Module 2: Networking Basics
2.1 HTTP & HTTPS
Definition: HTTP (Hypertext Transfer Protocol) is the application-layer protocol used to transfer data between clients and servers. HTTPS
is HTTP layered over TLS encryption, protecting data in transit from eavesdropping and tampering.
HTTPS Request
Client Server
Response
Why it matters: Nearly all web and API traffic runs on HTTP/HTTPS. Understanding request/response structure, headers, methods
(GET/POST/PUT/DELETE/PATCH), and status codes is foundational to API design (Module 3).
Azure implementation: Azure App Service and Application Gateway enforce HTTPS by default and can auto-manage TLS certificates via
App Service Managed Certificates or Key Vault-integrated certs.
2.2 TCP vs UDP
TCP UDP
Connection-oriented (handshake required) Connectionless
Guarantees delivery & order No delivery/order guarantee
Slower due to acknowledgements Faster, lower overhead
Used by: HTTP, databases, file transfer Used by: video streaming, VoIP, gaming, DNS
Rule of thumb: choose TCP when correctness matters more than speed; choose UDP when speed/real-time matters more than occasional data
loss.
2.3 DNS (Domain Name System)
Definition: DNS translates human-readable domain names (e.g., [Link]) into IP addresses that computers use to route traffic.
query IP address
DNS
Client Web Server
Resolver
Key record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), TXT (verification/SPF), NS (nameserver).
Azure implementation: Azure DNS for hosting zones; Azure Traffic Manager uses DNS-based routing for geo-load-balancing and failover
across regions.
2.4 SSL/TLS
Definition: TLS (Transport Layer Security, successor to SSL) encrypts data between client and server and authenticates server identity
using certificates, preventing man-in-the-middle attacks.
TLS Handshake (simplified)
1. Client Hello (supported cipher suites)
2. Server Hello + Certificate
3. Key exchange & session key generation
4. Encrypted communication begins
Azure implementation: Azure Key Vault stores and rotates TLS certificates; App Gateway/Front Door terminate TLS at the edge for
centralized certificate management.
2.5 IP Address
Definition: A unique numerical identifier assigned to each device on a network. IPv4 (e.g., [Link]) offers ~4.3 billion addresses; IPv6
(e.g., 2001:db8::1) offers a vastly larger address space to accommodate global device growth.
Public vs Private IP: Private IPs (10.x, 172.16–31.x, 192.168.x) are used within internal networks (e.g., an Azure VNet) and are not
routable on the public internet; a NAT gateway or public IP is required for external access.
2.6 Ports
Definition: A port is a numbered endpoint (0–65535) on a device that identifies a specific process/service, allowing one IP address to run
multiple network services simultaneously.
Port Service
80 HTTP
443 HTTPS
22 SSH
3306 MySQL
1433 SQL Server
6379 Redis
2.7 Reverse Proxy
Definition: A server that sits in front of backend servers and forwards client requests to them, hiding backend topology and adding load
balancing, caching, SSL termination, and security.
Server 1
Client Reverse Proxy Server 2
Server 3
Real-world example: NGINX or Azure Application Gateway sitting in front of multiple backend instances, distributing requests and
terminating TLS.
2.8 Forward Proxy
Definition: Sits in front of clients and forwards their requests to the internet, hiding the client's identity from the destination server.
Commonly used for corporate content filtering, caching, and anonymity.
Key distinction: a reverse proxy protects/manages servers (client doesn't know which server responded); a forward proxy protects/manages clients
(server doesn't know which client sent the request).
2.9 CDN (Content Delivery Network)
Definition: A geographically distributed network of edge servers that cache and serve static (and sometimes dynamic) content close to
the end user, reducing latency and origin server load.
Origin Server
Edge Node (US) Edge Node (EU)
Azure implementation: Azure Front Door and Azure CDN cache static assets (images, JS, CSS) at global points of presence, with rules-
based caching and WAF integration.
2.10 Firewalls
Definition: A security system that monitors and controls incoming/outgoing network traffic based on defined rules, blocking unauthorized
access.
Network firewall: Filters by IP, port, protocol (e.g., Azure Network Security Groups).
Web Application Firewall (WAF): Filters at the HTTP layer, blocking SQL injection, XSS, and OWASP Top 10 attack patterns.
Azure implementation: Azure Firewall for network-level filtering; WAF on Application Gateway/Front Door for application-level protection.
2.11 VPN (Virtual Private Network)
Definition: Creates an encrypted tunnel over a public network, allowing secure remote access to a private network as if directly
connected to it.
Azure implementation: Azure VPN Gateway connects on-premises networks to Azure VNets (Site-to-Site) or lets individual users connect
securely (Point-to-Site).
2.12 NAT (Network Address Translation)
Definition: Translates private IP addresses to a public IP (and back) so multiple devices on a private network can share a single public IP
to access the internet.
Private IP NAT Gateway Public IP
[Link] Internet
Azure implementation: Azure NAT Gateway provides outbound internet connectivity for VNet resources without exposing their private
IPs.
2.13 WebSockets
Definition: A protocol providing a persistent, full-duplex connection between client and server over a single TCP connection, enabling
real-time bidirectional communication without repeated HTTP request/response overhead.
Real-world example: Live chat apps, stock tickers, multiplayer games, and collaborative editing tools use WebSockets to push updates
instantly instead of polling.
Azure implementation: Azure SignalR Service manages WebSocket connections at scale, handling reconnection and fallback transports
(long polling) automatically.
Interview Q&A
Q: Why not just poll the server every second instead of using WebSockets?
A: Polling wastes bandwidth and adds latency between updates; WebSockets keep one connection open, pushing data the instant it's available
with far less overhead at scale.
2.14 HTTP/1.1 vs HTTP/2 vs HTTP/3
Version Key Characteristics
HTTP/1.1 Text-based, one request per connection at a time (head-of-line blocking), requires multiple connections for parallelism
HTTP/2 Binary framing, multiplexing (many requests over one connection), header compression (HPACK), server push
HTTP/3 Runs over QUIC (UDP-based) instead of TCP, eliminating TCP head-of-line blocking, faster connection setup, better performance on lossy
networks
Azure implementation: Azure Front Door and Application Gateway support HTTP/2 out of the box; HTTP/3 support is being progressively
rolled out across Azure's edge network.
Module 2 Common Mistakes
Confusing forward and reverse proxy roles; assuming HTTPS alone means "fully secure" (it only secures transport, not application logic); using UDP
for data that requires guaranteed delivery; not planning NAT/public IP needs for outbound-only workloads.
Module 2 Practice Interview Questions
1. Walk through what happens between typing a URL and the page rendering (DNS → TCP → TLS → HTTP → render).
2. Why does HTTP/2 multiplexing help performance compared to HTTP/1.1?
3. When would you choose a WebSocket over a REST API polling approach?
4. Explain how a CDN reduces latency for a user in Europe accessing a US-hosted origin.