Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Clients get 'unable to get local issuer certificate' from your server, but browsers work. Likely cause?

   1. AThe certificate expired
   2. BThe server doesn't send the intermediate certificate; browsers often fill the gap from cache, other clients don't
   3. CWrong port
   4. DDNS
   Show answer

   B. Servers must send the full chain (leaf + intermediates). Check with openssl s_client -showcerts.

   From lesson 09 · TLS: handshake & trust

2. Q2. What is SNI used for?

   1. AEncrypting the payload
   2. BThe client names the host it wants during the handshake, so one IP can serve different certificates
   3. CCompressing headers
   4. DChoosing HTTP/2
   Show answer

   B. Without SNI, a shared ingress IP couldn't know which certificate to present.

   From lesson 09 · TLS: handshake & trust

3. Q3. What does ALPN negotiate?

   1. AThe cipher
   2. BThe application protocol over TLS (e.g. h2 vs http/1.1)
   3. CThe certificate
   4. DThe IP version
   Show answer

   B. HTTP/2 and gRPC depend on ALPN. A proxy that doesn't offer h2 silently downgrades clients to HTTP/1.1.

   From lesson 09 · TLS: handshake & trust

4. Q4. What problem does HTTP/2 multiplexing solve?

   1. AEncryption
   2. BMany requests share one connection concurrently, instead of queuing or opening many connections
   3. CDNS latency
   4. DPacket loss
   Show answer

   B. HTTP/1.1 handles one request at a time per connection; browsers opened several connections to compensate. HTTP/2 interleaves streams on one.

   From lesson 10 · HTTP/1.1 → 2 → 3

5. Q5. Why does HTTP/3 run over QUIC on UDP?

   1. AUDP is always faster
   2. BTCP's in-order delivery stalls every stream when one packet is lost; QUIC handles loss per stream and combines transport and TLS handshakes
   3. CTLS doesn't work over TCP
   4. DTo avoid firewalls
   Show answer

   B. HTTP/2 over TCP still suffers transport-level head-of-line blocking. QUIC fixes that and speeds up connection setup.

   From lesson 10 · HTTP/1.1 → 2 → 3

6. Q6. What's a practical consequence of HTTP/2's long-lived connections for load balancing?

   1. ANone
   2. BAn L4 balancer pins all requests of one connection to one backend, so load can be uneven; L7 (per-request) balancing is needed
   3. CRequests are encrypted twice
   4. DIt disables caching
   Show answer

   B. One busy client with one connection can load one pod heavily. Balance per request at L7, or cycle connections.

   From lesson 10 · HTTP/1.1 → 2 → 3

7. Q7. You scale a gRPC service from 2 to 10 pods, but the new pods get almost no traffic. Why?

   1. AThe new pods are broken
   2. BgRPC clients keep long-lived HTTP/2 connections; an L4 Service balances connections, not requests, so existing connections stay on the old pods
   3. CDNS caching only
   4. DHPA misconfiguration
   Show answer

   B. Fix with per-request (L7) balancing: a mesh or gRPC-aware proxy, or client-side balancing with a headless Service, and bounded connection lifetimes.

   From lesson 11 · gRPC & Protobuf

8. Q8. What does a gRPC deadline do?

   1. ASchedules the call later
   2. BSets how long the caller will wait; it propagates to downstream calls, and work is cancelled when it expires
   3. CRetries the call
   4. DEncrypts the call
   Show answer

   B. Deadlines prevent requests from waiting forever and stop wasted work in deep call chains. Always set them.

   From lesson 11 · gRPC & Protobuf

9. Q9. Which gRPC status code usually means 'the server is overloaded or unavailable, retry later'?

   1. AINVALID_ARGUMENT
   2. BUNAVAILABLE
   3. CNOT_FOUND
   4. DPERMISSION_DENIED
   Show answer

   B. UNAVAILABLE is the usual retryable status (with backoff). Argument and permission errors won't succeed on retry.

   From lesson 11 · gRPC & Protobuf

10. Q10. curl to the site hangs after 'Client hello', while small API calls to the same host work. Which layer do you suspect first?

    1. ADNS
    2. BMTU/path: large handshake packets (certificate chains) are being dropped
    3. CRBAC
    4. DThe application code
    Show answer

    B. Handshakes with large certificate chains need full-size packets. Small requests fitting in small packets working is the classic MTU black-hole pattern.

    From lesson 12 · Capstone: one request, every layer

11. Q11. Why walk the layers from the bottom up during an incident?

    1. AIt's the only allowed order
    2. BEach layer depends on the ones below; the first failing layer is usually the root cause, and higher-layer errors are symptoms
    3. CIt's faster to type
    4. DKubernetes requires it
    Show answer

    B. A TLS error can be caused by DNS pointing at the wrong IP. Start low, stop at the first broken layer.

    From lesson 12 · Capstone: one request, every layer