Application Layer Protocols

1. What is the primary role of the Domain Name System (DNS) on the Internet?

DNS is the phonebook of the internet — it translates human-readable names like google.com into the numeric IP addresses computers actually use.

You type google.com
        ↓
DNS looks up google.com → 142.250.72.14
        ↓
Browser connects to that IP

Without DNS, you’d have to memorize IP addresses for every website.

How it works: your device asks a resolver, which queries a hierarchy of DNS servers (root → TLD → authoritative). Each returns the answer or points to the next server that knows it. Results are cached to keep it fast.

2. What happens when a user enters a website address (URL) in a browser?

The step-by-step flow:

1. DNS resolution — the browser asks DNS to convert the domain name (e.g., google.com) into an IP address.
2. TCP connection — the browser opens a TCP connection to that IP (three-way handshake).
3. TLS (for HTTPS) — a secure encrypted channel is established.
4. HTTP request — the browser sends the request (GET /) over the connection.
5. Response — the server returns the page, and the browser renders it.

URL → DNS → IP → TCP handshake → HTTPS request → server responds → render

DNS is the first step — without the IP, nothing else can begin.

3. What is the difference between Network Attached Storage (NAS) and a Storage Area Network (SAN)?

	NAS	SAN
Access level	File-level (files/folders)	Block-level (raw disk blocks)
Transport	Regular IP network (Ethernet)	Dedicated high-speed network
Protocols	NFS, SMB/CIFS	iSCSI, Fibre Channel
Look like	A shared file server	A local hard disk

• NAS — a device on your normal network that shares files using NFS/SMB. Like a shared drive: easy to use, familiar.
• SAN — a separate high-speed network of storage arrays exposing raw blocks. The server sees it as a directly attached disk, so it can format and manage the storage itself — needed for databases, VMs, applications with strict I/O needs.

Quick rule: NAS shares files over your LAN; SAN delivers blocks over its own dedicated, fast fabric.

4. What is the primary functional difference between a Forward Proxy and a Reverse Proxy?

They sit on opposite sides of the traffic flow.

• Forward Proxy — acts on behalf of internal clients making outbound requests. Hides client identities, caches content, enforces web policy.

[Client] ──→ [Forward proxy] ──→ Internet
   ↑ hides the client

• Reverse Proxy — stands in front of backend servers to manage inbound public requests. Load-balances, terminates SSL, shields the origin servers.

Internet ──→ [Reverse proxy] ──→ [Server A] / [Server B]
                        ↑ hides the servers

Forward proxy: “I go get the internet for you.” Reverse proxy: “The internet comes to me, I distribute it.” Both hide something — one hides clients, the other hides servers.

5. What is the defining characteristic of an Anonymous FTP configuration?

Anonymous FTP lets anyone access the server without a pre-registered account.

• Username: anonymous
• Password: your email address (a courtesy, rarely verified)

ftp> open files.example.com
Name: anonymous
Password: you@example.com

Why it exists: public distribution of files (drivers, open-source software, public documents). No account provisioning needed — the server just serves whatever it’s configured to share. It’s unrestricted by design, so it’s typically read-only and limited to a public directory.

6. What are the HTTP methods and status codes?

HTTP methods say what the client wants done:

• GET — fetch a resource (read-only, no body changes). The most common.
• POST — submit data to create/process something (login forms, uploads).
• PUT — replace a resource entirely (idempotent — same call same result).
• PATCH — partially update a resource.
• DELETE — remove a resource.
• HEAD — like GET but no body (headers only — used to check existence).

Idempotent methods (GET, PUT, DELETE, HEAD) can be retried safely; POST and PATCH are not.

Status codes come in five families:

• 1xx — informational (100 Continue).
• 2xx — success: 200 OK, 201 Created, 204 No Content.
• 3xx — redirection: 301 Moved Permanently, 302 Found, 304 Not Modified (cached).
• 4xx — client error: 400 Bad Request, 401 Unauthorized (no auth), 403 Forbidden (auth but no permission), 404 Not Found, 429 Too Many Requests.
• 5xx — server error: 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable, 504 Gateway Timeout.

The interview trio to always know: 200 = OK, 404 = not found, 500 = server broke. And the common trap: 401 is “you’re not logged in”, 403 is “you’re logged in but not allowed”.

7. Why is HTTP stateless and how do cookies and sessions work?

HTTP is stateless — each request is independent; the server doesn’t remember you between requests. By design this keeps servers simple and scalable (any server can serve any request). But applications need to remember logins — hence cookies and sessions.

Cookies — small name-value pieces the server sets (Set-Cookie header) that the browser stores and sends back with every request to that domain. They carry state across requests (session ID, preferences, tracking).

Sessions — the state kept on the server, keyed by a session ID. The flow:

1. Login → server creates a session, stores user data server-side
2. Server sends: Set-Cookie: session_id=abc123
3. Browser sends that cookie with every request
4. Server looks up abc123 → knows who you are

So the cookie is just the key; the session is the locked room it opens. Cookie = stored client-side, session = stored server-side. This pairing is how the stateless HTTP protocol runs stateful apps. (Security note: cookies can be hijacked, which is why modern apps sign/encrypt them and use HttpOnly/Secure flags.)

8. What is the difference between recursive and iterative DNS resolution?

When your resolver doesn’t have an answer cached, it must walk the DNS hierarchy (root → TLD → authoritative). The question is who does the walking:

• Recursive — the resolver does the walking on your behalf. It asks the root, gets pointed to the TLD server, asks that, gets pointed to the authoritative server, and so on — returning the final answer to you. One query from you; the resolver handles the rest.
• Iterative — the server responds with a referral (“I don’t know, but ask these servers”) and the client does the next query itself, one server at a time, until an authoritative answer comes back.

Recursive:
  You ──1 query──→ Resolver ──→ Root ──→ TLD ──→ Authoritative
                          ←── final answer back to you ──

Iterative:
  You → Root ("ask .com") → .com ("ask google.com's server") → Authoritative ("here's the IP")

In practice: your device sends a recursive query to its ISP’s resolver, which internally does iterative queries down the hierarchy. Recursive = “figure it out for me”; iterative = “point me to the next server.”

9. What are the email protocols — SMTP, POP3, and IMAP?

Email uses three protocols, each with a distinct job:

• SMTP (Simple Mail Transfer Protocol) — pushes mail. Used between mail servers and from client to server (sending). It’s like the postal truck — delivers the message. Port 25 (or 587 for submission).
• POP3 (Post Office Protocol v3) — downloads mail to one device and (by default) deletes it from the server. Offline-friendly, but no sync — checking on your phone doesn’t show what’s on your laptop. Port 110.
• IMAP (Internet Message Access Protocol) — syncs mail: messages stay on the server, and all devices see the same folders/state. The modern choice for multi-device use. Port 143.

Sender ──SMTP──→ Mail server ──SMTP──→ Recipient's mail server
                                            ↓ IMAP / POP3
                                       Recipient's device

The division: SMTP sends, POP3/IMAP receive. SMTP only ever pushes; you can’t use it to pull mail into your inbox. POP3 is “download and done”; IMAP is “keep in sync everywhere.”

10. How does FTP work and how does it differ from SFTP and TFTP?

• FTP (File Transfer Protocol) — transfers files over TCP using two connections: a control connection on port 21 (commands) and a separate data connection (the actual file). Plain FTP is unencrypted — credentials and data travel in clear text. Runs in active or passive mode (passive solves the firewall/NAT problem).
• SFTP (SSH File Transfer Protocol) — FTP-style file transfer over SSH, so everything is encrypted. Not the same as FTPS (FTP + TLS); SFTP is a separate protocol built on SSH. The safe, modern choice.
• TFTP (Trivial FTP) — a minimal UDP file transfer: no authentication, no directory listing, no security. Used for simple tasks like booting diskless devices or router firmware updates over the LAN.

	FTP	SFTP	TFTP
Transport	TCP	SSH (TCP)	UDP
Encryption	No	Yes	No
Auth	Yes	Yes	None
Use	Legacy transfers	Secure transfers	Device boot/updates

The one-liner: FTP is legacy plaintext, SFTP is encrypted FTP over SSH, TFTP is a tiny UDP file pusher for bootstrapping hardware.