Answer: The OSI (Open Systems Interconnection) Model is a conceptual framework that standardizes network communication functions into seven logical layers:

1. Physical (Layer 1): Transmits raw bit streams over physical media (cables, fiber, radio frequencies).
2. Data Link (Layer 2): Encapsulates packets into frames and handles node-to-node data transfer, error detection, and MAC addressing (Switches operate here).
3. Network (Layer 3): Routes data packets between different networks using IP addressing (Routers operate here).
4. Transport (Layer 4): Manages end-to-end connection control, reliability, segmenting, and port addressing (TCP/UDP protocols operate here).
5. Session (Layer 5): Manages authentication, session authorization, and continuous dialogue connection control between applications.
6. Presentation (Layer 6): Translates, encrypts, decrypts, and compresses data formats (SSL/TLS, JSON/XML mapping).
7. Application (Layer 7): Provides network interface access to end-user software services (HTTP, DNS, SSH, SMTP).

Answer: The TCP/IP Model (or Internet Protocol Suite) is a practical, simplified 4-layer model used to design real-world internet architectures:

• Link Layer (equivalent to OSI Layers 1-2): Manages physical connections, MAC addresses, and network interface hardware drivers (Ethernet, Wi-Fi).
• Internet Layer (equivalent to OSI Layer 3): Packages and routes data packets across network boundaries (IP, ICMP, ARP).
• Transport Layer (equivalent to OSI Layer 4): Establishes logical host-to-host communication channels (TCP, UDP).
• Application Layer (equivalent to OSI Layers 5-7): Dictates application-level protocol formatting (HTTP, DNS, SSH, FTP).

Answer:

Answer: A socket is a software abstraction representing an endpoint in a two-way communication link between two programs running on a network. It is uniquely identified by the combination of an IP Address and a Port Number (e.g., 192.168.1.100:80).

Answer: Port Forwarding (or port mapping) is a Network Address Translation (NAT) application that redirects a communication request from one address and port combination to another while packets traverse a network gateway (e.g., exposing a private container application listening on port 8080 to the host's public IP port 80).

Answer: DNS acts as the phonebook of the internet, converting human-readable domain names (e.g., example.com) into computer-readable IP addresses (e.g., 93.184.216.34) in a recursive process:

                  ┌──────────────────────┐
                  │ 👤 User Web Browser  │
                  └──────────┬───────────┘
                             │ 1. Query: "example.com"
                             ▼
                  ┌──────────────────────┐
                  │ 🗄️ Recursive Resolver│ ◀───┐
                  └──────────┬───────────┘     │
                             │                 │ 8. Returns IP
                             │ 2. Queries      │
                             ▼                 │
                 ┌────────────────────────┐    │
                 │ 🌐 Root Name Server    │ ───┤
                 └────────────────────────┘    │
                             │                 │
                             │ 3. Refer to .com│
                             ▼                 │
                 ┌────────────────────────┐    │
                 │ 🌐 TLD Name Server     │ ───┤
                 └────────────────────────┘    │
                             │                 │
                             │ 4. Refer to DNS │
                             ▼                 │
                 ┌────────────────────────┐    │
                 │🌐 Authoritative Server │ ───┘
                 └────────────────────────┘

1. Client Query: Browser checks local DNS cache. If not found, it queries the Recursive Resolver (usually managed by your ISP or a public provider like 8.8.8.8).
2. Root Server Query: The recursive resolver queries a Root Name Server (.). The root server directs the resolver to the Top-Level Domain (TLD) Server handling .com.
3. TLD Server Query: The resolver queries the TLD server. The TLD server responds with the IP of the domain's Authoritative Name Server.
4. Authoritative Server Query: The resolver queries the authoritative name server, which returns the actual IP address mapped to the domain.
5. Caching & Response: The resolver returns the IP to the browser and caches it for future use.

Answer: DNS Caching is the temporary storage of IP mappings close to the requesting client (in browsers, operating systems, routers, and resolvers) for a duration defined by the record's TTL (Time to Live), minimizing the need to query recursive resolvers and root servers repeatedly.

Answer: Route 53 is a highly available and scalable cloud Domain Name System (DNS) service provided by AWS. It performs three primary functions: domain registration, recursive DNS routing, and resource health checking, supporting advanced routing policies (latency-based, geolocation, failover, and weighted routing).

Answer: Split-Horizon DNS is a DNS configuration where the name server returns different IP addresses for the same domain name depending on the source IP of the requesting client (e.g., returning a private VPC IP 10.0.1.15 to internal staff, but returning a public elastic IP 54.210.12.5 to external internet clients).

Answer: DNS Propagation is the period of time required for changes to DNS records (like updating an IP address) to distribute and update across all DNS cache caches worldwide. This can take up to 24–48 hours, dictated by the cached record's TTL setting.

Answer:

1. Parse URL: The browser extracts the protocol (https), host name (example.com), and path.
2. DNS Resolution: Resolves the hostname to an IP address.
3. Establish Connection: Initiates a TCP 3-way handshake (SYN ➡️ SYN-ACK ➡️ ACK) with the server IP on port 443.
4. TLS Handshake: Negotiates encryption keys, verifies the server's SSL certificate, and establishes a secure TLS session.
5. Send HTTP Request: Browser sends an HTTP request (e.g., GET /index.html).
6. Server Response: Server processes the request and returns an HTTP response code (e.g., 200 OK) and payload data (HTML, JS).
7. Render Page: Browser parses HTML, fetches secondary resources (CSS, images), and renders the webpage.

Answer: HTTPS overlays HTTP on top of the SSL/TLS protocol to encrypt communication:

1. Client Hello: Client sends supported TLS versions, cipher suites, and a random string.
2. Server Hello: Server responds with the selected TLS version, selected cipher suite, another random string, and its SSL Certificate.
3. Authentication: Client validates the SSL certificate signature against its list of trusted Certificate Authorities (CAs).
4. Key Exchange:
   • Client generates a Pre-Master Secret, encrypts it using the server's public key from the certificate, and sends it to the server.
   • Server decrypts the Pre-Master Secret using its private key.
5. Generate Session Keys: Both client and server use the Pre-Master Secret and the initial random strings to calculate a symmetric Session Key.
6. Handshake Finished: Both sides send encrypted verification messages confirming that all future messages will be encrypted using the symmetric Session Key.

Answer:

• SSL (Secure Sockets Layer): The original encryption protocol developed by Netscape in the 1990s. SSL v2 and v3 are deprecated due to cryptographic vulnerabilities.
• TLS (Transport Layer Security): The modern, secure successor to SSL. TLS 1.2 and 1.3 are the current industry standards. (Although TLS is used everywhere, it is still commonly referred to as "SSL").

Answer: An SSL Certificate is a digital file signed by a trusted third-party Certificate Authority (CA) that binds a public cryptographic key to an organization's identity or domain name, verifying that the server represents the actual domain owner.

Answer: In standard TLS, only the server proves its identity to the client. In Mutual TLS (mTLS), both the client and the server validate each other's certificates:

• The client verifies the server's certificate.
• The server requests and verifies the client's certificate.
• Commonly used in zero-trust microservice networks (Service Meshes like Istio or Linkerd) to prevent unauthorized internal service communication.

Answer: A Load Balancer is a physical device or virtual software layer that acts as a traffic cop, distributing incoming client network requests (HTTP, TCP, UDP) across a pool of healthy backend servers.

Why it is Important:#

• Prevents Overload: Ensures no single server becomes a performance bottleneck by distributing requests evenly.
• High Availability & Failover: Monitors backend server health; if a server fails, the load balancer stops routing traffic to it, sending requests to healthy servers instead.
• SSL Termination: Can decrypt incoming HTTPS traffic at the load balancer level, freeing backend servers from computational overhead.
• Scalability: Allows adding or removing backend servers seamlessly without affecting the client connection endpoint.

Answer:

• Layer 4 Load Balancer (Network Level):
  • Operates at the Transport Layer (TCP/UDP).
  • Distributes traffic based on IP addresses and port numbers. It does not inspect the payload content (e.g., AWS Network Load Balancer).
  • Pros: Incredibly fast, handles millions of connections with low latency.
• Layer 7 Load Balancer (Application Level):
  • Operates at the Application Layer (HTTP/HTTPS).
  • Distributes traffic based on HTTP headers, cookies, URL paths, or query parameters (e.g., AWS Application Load Balancer, Nginx).
  • Pros: Supports smart routing (e.g., routing traffic containing /api to an API service and /images to a storage service).

Answer: Sticky Session is a load balancer configuration that routes all requests from a specific user session to the same backend server for the duration of the session, typically managed using cookies. This is useful for legacy stateful applications that store session data in local server memory.

Answer:

• Forward Proxy: Acts on behalf of clients to filter, cache, or anonymize outgoing internet requests (e.g., a corporate firewall blocking employees from accessing social media).
• Reverse Proxy: Acts on behalf of servers. It intercepts incoming requests from the internet and forwards them to internal backend servers (e.g., Nginx handling SSL termination, IP masking, and static caching).
  • Key Functions:
    • Load Balancing: Distributes incoming HTTP requests to healthy backend application instances.
    • Security (IP Masking): Hides the IP address of backend servers from clients, preventing direct exploitation.
    • SSL/TLS Termination: Handles decryption of HTTPS traffic, reducing CPU load on backend servers.
    • Caching: Caches static assets (images, CSS, JS) locally to speed up user load times.
    • Common Example: Nginx is widely used as a reverse proxy, web server, and API gateway.

Answer: Follow a bottom-up troubleshooting methodology:

1. Check Client Connectivity: Confirm the issue is not local (e.g., test using curl -I https://website.com from external networks).
2. DNS Verification: Run dig website.com or nslookup to verify the hostname resolves to the correct IP.
3. Check Port Openness: Run nc -zv <IP> 443 or telnet <IP> 443 to check if port 443 is accepting connections.
4. Trace Network Path: Run traceroute <IP> or mtr <IP> to identify where network packets are being dropped.
5. Check Security Rules: Verify if security groups, NACLs, or local iptables are blocking ports.
6. Inspect Web Server: SSH into the server and run systemctl status nginx (or apache) to check if the server daemon is running.
7. Check Logs: Audit web server logs (/var/log/nginx/error.log) and system resources (top, df -h).

Answer:

• Verify your local network has DNS servers configured (cat /etc/resolv.conf).
• Query public resolvers to isolate issues: dig website.com @8.8.8.8.
• Check the domain registration status and nameserver records at the registrar (WHOIS lookup).
• Check if the authoritative DNS zones (e.g., AWS Route53 hosted zones) contain the correct A or CNAME records.

Answer:

• Impact: User web browsers will display a warning page stating "Your connection is not private," blocking users from accessing the site. Automated API requests will fail with TLS handshake errors.
• Resolution:
  1. Generate a new CSR (Certificate Signing Request).
  2. Request a renewal from your CA (e.g., Let's Encrypt, DigiCert, AWS Certificate Manager).
  3. Deploy the new certificate and private key to the web server, load balancer, or CDN.
  4. Reload the web server configuration (e.g., systemctl reload nginx) to apply changes.
  5. Mitigation: Implement automated certificate renewals using tools like certbot or AWS ACM auto-renewal.