DevOps Networking Syllabus

Which transport protocol is typically preferred for real-time applications like video streaming, VoIP, and online gaming, and why?

UDP, because its low overhead and lack of retransmission/ordering give lower latency; occasional lost packets are preferable to delay in real-time media.

How many bytes is a standard TCP header versus a UDP header (without options)?

A standard TCP header is $20$ bytes (without options); a UDP header is $8$ bytes.

What four fields make up a UDP header?

Source Port, Destination Port, Length, and Checksum (each $16$ bits, total $8$ bytes).

What is the purpose of the TCP sliding window and flow control?

Flow control uses a receiver-advertised window size to limit how much unacknowledged data the sender may transmit, preventing the sender from overwhelming the receiver's buffer.

What are the well-known port ranges, and which ports do HTTP and HTTPS use by default?

Well-known ports: $0$–$1023$; registered: $1024$–$49151$; dynamic/ephemeral: $49152$–$65535$. HTTP uses port $80$; HTTPS uses port $443$.

What is the maximum number of ports available for TCP and UDP, and why?

$65{,}536$ ports ($2^{16}$, numbered $0$–$65535$), because the port field in the header is $16$ bits wide.

What is the core difference between HTTP and HTTPS?

HTTPS is HTTP layered over TLS/SSL, encrypting the communication for confidentiality and integrity and authenticating the server via a certificate; plain HTTP is unencrypted.

What does it mean that HTTP is a stateless protocol, and how is state commonly maintained?

Each HTTP request is independent; the server retains no memory of previous requests. State is maintained using cookies, sessions, or tokens.

Match these HTTP status code classes to their meanings: 2xx, 3xx, 4xx, 5xx.

2xx = Success; 3xx = Redirection; 4xx = Client error; 5xx = Server error. (1xx = Informational.)

What do HTTP status codes 200, 301, 404, and 500 mean?

200 OK (success); 301 Moved Permanently (redirect); 404 Not Found (client error); 500 Internal Server Error.

Which HTTP methods are considered idempotent, and what does idempotent mean?

GET, PUT, DELETE, HEAD, and OPTIONS are idempotent: making the same request multiple times has the same effect as making it once. POST is generally not idempotent.

In the TLS handshake, what type of cryptography establishes the session key versus what encrypts the bulk data?

Asymmetric (public-key) cryptography is used to authenticate and securely exchange/establish a shared key; symmetric cryptography then encrypts the bulk session data for efficiency.

What is the primary purpose of DNS (Domain Name System)?

To translate human-readable domain names (e.g., example.com) into IP addresses (and vice versa), acting as the "phonebook" of the Internet.

What default port and transport protocol does DNS use, and when does it switch?

DNS primarily uses port $53$ over UDP for queries; it switches to TCP for responses larger than $512$ bytes and for zone transfers.

Identify these DNS record types: A, AAAA, CNAME, MX.

A maps a name to an IPv4 address; AAAA maps a name to an IPv6 address; CNAME is an alias pointing one name to another name; MX specifies the mail server for a domain.

What is the role of a DNS TTL (Time To Live) value?

It specifies, in seconds, how long a DNS record may be cached by resolvers before they must query the authoritative server again.

Describe the order of DNS resolution from the client's perspective.

The resolver queries (after checking caches) the root nameserver, which refers to the TLD nameserver (e.g., .com), which refers to the authoritative nameserver for the domain, which returns the final record.

What is a DNS PTR record used for?

It performs reverse DNS lookup, mapping an IP address back to a hostname (the opposite of an A record).

What is a firewall, and what is the difference between a stateful and a stateless firewall?

A firewall filters traffic based on security rules. A stateless firewall inspects each packet in isolation against rules; a stateful firewall tracks active connection state and allows return traffic for established sessions.

What is the difference between a firewall DROP and a REJECT action?

DROP silently discards the packet with no reply (the sender just times out); REJECT discards the packet but sends back an error response (e.g., ICMP destination unreachable or TCP RST).

What is the typical "default deny" principle in firewall configuration?

All traffic is blocked by default, and only explicitly allowed (whitelisted) traffic is permitted, minimizing the attack surface.

What is the difference between an L4 (network) load balancer and an L7 (application) load balancer?

An L4 load balancer routes based on IP address and TCP/UDP port (transport layer); an L7 load balancer routes based on application-layer content such as HTTP headers, URLs, or cookies.

Name three common load-balancing algorithms.

Round Robin, Least Connections, and IP Hash. (Others include Weighted Round Robin and Least Response Time.)

What is the purpose of a health check in a load balancer?

It periodically probes backend servers and removes unhealthy/unresponsive ones from the pool so traffic is only routed to servers that can handle requests.

What is session persistence (sticky sessions) in load balancing?

A mechanism that ensures requests from a given client are consistently routed to the same backend server, typically using a cookie or source IP, to preserve session state.

What is a VPN, and what are its two primary security benefits?

A Virtual Private Network creates an encrypted tunnel over a public network. Its benefits are confidentiality (encryption of traffic) and privacy/anonymity (hiding the real IP and securing data over untrusted networks).

Compare IPsec and SSL/TLS VPNs.

IPsec VPNs operate at the network layer (Layer 3) and typically require a client, securing all IP traffic; SSL/TLS VPNs operate at the application/transport layer and are often browser-accessible (clientless), useful for specific application access.

What is the difference between a site-to-site VPN and a remote-access VPN?

A site-to-site VPN connects two entire networks (e.g., two office LANs) via gateways; a remote-access VPN connects an individual user's device to a private network from a remote location.

What is the difference between symmetric and asymmetric encryption?

Symmetric encryption uses one shared secret key for both encryption and decryption (fast); asymmetric encryption uses a public/private key pair, encrypting with one and decrypting with the other (slower, enables secure key exchange).

What do the three components of the CIA triad stand for in network security?

Confidentiality (data is accessible only to authorized parties), Integrity (data is accurate and unaltered), and Availability (systems and data are accessible when needed).

What is the difference between a DoS and a DDoS attack?

A DoS (Denial of Service) attack floods a target from a single source to exhaust its resources; a DDoS (Distributed DoS) attack uses many distributed compromised machines (a botnet) simultaneously, making it harder to block.