Middle Load Balancing & Networking Interview Questions (50 MCQs)

Question 1

Your service has request durations ranging from 10 ms to 30 s. Which algorithm usually performs better?

Accepted Answer

Least connections, since it accounts for each server's actual load

Answer

Round robin, since each server gets an equal request count

Answer

IP hash, since it pins each client to a fixed server

Answer

Random, since it needs no state and is faster

Question 2

Why is IP hash problematic for users behind corporate NAT or mobile carriers?

Accepted Answer

Thousands of users share one IP and all land on one server

Answer

NAT makes the hash produce a random value every time

Answer

IP hash does not work with private addresses at all

Answer

NAT converts every request into UDP

Question 3

What is the advantage of consistent hashing over `hash(key) % N` when adding a server?

Accepted Answer

Only about `1/N` of keys move instead of nearly all of them

Answer

No key is ever moved at all

Answer

Load is always perfectly even without any tuning

Answer

It removes the need to know the list of servers

Question 4

Why are virtual nodes used in consistent hashing?

Accepted Answer

So each server has many ring points and load is more even

Answer

To convert physical servers into virtual machines

Answer

To reduce the number of stored keys

Answer

To remove the need for a hash function

Question 5

How does the power of two choices algorithm work?

Accepted Answer

It picks two random servers and chooses the less loaded one

Answer

It always alternates between the first two servers in the list

Answer

It sends every request to two servers at once

Answer

It fails over only after two servers have failed

Question 6

What is the main cost of choosing a Layer 7 load balancer over Layer 4?

Accepted Answer

More CPU and latency from parsing HTTP and decrypting TLS

Answer

Inability to support multiple backend servers

Answer

Lack of any health checking for backends

Answer

Inability to use the HTTPS protocol

Question 7

What do you give up with TLS passthrough?

Accepted Answer

The ability to route by path, header, or cookie at the load balancer

Answer

Encryption between the client and the backend server

Answer

The ability to have more than one backend server

Answer

Support for HTTP/1.1 on the backend

Question 8

Why might traffic be re-encrypted to the backend after TLS termination at the LB?

Accepted Answer

For internal-network security or compliance while keeping L7 routing

Answer

To make responses smaller and faster

Answer

Because backends cannot understand plain HTTP

Answer

So the LB no longer needs a certificate

Question 9

What does SNI enable for a load balancer with a single IP?

Accepted Answer

Serving multiple domains with different certificates on one IP and port

Answer

Encrypting the domain name so no one can see it

Answer

Removing the need for certificates for domains entirely

Answer

Automatically upgrading HTTP/1.1 to HTTP/2

Question 10

Why is cookie-based stickiness usually better than IP-based stickiness?

Accepted Answer

It identifies each browser even when IPs are shared or changing

Answer

It never needs memory or state in the load balancer

Answer

It works without issue on Layer 4 load balancers too

Answer

It keeps the session intact when the server fails

Question 11

What trade-off comes with lowering health check interval and unhealthy threshold?

Accepted Answer

Faster failure detection, but risk of flapping and more probe traffic

Answer

Less CPU usage, but slower failure detection

Answer

More security, but incompatibility with HTTPS

Answer

There is no trade-off; it is always better

Question 12

What is the difference between readiness and liveness probes in Kubernetes?

Accepted Answer

Readiness decides if it gets traffic; liveness decides if it is restarted

Answer

Readiness runs only at build time; liveness only in production

Answer

Readiness checks memory; liveness checks disk

Answer

Both do exactly the same thing with different names

Question 13

Why can a health check that also verifies a shared database be dangerous?

Accepted Answer

A slow DB marks every instance unhealthy at once, taking the whole service down

Answer

Health checks cannot access databases

Answer

It causes database data to be deleted

Answer

It is only supported on Layer 4 load balancers

Question 14

What is the trade-off of a very low TTL (e.g. 30 s) on your main service's DNS record?

Accepted Answer

Faster failover, but more lookups, added latency, and more DNS dependency

Answer

More security, but incompatibility with IPv6

Answer

Lower cost, but slower failover

Answer

Better browser caching, but uneven load distribution

Question 15

Despite a 60 s TTL, some users hit the old IP for hours after failover. Most likely reason?

Accepted Answer

Some resolvers or runtimes ignore TTL and cache longer

Answer

TTL is measured in hours, not seconds

Answer

`A` records can never be changed

Answer

The old load balancer is blocking the new IP

Question 16

What is the key difference between GeoDNS and anycast for steering users to the nearest site?

Accepted Answer

GeoDNS returns different IPs at DNS; anycast uses one IP routed by BGP

Answer

GeoDNS is only for UDP; anycast is only for HTTP

Answer

GeoDNS requires BGP; anycast requires DNS

Answer

There is no difference; they are two names for one technique

Question 17

Why can't you put a `CNAME` at the zone apex (e.g. `example.com`), and what is the alternative?

Accepted Answer

A `CNAME` cannot coexist with `SOA`/`NS`; use `ALIAS`/`ANAME` or CNAME flattening

Answer

`CNAME` only works for IPv6; you must use `AAAA`

Answer

A `CNAME` at the apex causes infinite loops; use `MX` instead

Answer

`CNAME` is only for mail subdomains; use `TXT` instead

Question 18

What does global server load balancing (GSLB) do beyond plain GeoDNS?

Accepted Answer

It also factors in each region's health, capacity, and latency

Answer

It serves all traffic from a single datacenter

Answer

It replaces the local load balancers inside each region

Answer

It automatically shards the database across regions

Question 19

Your service has uploads up to 5 minutes, but deregistration delay is 30 s. What happens?

Accepted Answer

Long uploads get cut off during deploys or scale-in

Answer

The load balancer automatically extends the timeout to 5 minutes

Answer

Uploads migrate to a new server and continue

Answer

No effect, because draining only applies to HTTPS

Question 20

Why does an L4 load balancer often distribute service-to-service HTTP/2 traffic unevenly?

Accepted Answer

HTTP/2 multiplexes requests over few long-lived connections, and the LB only sees connections

Answer

HTTP/2 always uses UDP, which L4 does not support

Answer

HTTP/2 encrypts headers so the LB cannot see the port

Answer

HTTP/2 automatically broadcasts requests to all servers

Question 21

Which approaches are common for properly balancing gRPC traffic across instances?

Accepted Answer

An HTTP/2-aware L7 proxy like Envoy, or client-side load balancing

Answer

DNS round robin with a very high TTL

Answer

An L4 load balancer with IP hash

Answer

Converting every call to WebSocket

Question 22

What is a major downside of client-side load balancing?

Accepted Answer

LB logic must be implemented and updated in every client language and library

Answer

It always adds an extra network hop to every request

Answer

It cannot support more than two server instances

Answer

It can only be used with UDP

Question 23

What is the difference between server-side and client-side service discovery?

Accepted Answer

Server-side: an LB queries the registry; client-side: the client queries and picks

Answer

Server-side works only in the cloud; client-side only on-premise

Answer

Server-side: servers discover clients; client-side: the reverse

Answer

Server-side uses DNS; client-side has no registry at all

Question 24

Why do service registries typically use heartbeats or TTL leases for instances?

Accepted Answer

So instances that crashed without deregistering are removed automatically

Answer

To measure network speed between services

Answer

So each instance restarts every few seconds

Answer

To rotate service passwords automatically

Question 25

In a service mesh like Istio, what responsibilities does the sidecar proxy take from application code?

Accepted Answer

Load balancing, retries, mTLS, and traffic metrics between services

Answer

Business logic and input data validation

Answer

Database migrations and schema management

Answer

Rendering UI and managing frontend state

Question 26

What is the main cost of the sidecar architecture in a service mesh?

Accepted Answer

Per-pod resource usage and two extra proxy hops per call

Answer

Inability to use HTTPS between services

Answer

The need to fully rewrite all services

Answer

Incompatibility with containers and Kubernetes

Question 27

Users' WebSocket connections drop after exactly 60 s of inactivity. Most likely cause and fix?

Accepted Answer

The load balancer's idle timeout; send ping/heartbeats or raise the timeout

Answer

Browser memory limits; reduce message size

Answer

Certificate expiry; renew the certificate

Answer

DNS TTL limit; increase the record's TTL

Question 28

During WebSocket server deploys, all clients reconnect at once and overload servers. Best mitigation?

Accepted Answer

Client exponential backoff with jitter and gradual server rollout

Answer

Immediate reconnect of all clients to reduce downtime

Answer

Disabling health checks during deploys

Answer

Raising the DNS record's TTL to one day

Question 29

In an HAProxy setup with keepalived, what does the VRRP protocol do?

Accepted Answer

Moves a virtual IP to the backup node when the master fails

Answer

Spreads traffic across backend servers in round robin

Answer

Synchronizes TLS certificates between nodes

Answer

Pulls the HAProxy config from a git repository

Question 30

What is the main benefit and risk of active-active versus active-passive for load balancers?

Accepted Answer

All nodes' capacity is used, but if each runs above 50%, one failing overloads the other

Answer

Cost drops to zero, but HTTPS is not supported

Answer

Latency drops, but health checks become impossible

Answer

It has no risk and is always better

Question 31

Which statement best describes the difference between an API gateway and a load balancer?

Accepted Answer

A gateway focuses on API concerns like auth and transformation; an LB on spreading traffic across instances

Answer

A gateway only handles UDP traffic; an LB only TCP

Answer

A gateway is always faster and fully replaces the LB

Answer

An LB is used only in frontend and a gateway only in databases

Question 32

Which anti-pattern is common when using an API gateway?

Accepted Answer

Putting business logic in the gateway and turning it into a shared monolith

Answer

Using the gateway to enforce global rate limiting

Answer

Validating tokens at the gateway before reaching services

Answer

Running multiple gateway instances behind an LB

Question 33

When is the Backend for Frontend (BFF) pattern a better fit than one general API gateway?

Accepted Answer

When web and mobile clients need very different data and formats

Answer

When there is only one client type and one backend service

Answer

When you want all services directly exposed to the internet

Answer

When you need to remove authentication entirely

Question 34

After enabling TLS termination on the LB, the app gets stuck in an HTTPS redirect loop. Likely cause?

Accepted Answer

The app sees plain HTTP and does not check `X-Forwarded-Proto`

Answer

The LB's certificate was issued for the wrong domain

Answer

The DNS record points to the wrong IP

Answer

The browser does not support HTTP/2

Question 35

Behind an L4 load balancer that proxies connections, how can the backend learn the real client IP?

Accepted Answer

Via the PROXY protocol, which sends connection info at the start of the TCP stream

Answer

Via an `X-Forwarded-For` header the L4 LB adds

Answer

By checking the user's session cookie

Answer

By doing a reverse DNS lookup on the LB's IP

Question 36

What is the benefit of Direct Server Return (DSR)?

Accepted Answer

Responses go straight from backend to client, freeing LB bandwidth

Answer

Requests reach the backend without passing through the LB

Answer

It enables routing by path and cookie

Answer

TLS is automatically terminated on the LB

Question 37

Why shouldn't a load balancer retry failed `POST` requests by default?

Accepted Answer

The request may already have been processed, so retrying applies it twice

Answer

Because `POST` always has a very large body

Answer

Because LBs technically cannot send `POST`

Answer

Because retries cause the certificate to expire

Question 38

What does the slow start feature do for newly added instances?

Accepted Answer

Gradually ramps up the new instance's traffic share over a time window

Answer

Keeps the new instance entirely out of traffic for an hour

Answer

Throttles the new instance's network speed

Answer

Restarts the instance several times until stable

Question 39

How can a load balancer be used to perform a canary release?

Accepted Answer

With weighted routing, e.g. 5% of traffic to the new version and the rest to the current one

Answer

By sending all traffic to the new version and rolling back on errors

Answer

By disabling health checks for the new version

Answer

By setting the DNS record's TTL to zero

Question 40

In blue-green deployment, what role does the load balancer play?

Accepted Answer

It switches traffic from the current to the new environment at once, making rollback instant

Answer

It copies code between the blue and green environments

Answer

It automatically migrates each environment's database

Answer

It always splits traffic 50/50 between both environments

Question 41

What does outlier detection in proxies like Envoy catch that active health checks might miss?

Accepted Answer

An instance that returns `200` on `/health` but many `5xx` errors on real traffic

Answer

An instance whose CPU is below 10%

Answer

Clients sending too many requests

Answer

DNS records whose TTL has expired

Question 42

Request path: CDN → LB → service A → service B. How should timeouts be set?

Accepted Answer

Each outer layer should have a slightly longer timeout than its inner layer

Answer

All layers should have exactly the same timeout

Answer

Inner layers should have longer timeouts than outer layers

Answer

Disable timeouts in every layer

Question 43

What is the benefit of enabling keep-alive between the reverse proxy and backends?

Accepted Answer

Eliminates repeated TCP/TLS handshakes, cutting latency and port usage

Answer

It makes responses automatically cached

Answer

It removes the need for health checks

Answer

It automatically encrypts the traffic

Question 44

An LB has nodes in two AZs; zone A has 2 instances and zone B has 8. Without cross-zone load balancing, what happens?

Accepted Answer

Each node sends only within its zone, overloading zone A's two instances

Answer

All traffic automatically moves to zone B

Answer

The load balancer fails and returns `503`

Answer

Load stays exactly equal across all 10 instances

Question 45

A buggy instance answers every request in 2 ms with a `500`. What happens under least response time?

Accepted Answer

It looks fastest and attracts even more traffic (a black hole)

Answer

The LB immediately removes it for being slow

Answer

Traffic stays evenly spread across all instances

Answer

The algorithm automatically switches to round robin

Question 46

Why does anycast help absorb DDoS attacks?

Accepted Answer

Attack traffic is spread across dozens of PoPs worldwide instead of one site

Answer

Anycast automatically decrypts and drops malicious traffic

Answer

Anycast only lets trusted IPs connect

Answer

Anycast hides the service's IP from attackers

Question 47

Why does reverse proxy buffering (e.g. NGINX) protect backends from slow clients?

Accepted Answer

The proxy reads the response quickly from the backend and trickles it to the slow client itself

Answer

The proxy blocks slow clients entirely

Answer

The proxy increases the client's internet speed

Answer

The proxy converts responses into a smaller format

Question 48

In a chat app with several WebSocket servers behind an LB, how does a message from a user on server 1 reach a user on server 3?

Accepted Answer

Servers publish via a backplane like Redis Pub/Sub or a message broker

Answer

The load balancer copies the message to all servers

Answer

The server 3 user connects directly to server 1

Answer

Sticky sessions place all users on the same server

Question 49

What advantage does latency-based DNS routing (e.g. Route 53) have over geolocation routing?

Accepted Answer

It decides by measured network latency rather than geographic distance

Answer

It always sends users to the cheapest region

Answer

It removes the need to run in multiple regions

Answer

It automatically enforces data residency rules

Question 50

IP-based rate limiting in an app behind an LB throttles all users together. What is wrong?

Accepted Answer

The app sees the LB's IP and must read the client IP from a trusted `X-Forwarded-For`

Answer

Rate limiting only works correctly over HTTP/2

Answer

The LB sends all requests to a single instance

Answer

The DNS record's TTL is too low for rate limiting