Tools / System Design
1. Difference between horizontal and vertical scaling.
Horizontal Scaling also referred to as "scale-out" is the addition of more machines or setting up a cluster/distributed environment for your software system. This usually requires a load-balancer program which is a middleware component in the standard 3 tier client-server architectural model. Ver...
2. What is a Load Balancer?
Load balancer is responsible to distribute user requests (load) among the various back-end systems/nodes in the cluster. Each of these back-end machines runs a copy of your software and hence capable of servicing requests. Another common responsibility is "health-check" where the load balancer us...
3. Explain few load balancing algorithms that you know.
Round Robin also called as "Next in Loop". Weighted Round Robin , similar to Round Robin, but some servers get a larger share of the overall traffic. Random. In Source IP hash Connections are distributed to backend servers based on the source IP address. If a web node fails and is taken out of se...
4. Explain CAP theorem.
The CAP theorem, also known as Brewer's theorem , states that it is impossible for a distributed data store to simultaneously provide more than two out of the following three guarantees: Consistency: Every read receives the most recent write or an error. Availability: Every request receives a (no...
5. Explain the BASE property of the database.
Basically Available indicates that the system does guarantee availability, in terms of the CAP theorem. Soft state indicates that the state of the system may change over time, even without input. This is because of the eventual consistency model. Eventual consistency indicates that the system wil...
6. What is database sharding?
A database shard is a horizontal partition of data in a database. Each individual partition is referred to as a database shard. Each shard is held on a separate database server instance, to spread the load. Some data within a database remains present in all shards,[notes 1] but some appear only i...
7. Difference between database sharding and partitioning.
Partitioning is a general term used to describe the act of breaking up your logical data elements into multiple entities for the purpose of performance, availability, or maintainability. Sharding is the equivalent of " horizontal partitioning ". " Vertical partitioning " is the act of splitting u...
8. Difference between eventual and strong consistency in Distributed Databases.
Eventual consistency makes sure that data of each node of the database gets consistent eventually. Time taken by the nodes of the database to get consistent may or may not be defined. In Strong consistency, data will get passed to all the replicas as soon as a write request comes to one of the re...
9. How to choose between SQL and No-SQL Database?
SQL database is a better choice for any business that has the pre-defined structure and set schemas. Applications that involve multi-row transactions - like accounting systems, warehousing, payment systems can be benefitted using SQL database. NoSQL database is a good choice for businesses that h...
10. What is TLS?
Transport Layer Security (TLS) is a cryptographic protocol that provide communications security over a computer network. The TLS protocol aims primarily to provide privacy and data integrity between two communicating computer applications that ensure private connection and maintain integrity.
11. Explain Request Throttling.
Throttling is a process that is used to control the usage of APIs by consumers during a given period. You can define throttling at the application level and API level. Throttling limit is considered as cumulative at API level.
12. Difference: hard vs soft real-time system.
Hard real-time expects every hit must meets its deadline. Hard real-time systems very few and used in medical and defense fields. Soft real-time systems, also known as firm real-time system, allow some hits if it miss deadline. That is considered common scenario although too many misses are not t...
13. What is NAT-T (NAT Traversal)?
Nat Traversal also known as UDP encapsulation allows traffic to get to the specified destination when a device does not have a public address. This is usually the case if your ISP is doing NAT, or the external interface of your firewall is connected to a device that has NAT enabled.
14. What does HLS stand for?
HLS stands for HTTP Live Streaming . HLS is a media streaming protocol for delivering visual and audio media to viewers over the internet. Its adaptive bitrate video delivery is a combination of server and client software that detects a client's bandwidth capacity and adjusts the quality of the v...
15. Security measures to follow when you are developing your projects.
Perform security tests in CD/CD: CI/CD processes and tools are great places to include security tools and security uni-test cases. Generally, developers are amenable to fixing flagged vulnerabilities on merges but more resistant to addressing large security coding problems prior to shipping a pro...
16. Explain about EquiFax 2017 security incident.
In July 2017, Equifax suffered a breach, disclosing 150 million customer records. The exploit was due to a known vulnerability in the Apache struts2 library. Failure to patch quickly placed Equifax and its customers at risk. From the operational perspective, patching can destabilize production sy...
17. Different Injection defects.
Cross-site scripting (XSS), SQL injection, Command injection, Insecure redirects, Insecure file upload/download, and Buffer overflow.
18. Different Authentication & access control defects.
Insufficient authentication, Insufficent authorization, Parameter tampering, and Cross-Site request forgery (CSRF).
19. Causes of Data protection defects.
Insecure cryptographic algorithm, Insecure password management, Insecure session management, and information exposure.
20. What is Cross-site scripting?
Cross-site scripting (XSS) occurs when malicious code is included in an HTML response, that alters the way the page is rendered. The malicious data is interpreted as script and executed on the client's browser. There are 2 types of XSS. Reflected: Data from the incoming HTML request is returned i...
21. What is SQL injection?
SQL injection is the highest application security concern because it's well known, easy to perform and operates on the database server. SQL injection occurs when: Malicious data is used to construct SQL statements via string concatenation, thus commingling executable code and data. Executable cod...
22. Explain Command injection.
Command injections attacks exploit application functionality that makes system calls or commands using untrusted data. Attacks become possible when an application passes unsafe user-supplied data such as forms, cookies, and HTTP headers to the system as part of a shell command. This type of secur...
23. What is meant by Insecure redirects?
This type of injection defects occur where untrusted data redirects used to faulty/malicious sites. Redirects allows web application to direct users to different pages within the same application or to an external site. An insecure redirect sends the user to an untrusted or malicious site. To pre...
24. Explain about "insecure upload/download" injection defect.
Uploading/downloading files in an insecure manner is a broad type of risk that covers path manipulation, data caching, file handling, malware and anti-virus, access control, and bandwidth concerns. Path manipulation is a major concern. For this type of injection defect, untrusted data is used to ...
25. What is the "Buffer overflow" attack?
Buffer overflow occurs when an application writes more data into an area of memory, called a buffer than was intended. Buffers are created to contain a finite amount of data. When the data is longer than expected, data will overflow into one or more adjacent memory locations (buffers) replacing t...
26. Differentiate Authentication and Authorization.
Authentication is the act of proving one's identity. Authorization is the act of proving one's access privileges. Think of Authentication as locking into an account, for this to happen smoothly a system has to verify your identity before letting you in. Authorization differs, although you are aut...
27. What is parameter tampering?
Parameter tampering, also known as insecure direct object reference, occurs when attackers manipulate parameters exchanged between client and server to gain access unauthorized access to data. Examples of parameter values frequently manipulate include: cookies. URL parameters. Drop-down list, Rad...
28. What is Cross-site request forgery (CSRF)?
Cross-site request forgery (CSRF) occurs when a malicious website, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site where the user is currently authenticated. These attacks can make use of a target system's normal functions -- su...
29. What is SACM (Service Asset and Configuration management)?
SACM is a primary information technology-business process that is foundational and required to mitigate system vulnerabilities and risk of cyberattacks against any organization. It is a collection of processes that achieve operational control, systematic onboarding, validation, updates, maintenan...
30. What is digital accessibility?
Digital accessibility is about making digital products and services accessible to those with disabilities. A website, application or document is accessible when a person with diverse abilities can use it to perform the task or access the service for which it is intended without reliance on the as...
31. What is WAI-ARIA?
WAI-ARIA, the A ccessible R ich I nternet Applications Suite, defines a way to make Web content and the Web applications more accessible to people with disabilities . It especially helps with dynamic content and advanced user interface controls developed with Ajax, HTML, JavaScript, and related t...
32. What is VUI?
VUI stands for Voice User Interface . It allows the user to interact with a system through voice or speech commands. Some of the platforms include Google Assistant, Amazon Alexa, Hey Cortona, Siri, and Samsung Bixby.
33. What are Alexa skills?
It is nothing but a application for Alexa. Ease of Access. Speed & Efficiency.
34. What is DNS TXT record?
A TXT record is a type of resource record in the Domain Name System(DNS) used to provide the ability to associate arbitrary text with a host or other names, such as human-readable information about a server, network, data center, or other accounting information.
35. What is Resident Set Size (RSS)?
Resident Set Size (RSS) is the amount of RAM your process is consuming.
36. Explain 12-Factor App methodology.
The Twelve(12)-Factor App methodology is a methodology for building software-as-a-service applications. These best practices are designed to enable applications to be built with portability and resilience when deployed to the web. Factor. Description. Codebase There should be exactly one codebase...
37. What is certificate pinning?
Certificate pinning restricts which certificates are considered valid for a particular website, limiting risk. Instead of allowing any trusted certificate to be used, operators "pin" the certificate authority (CA) issuer(s), public keys, or even end-entity certificates of their choice. Clients co...
38. Difference between SSL authentication and Mutual SSL Authentication.
In SSL authentication, the client is presented with a server's certificate, the client computer might try to match the server's CA against the client's list of trusted CAs. If the issuing CA is trusted, the client will verify that the certificate is authentic and has not been tampered with. This ...
39. What is OAUTH?
OAuth (Open Authorization) is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords.
40. What is a Canary release?
A canary release is a software testing technique used to reduce the risk of introducing a new software version into production by gradually rolling out the change to a small subgroup of users, before rolling it out to the entire platform/infrastructure.
41. What is Domain Driven Design?
Domain-Driven Design is a way of looking at software from top-down. When we are developing software our focus shouldn't be primarily on technology, it should be primarily on business or whatever activity we are trying to assist with the software, the domain. Specifically we approach that by tryin...
42. Difference between TLS and MTLS.
Transport Layer Security (TLS) is an encryption protocol in wide use on the Internet. TLS, which was formerly called SSL, authenticates the server in a client-server connection and encrypts communications between client and server so that external parties cannot spy on the communications. Mutual ...
43. What is RSocket?
RSocket is an open-source streaming message protocol with Reactive Extension/Stream semantics initially created by Netflix. The main difference between RSocket and traditional TCP web socket is, RSocket is flexible and adds reactive streams.
44. What is Site reliability engineering (SRE)?
As per Wikipedia, Site reliability engineering is a set of principles and practices that incorporates aspects of software engineering and applies them to infrastructure and operations problems. The main goals are to create scalable and highly reliable software systems.
45. Difference Between Semaphore and Mutex.
The Mutex is a locking mechanism that makes sure only one thread can acquire the Mutex at a time and enter the critical section. This thread only releases the Mutex when it exits the critical section. The Mutex is a locking mechanism that makes sure only one thread can acquire the Mutex at a time...
46. What is Privilege Escalation?
Privilege escalation is a type of network attack used to gain unauthorized access to systems within a security perimeter. Attackers start by finding weak points in an organization's defenses and gaining access to a system. In many cases, the first point of penetration will not grant attackers the...
47. What is SSRF?
SSRF stands for server-side request forgery, are designed to exploit how a server processes external information. The primary purpose of the attack is to gain access to sensitive information/data. This could be performed directly (by forcing it to write data to an attacker-supplied URL) or indire...
48. Best practices for Strong cryptography.
Make sure you don't use algorithms that have known weaknesses such as MD5/SHA1, Data Encryption Standard (DES), and instead, use cryptographically strong APIs provided by your programming languages such as Advanced Encryption Standard (AES) (>=128 bits),and SHA256 (>=256-bits).
49. Define Latency and throughput.
Latency is the time taken in milliseconds for delivering a single message or getting a response. Throughput is the amount of data successfully transmitted through a system in a given amount of time. It is measured in bits per second.
50. What is Insecure Design?
Insecure design encompasses various risks that arise from ignoring design and architectural best practices, starting from the planning phase before actual implementation. A near-perfect implementation cannot prevent defects arising from an insecure design.
51. What is threat modeling?
Threat modeling is a procedure for optimizing the applications, system, or business process security by identifying objectives and vulnerabilities, and then defining countermeasures to prevent or mitigate the effects of threats to the system. There are many different threat modeling methodologies...
52. Explain STRIDE threat modeling.
Microsoft developed the STRIDE methodology in the late 1990s as a way to standardize the identification of threats across their product line. It offers a mnemonic for identifying security threats in six categories: Spoofing : An intruder posing as another user, component, or other system feature ...
53. What is meant by tokenization?
Tokenization refers to a process by which a piece of sensitive data, such as a credit card number, is replaced by a surrogate value known as a token. It is the process of replacing sensitive data with unique identification symbols that retain all the essential information about the data without c...
54. What is the PACELC theorem?
In theoretical computer science, the PACELC theorem is an extension of the CAP theorem. It states that in the case of network partitioning (P) in a distributed computer system, one has to choose between availability (A) and consistency (C) (as per the CAP theorem), but else (E), even when the sys...
55. What is a denial of service attack (DoS)?
A Denial-of-Service (DoS) attack is an attack meant to shut down a machine or network, making it inaccessible to its intended users. DoS attacks accomplish this by flooding the target with traffic or sending it information that triggers a crash. In both instances, the DoS attack deprives legitima...
56. What is a Finite State Machine (FSM)?
A Finite State Machine, or FSM, is a computation model that can be used to simulate sequential logic, or, in other words, to represent and control execution flow. Finite State Machines can be used to model problems in many fields, including mathematics, artificial intelligence, games or linguistics.
57. What is SNAT (Secure network address translation)?
Secure network address translation (SecureNA or SNAT) is a network address translation (NAT) technique that enables private network security by providing a public Internet Protocol (IP) address to remote users/systems.
58. What is Global Traffic Manager (GTM)?
GTM load balancer balances traffic for application servers across Data Centers. Global Traffic Manager is a load balancing solution that operates at the DNS level, directing traffic across multiple geographically dispersed data centers. Its primary goal is to optimize application availability and...
59. What is Local Traffic Manager (LTM)?
Local Traffic Manager focuses on load balancing within a single data center or location. It operates at the application layer, intelligently distributing traffic across multiple servers to ensure efficient resource utilization and optimal performance. The real power of the LTM is it's a Full Prox...
60. Difference: API Gateway, Load Balancer, and Reverse Proxy.
Core Purpose API Gateway Load Balancer Reverse Proxy Main Job Manage multiple API services Distribute traffic Optimize web apps Scope Different services Same service Single web application Auth Advanced Basic Basic Smart Routing Yes ALB - Yes NLB - No Limited Caching API Responses Basic Sticky Se...
61. What is CUDA?
CUDA (Compute Unified Device Architecture) is a parallel computing platform and programming model created by NVIDIA that allows software to use NVIDIA GPUs for general-purpose computing (GPGPU), not just graphics. It significantly speeds up applications in AI, scientific simulation, and data proc...
