Networking & Protocols
Putting it together: multiple-choice review
Crux Cross-track multiple-choice synthesis for the networking capstone — one URL through DNS, TCP/QUIC, TLS, proxy gates, render, and the cascade defenses that keep it standing.
Your altitude — climbing toward senior
ZeroJuniorMiddleSenior
You are at senior altitude — in orbitSix questions that each cut across several chapters of the track at once. None is a single-lesson definition — each is a decision a senior engineer makes when a real page load misbehaves and the cause could live in any layer.
Goal
Confirm you can reason about the whole stack as one system: which layer owns a symptom, which optimisation removes round-trips versus shortens them, and how a single slow dependency turns into a site-wide outage.
Quiz
Completed
A returning user loads a CDN-fronted page. You want the biggest single cut to time-to-first-byte. Which lever wins, and why?
Heads-up TLS 1.3 saves one RTT on a new connection, but on a warm return visit TLS already resumes at 0-RTT. The dominant cost is the origin round-trip, which only an edge cache hit removes.
Heads-up Faster origin compute helps only the processing span. The chain is round-trip bound, not CPU bound — shortening one span you already pay does far less than removing whole round-trips via the cache.
Heads-up A longer TTL helps DNS on repeat visits, but DNS is already sub-millisecond from the OS cache on a return visit. It is not where the milliseconds are.
Quiz
Completed
On a warm return visit over HTTP/3 the request is sent inside the QUIC Initial packet, before the server replies. The handler creates an order row. What is the correct server behaviour and why?
Heads-up 0-RTT encrypts the payload, but an attacker who captures the encrypted packet can resend it verbatim. Encryption does not prevent replay; idempotency does.
Heads-up Timing tricks do not close the replay window and break under load. The defined mechanism is to refuse 0-RTT for non-idempotent methods with 425 Too Early.
Heads-up Only idempotent methods (GET, HEAD, OPTIONS) are replay-safe at 0-RTT. A POST that mutates state is exactly the dangerous case.
Quiz
Completed
A botnet of 10,000 residential IPs each sends about 1 req/s. Your per-IP rate limit is 5 req/s and your WAF sees ordinary browser fingerprints. The origin is buckling. What actually stops this?
Heads-up Each bot is already under the limit at 1 req/s, and a stricter per-IP cap punishes legitimate browsers that burst many subresources at once. Per-IP limiting is the wrong axis for a distributed flood.
Heads-up PL4 blocks legitimate traffic that merely resembles attack patterns and still cannot distinguish a low-rate bot with a real browser fingerprint. Signature matching is not a volumetric defense.
Heads-up Residential botnet IPs share ASNs with real users, so ASN blocks cause collateral damage. The durable fix is bounding concurrency at origin, not blocklisting networks.
Quiz
Completed
The network finishes in 150 ms but LCP fires at 3.2 s. The hero image is injected by JavaScript after framework boot. What is the root cause and the highest-leverage fix?
Heads-up A failed resumption costs tens of milliseconds, not seconds, and the network already completed in 150 ms. The gap is the render pipeline, not the handshake.
Heads-up Render-blocking CSS is intentional and accounts for a small, bounded delay. A 3-second LCP gap points at the hero resource being discovered late, not at the CSSOM.
Heads-up TTFB is inside the 150 ms the network already spent. The 3-second gap is browser-side: the LCP element fetched late because the preload scanner could not discover it.
Quiz
Completed
A third-party API slows to 5 s. Within 30 s the whole site is down, though that API powers only checkout. Which combination of defenses would have contained the blast radius?
Heads-up Backoff slows each client's retry cadence but, with one shared pool across thousands of clients, the slow dependency still occupies every thread. Backoff without isolation does not stop one dependency starving the rest.
Heads-up A larger shared pool only lets more threads pile up on the slow dependency before it saturates; it postpones, not prevents, the total stall. Isolation (bulkhead), not size, contains it.
Heads-up A longer timeout holds each thread, connection, and buffer for longer on the slow call, accelerating exhaustion. Fast failure plus isolation is the cascade defense, not patience.
Quiz
Completed
A commuter on a train reports the app reloads each time the train enters a tunnel and the phone hops WiFi to cellular. The app runs HTTP/3. Where is the deployment bug?
Heads-up Surviving IP changes is exactly what QUIC connection migration provides via the Destination Connection ID. The reload means migration is being broken downstream, not that QUIC lacks the feature.
Heads-up Ticket lifetime is unrelated to a mid-session network change. Migration reuses the existing keys and streams on the new path; the failure is connection-ID routing, not resumption.
Heads-up HoL blocking is a TCP/HTTP/2 problem that QUIC's independent streams avoid, and it does not cause a full reload on a network change. The symptom is a broken migration path.
Recap
The through-line of the whole track is one system: a fixed phase chain (DNS, TCP/QUIC, TLS, proxy gates, origin, render) where round-trip count is the latency lever, and where removing round-trips (edge cache, 0-RTT, pooling) beats shortening them. The same composition fails as a system — distributed floods slip past per-IP limits, a late-discovered hero defeats the preload scanner, one slow dependency cascades through uncoordinated retries, and a connection-ID-blind load balancer breaks QUIC migration. Senior debugging is knowing which layer owns the symptom and which defense bounds the blast radius.