Application Layer Practice Questions

DNS uses UDP (port 53) for standard queries because DNS messages are typically small (under 512 bytes traditionally, 4096 bytes with EDNS0) and latency matters more than guaranteed delivery - if a UDP response is lost, the client simply retries. DNS uses TCP (port 53) when: (1) the response exceeds the UDP size limit and is truncated, (2) for zone transfers (AXFR) between authoritative servers, which involve large amounts of data requiring reliable delivery. This dual-protocol approach balances efficiency and reliability.

DNS iterative resolution (from scratch with empty cache): (1) Client contacts the local DNS resolver (recursive resolver). (2) Local resolver queries a root DNS server → root returns the address of the .com TLD server. (3) Local resolver queries the .com TLD server → TLD returns the address of example.com's authoritative server. (4) Local resolver queries example.com's authoritative DNS server → gets the IP address of www.example.com. (5) Local resolver caches the result and returns it to the client. The order is: Root → TLD → Authoritative.

In iterative resolution, each DNS server responds with a referral to the next server to query. In recursive resolution, the DNS server does the full lookup on behalf of the client.

SMTP session flow: (1) TCP connection established on port 25. (2) Server sends 220 greeting. (3) Client sends EHLO (or HELO) with its domain - server responds with 250 and supported extensions. (4) MAIL FROM: sender@domain - specifies the sender envelope address. (5) RCPT TO: recipient@domain - specifies each recipient. (6) DATA - client sends message headers and body, ending with a line containing only '.'. (7) Server responds 250 OK. (8) QUIT - terminates session. SYN/SYN-ACK/ACK is the TCP handshake (transport layer), not SMTP.

Non-persistent HTTP (HTTP/1.0 default): each request/response pair requires a new TCP connection - incurring a 2-RTT overhead per object (1 RTT for TCP handshake + 1 RTT for HTTP request/response). For a page with k objects: 2k RTTs total. Persistent HTTP (HTTP/1.1 default): the TCP connection remains open after a response, allowing multiple requests/responses over the same connection. With pipelining, the client can send multiple requests without waiting for responses, reducing total time to approximately 2 RTTs for the base page + k RTTs for k objects.

Cookie mechanism: (1) Server sends 'Set-Cookie: session_id=abc123; Expires=...' in HTTP response header. (2) Browser stores the cookie locally. (3) Browser includes 'Cookie: session_id=abc123' in every subsequent HTTP request to the same domain. (4) Server reads the cookie to identify the user/session, maintaining state across the stateless HTTP protocol. Cookies can store user preferences, session tokens, tracking identifiers. They have attributes: Domain, Path, Expires/Max-Age, Secure (HTTPS only), HttpOnly (no JS access).

HTTP status code categories: 1xx (Informational), 2xx (Success), 3xx (Redirection), 4xx (Client Error), 5xx (Server Error). A: 200 OK - request succeeded, response body contains the resource ✓. B: 301 Moved Permanently - resource at a new URI; client should update bookmarks and use the new URL ✓. C: FALSE - 404 Not Found means the requested resource does not exist on the server; 500 Internal Server Error is the server error. D: 304 Not Modified - used with conditional GET (If-Modified-Since); server confirms cached copy is still current, no body is sent ✓.

Non-persistent HTTP requires 2 RTTs per object: 1 RTT for TCP connection establishment + 1 RTT for HTTP request and response. Total objects = 1 base HTML + 10 images = 11 objects. Total time = 11 × 2 RTTs = 22 RTTs = 22 × 100ms = 2200ms. Each object requires its own TCP handshake (1 RTT) followed by the HTTP GET and response (1 RTT), giving 200ms per object × 11 objects = 2200ms.

HTTPS (HTTP Secure) uses TLS (Transport Layer Security), formerly SSL (Secure Sockets Layer), to encrypt HTTP communications, providing confidentiality, integrity, and authentication.

DNS record types: A record - maps hostname to IPv4 address (e.g., example.com → 93.184.216.34). AAAA record - maps hostname to IPv6 address (NOT the NS record). MX record - specifies the mail exchange server(s) for a domain with priority values. CNAME record - Canonical Name, creates an alias pointing to another domain name (e.g., www.example.com → example.com). NS record - specifies the authoritative name servers for a domain (e.g., example.com → ns1.example.com). SOA record - Start of Authority, contains administrative info about the zone. D is FALSE - NS records do not map to IPv6 addresses; AAAA records do.

Persistent HTTP with pipelining: (1) TCP handshake: 1 RTT = 50ms. (2) Request base HTML + receive response: 1 RTT + transmission time = 50 + 10 = 60ms. (3) Client pipelines all 5 object requests without waiting: sends all 5 GETs, receives all 5 responses: 1 RTT + 5 × transmission time = 50 + 5×10 = 100ms. Total = 50 (TCP) + 60 (base HTML) + 50 (pipelined RTT) = 160ms. Wait: TCP=50ms, base HTML request/response = 1RTT+10ms = 60ms, pipelined 5 objects = 1RTT + 5×10ms = 100ms. Total = 50+60+50 = 160ms.

TELNET (port 23): provides remote login over TCP but transmits ALL data - including usernames, passwords, and commands - in plaintext. This makes TELNET completely insecure on untrusted networks (passwords can be sniffed). SSH (Secure Shell, port 22): provides encrypted remote login, encrypting all communication using public-key cryptography and symmetric encryption. SSH also supports secure file transfer (SCP, SFTP), port forwarding, and tunneling. TELNET has been largely replaced by SSH due to its complete lack of security.

SMTP (port 25) is a push protocol used to send (push) email: from the email client (MUA) to the sender's mail server (MSA/MTA), and from mail server to mail server during delivery. SMTP operates over TCP for reliable delivery. SMTP does NOT retrieve mail from a server - that is done by retrieval protocols: POP3 (Post Office Protocol 3, port 110) downloads and typically deletes mail from server, or IMAP (Internet Message Access Protocol, port 143) synchronizes mail while keeping it on the server.

An 'A' (Address) record maps a domain name to its corresponding IPv4 address. MX is for mail exchange, CNAME for canonical name alias, and NS for name server.

CDN (Content Delivery Network): A: Replicate content - CDNs place copies of content (videos, images, scripts) on servers (PoPs/edge servers) distributed globally, so users download from a nearby server instead of a distant origin. B: DNS-based redirection - when a user requests content, DNS resolves the CDN domain to the IP of the nearest/best edge server (using Anycast or DNS geolocation). D: Origin offload - edge servers serve cached content directly, dramatically reducing requests to and bandwidth from the origin server. C is FALSE - the origin server still exists and is the source of truth; CDN edge servers cache from it. When a cache miss occurs, the edge server fetches from origin.

Routing packets is a function of the Network Layer (Layer 3), not the Application Layer (Layer 7). The Application Layer provides services like email (SMTP), file transfer (FTP), and directory services (DNS).

HTTP/2 improvements over HTTP/1.1: A: Multiplexing - multiple streams (request-response pairs) are interleaved over a single TCP connection, eliminating head-of-line blocking at the HTTP level. B: Binary framing - HTTP/2 uses a binary protocol (frames) instead of HTTP/1.1's human-readable text, enabling more efficient parsing. D: Server push - the server can proactively send resources (e.g., CSS, JS files) that it knows the client will need, without waiting for the client to request them. C is FALSE - HTTP/2 still uses TCP. HTTP/3 (QUIC) uses UDP to further eliminate TCP's head-of-line blocking.

POST is not idempotent - calling it multiple times may create multiple resources. GET, PUT, and DELETE are idempotent (same result regardless of how many times called).

DNS caching at local resolvers (and browsers, OS) stores recently resolved name-to-IP mappings for a period defined by the TTL (Time To Live) value in the DNS record. Benefits: (1) Reduces DNS resolution latency - cached hits return instantly without querying root/TLD/authoritative servers. (2) Reduces DNS traffic on the internet - popular domains are resolved locally from cache. (3) Reduces load on DNS servers. When the TTL expires, the cached entry is discarded and a fresh resolution is performed. TTL values are set by domain administrators in authoritative DNS records.