A service starts refusing connections under load, but CPU and memory are fine. What limits would you check?
What they are really testing: Knowledge of the limits that bite before resources do. Candidates who only know CPU and memory will be stuck, and these limits cause a large share of real production incidents.
A real interview question
A service starts refusing connections under load, but CPU and memory are fine. What limits would you check?
What most people say
drag me
“I would increase the number of replicas so the load is spread across more instances.”
If the limit is per-process, more replicas can help by accident, but if it is conntrack, a shared NAT gateway or a database pool ceiling, adding replicas increases pressure on the shared limit and makes it worse.
The follow-ups they ask next
How would you spot conntrack exhaustion specifically?
Kernel logs report table full and dropped packets, and the conntrack count metric sits at its maximum. It is invisible from application logs, which is what makes it confusing: the app never sees the connection.
What causes a lot of sockets in TIME_WAIT and does it matter?
The side that closes first holds TIME_WAIT for around 60 seconds. It matters mainly for high-churn clients exhausting ports. Fix with connection reuse and keep-alive rather than by disabling kernel protections.
What the interviewer is listening for
- Names file descriptors first
- Knows ephemeral port and TIME_WAIT behaviour
- Includes invisible infrastructure limits like conntrack
What sinks the answer
- Only scales replicas
- Unaware of the accept backlog
- No knowledge of connection-tracking limits
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Healthy resources but refused connections means [a countable limit]. Check [file descriptors, since every socket is one and the default is often 1024], [listen backlog filling when accept is slower than arrival], [ephemeral port exhaustion with TIME_WAIT on high-churn clients], [application and database pool maximums], and [conntrack or NAT gateway limits, which drop silently and are invisible to the app].”
Keep going with networking
Junior
What does a load balancer do during a deployment, and how does it know an instance is ready?
Mid
Trace what happens between a user typing your URL and your container returning a response.
Senior
Design a CI/CD system for 15 microservices owned by 4 teams deploying several times a day.
Senior
Design an observability stack for a system where nobody can currently answer why a request was slow.
Senior
Leadership asks you to prove the platform investment is working. What do you measure?
Senior
You inherit 200 Jenkins jobs with no documentation and are asked to migrate to a modern CI system. How do you approach it?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free