a key aspect of a security group's 'stateful' behavior?
Show the answer
Answer: d · It automatically allows inbound response traffic for connections initiated from within the protected resource.
A stateful firewall tracks active connections, automatically allowing return traffic for connections initiated from within the resource, even if no explicit inbound rule exists for that return traffic. Option B is incorrect because security groups are allow-only and do not support explicit deny rules.
Read the full bite: Security Groups: Stateful Firewalls for Your Cloud Resources
Question 25 of 30
Which type of content should generally NOT be served through a Content Delivery Network (CDN)?
Show the answer
Answer: b · A user's unique shopping cart details
The card explicitly states that highly dynamic or personalized content, such as a user's shopping cart, should not be cached on a CDN to prevent data leaks. Static assets like images, JavaScript, and pre-recorded videos are ideal for CDN delivery.
Read the full bite: Content Delivery Network (CDN): Serving Content from the Edge
Question 26 of 30
Which of the following best describes the primary advantage of using Managed Cloud DNS over self-hosting DNS servers?
Show the answer
Answer: c · It abstracts away the operational complexities of server management, scaling, and security.
Managed Cloud DNS's core purpose is to abstract away the operational burden of managing DNS servers, including patching, scaling, and protecting against DDoS attacks. The card explicitly states it is not a general-purpose database and lacks complex query or transactional guarantees.
Read the full bite: Managed Cloud DNS: Offload Your DNS Server Management
Question 27 of 30
For which use case would you typically deploy an AWS NAT Gateway?
Show the answer
Answer: b · To allow instances in a private subnet to initiate outbound connections to the internet for updates.
A NAT Gateway's primary purpose is to enable instances in private subnets to initiate outbound internet traffic, such as downloading updates, without allowing unsolicited inbound connections. Option A is incorrect because NAT Gateways do not permit inbound traffic from the internet. Option D is incorrect as NAT Gateways do not provide direct public IP addresses to private instances for inbound access.
Read the full bite: NAT Gateway: Your VPC's Outbound-Only Internet Door
Question 28 of 30
Which statement accurately describes a critical configuration requirement for a Network ACL (NACL) to allow a web server in its associated subnet to successfully respond to incoming HTTP requests?
Show the answer
Answer: d · Both an inbound rule allowing HTTP traffic on port 80 and an outbound rule allowing traffic on ephemeral ports (1024-65535) must be explicitly defined.
NACLs are stateless, meaning they do not remember previous connections. Therefore, to allow a web server to respond to an inbound HTTP request, explicit outbound rules for the return traffic on ephemeral ports must be configured in addition to the inbound HTTP rule. Option C describes the behavior of stateful firewalls like Security Groups, not NACLs.
Read the full bite: Network ACLs: A Stateless Firewall for Subnets
Question 29 of 30
What is a key benefit of using gRPC for internal microservice communication compared to REST/JSON?
Show the answer
Answer: a · It enforces a strict, language-agnostic contract, leading to higher performance and fewer integration issues.
The card highlights that gRPC enforces a strict contract via Protocol Buffers, which prevents data mismatch errors and, combined with efficient binary transport, leads to high performance. Options A and D describe attributes that are either benefits of REST/JSON or scenarios where gRPC is not recommended.
Read the full bite: gRPC: High-Performance RPC with Contracts
Question 30 of 30
Which statement accurately describes a fundamental limitation of VPC peering?
Show the answer
Answer: c · It does not support transitive routing, meaning communication cannot pass through an intermediate peered VPC.
The card explicitly states that VPC peering connections are not transitive, meaning communication cannot pass through an intermediate VPC. This is a critical limitation for complex network designs. The other options contradict the card's description of VPC peering's security, reliability, and cross-account/region capabilities.
Read the full bite: VPC Peering: Connect Private Networks Securely
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.