Networking Interview Questions

A LAN (Local Area Network) connects devices within a genuinely small, localized area, like a single office or home. A WAN (Wide Area Network) connects devices across a genuinely much larger geographic area, potentially spanning cities or countries, with the internet itself being the genuinely largest, most well-known example of a WAN.

A MAN (Metropolitan Area Network) covers a genuinely larger area than a LAN, typically a city or a large campus, but a genuinely smaller area than a WAN, sitting conceptually as a genuine middle ground between the two in terms of actual geographic scale.

Bandwidth measures the genuine maximum amount of data that can actually be transmitted over a network connection in a given amount of time, commonly measured in bits per second, and it's genuinely often confused with actual speed, though they're genuinely related but distinct concepts.

Bandwidth measures the genuine maximum amount of data a connection can actually carry per unit of time. Latency measures the genuine time delay for a single piece of data to actually travel from source to destination. A connection can genuinely have high bandwidth but also high latency, or the reverse.

A protocol is a genuine set of agreed-upon rules governing how devices actually communicate with each other, defining things like the exact format of data being sent and how errors are actually handled, ensuring different devices from genuinely different manufacturers can still actually understand each other correctly.

The OSI (Open Systems Interconnection) model is a genuinely conceptual framework describing how network communication happens, broken into seven distinct layers, each genuinely handling a specific aspect of that communication, from the actual physical transmission of bits up to the genuine application interacting with a user.

Physical, Data Link, Network, Transport, Session, Presentation, and Application, genuinely each building on the layer beneath it, with the Physical layer handling genuinely raw bit transmission and the Application layer handling the genuine actual software a user directly interacts with.

The OSI model has genuinely seven distinct layers, largely theoretical and used for genuinely teaching networking concepts. The TCP/IP model, which is what the actual internet is genuinely built on, condenses this into typically four layers, Network Access, Internet, Transport, and Application, more genuinely closely reflecting real-world protocol implementation.

The Network layer handles genuine logical addressing and routing, determining the actual best path for data to travel from a source device to a genuinely different destination device across potentially many, genuinely different intermediate networks. IP addressing and routing genuinely happen at this layer.

The Transport layer handles genuine end-to-end communication between two devices, including things like ensuring data actually arrives reliably and in the correct order. TCP and UDP are both genuine Transport layer protocols, each handling this genuine responsibility quite differently.

The Data Link layer handles genuine communication between devices on the exact same local network segment, using a MAC address to actually identify each device, and it's genuinely responsible for organizing raw bits from the Physical layer into structured, meaningful frames.

An IP address is a genuinely unique numerical identifier assigned to a device on a network, letting other devices actually locate and communicate with it, serving a genuinely similar role to a postal address for actually routing mail to the correct destination.

IPv4 uses a genuinely 32-bit address format, providing roughly 4.3 billion possible unique addresses, which has genuinely become insufficient given the sheer number of devices actually connected to the internet today. IPv6 uses a genuinely much larger 128-bit address format, providing an astronomically larger number of possible addresses.

A public IP address is genuinely, uniquely routable across the actual internet. A private IP address, from a genuinely reserved range like 192.168.x.x, is used only within a genuinely local, private network and isn't directly reachable from the actual internet without some form of translation.

A subnet mask determines which genuine portion of an IP address represents the actual network itself and which portion represents a specific individual host on that network, letting a device actually determine whether another IP address is genuinely on the same local network or requires routing to reach.

APIPA assigns a device an address in the 169.254.x.x range automatically when it's configured to obtain an address via DHCP but genuinely can't reach a DHCP server at all. Seeing a device with an APIPA address is usually a clear, quick sign that DHCP itself is unreachable, rather than a genuine problem with the device's own network settings.

NAT translates a genuinely private IP address used within a local network into a genuinely public IP address when communicating with the actual internet, and translates the response back. It solves the genuine problem of a limited supply of public IPv4 addresses, letting genuinely many devices on a private network share just one single public address.

127.0.0.1 (or localhost) is the genuine loopback address, always referring back to the exact same local device sending the request. It's genuinely used for testing a network application on the exact same machine it's actually running on, without needing genuine external network communication at all.

TCP (Transmission Control Protocol) is genuinely connection-oriented and reliable, guaranteeing data arrives in order and retransmitting anything genuinely lost. UDP (User Datagram Protocol) is genuinely connectionless and doesn't guarantee delivery or order, but is faster and carries genuinely less overhead, since it skips all that reliability machinery.

An application like video streaming or online gaming genuinely prioritizes speed and low latency over perfect reliability, since a genuinely occasional dropped packet is far less noticeable or disruptive than the delay TCP's own retransmission and ordering guarantees would actually introduce.

The three-way handshake, SYN, SYN-ACK, ACK, establishes a genuine, reliable connection between two devices before actual data transfer begins, ensuring both sides are genuinely ready and able to communicate before either one actually starts sending real application data.

A port number identifies a genuinely specific application or service running on a device, letting multiple genuinely different applications on the exact same device, all sharing one single IP address, each actually receive their own correct, intended traffic.

Port 80 for genuinely unencrypted HTTP web traffic. Port 443 for genuinely encrypted HTTPS traffic. Port 22 for SSH remote access. Port 25 for SMTP email. Each is a genuinely standard, widely recognized convention, though a service can technically genuinely run on a different port if actually configured to do so.

TCP genuinely numbers every piece of data sent, letting the receiving end actually reassemble it in the exact correct original order, and genuinely requests retransmission of anything that arrives damaged or genuinely doesn't arrive at all, guaranteeing the receiving application ultimately gets a genuinely complete, correctly ordered stream of data.

DNS (Domain Name System) translates a genuinely human-readable domain name, like example.com, into the actual numerical IP address a computer genuinely needs to actually locate and connect to that specific server, solving the genuine problem of humans needing to remember a genuinely hard-to-recall numeric address for every single website.

A device asks a DNS resolver to actually look up a domain name, which checks a genuine series of DNS servers, root, top-level domain, and authoritative, each one genuinely narrowing down the search until the actual correct IP address for that specific domain is genuinely found and returned.

HTTP (HyperText Transfer Protocol) is the genuine protocol web browsers and servers use to actually communicate, defining how a client requests a resource, like a web page, and how a server actually responds with that requested content.

HTTPS is genuinely HTTP encrypted using TLS/SSL, protecting the actual data exchanged between a browser and a server from being genuinely read or tampered with by anyone intercepting the actual traffic in between. Plain HTTP sends data genuinely unencrypted, visible to anyone who can genuinely observe the network traffic.

A DNS record maps a genuine domain name to specific information. An A record maps it to an actual IPv4 address. A CNAME record maps it to genuinely another domain name instead. An MX record specifies which genuine mail server actually handles email for that domain.

DNS caching stores a genuine, previously looked-up domain-to-IP mapping locally, on a device or an intermediate resolver, for a defined period, letting a genuinely repeated request for that same domain skip the full DNS lookup process entirely, meaningfully speeding up subsequent connections to a genuinely already-visited website.

A hub genuinely broadcasts incoming data to every single connected device, regardless of the genuine intended recipient. A switch genuinely, intelligently forwards data only to the specific device it's actually intended for, based on that device's MAC address. A router connects genuinely separate networks together and directs traffic between them based on IP addresses.

A switch learns which genuine device is connected to which specific port and forwards traffic only to that specific destination, rather than a hub's approach of genuinely broadcasting every single piece of data to all connected devices, which wastes genuine bandwidth and creates unnecessary network congestion.

A router connects a genuinely local, private network to a genuinely larger external network, like the internet, typically also performing NAT to let multiple genuine devices on the local network share one single public IP address when actually communicating with the outside world.

A NIC is the genuine hardware component in a device, like a computer, that actually enables it to physically connect to a network, whether through a wired Ethernet cable or wirelessly, and it's genuinely assigned a unique MAC address at the hardware level.

An access point extends a wired network's own connectivity wirelessly, letting a Wi-Fi device join a network that access point is itself connected to. A wireless router genuinely combines that access point functionality with routing between the local network and an external network, like the internet, all in one single device.

A MAC address is a genuinely unique, hardware-assigned identifier for a network interface, remaining genuinely fixed for the life of that specific hardware. An IP address is genuinely assigned logically and can genuinely change depending on which network a device is actually currently connected to.

For a /24 network, 8 bits genuinely remain for hosts, giving 2^8 = 256 total addresses, minus 2 (one genuinely reserved for the network address itself, one for the broadcast address), leaving 254 genuinely usable host addresses within that specific subnet.

VLSM lets you genuinely subdivide a network into subnets of different, genuinely varying sizes, rather than forcing every subnet to be the exact same size. It solves the genuine problem of wasting IP address space by allocating a genuinely large, fixed-size subnet to a genuinely small department that only actually needs a handful of addresses.

Subnetting genuinely reduces broadcast traffic, since a broadcast only genuinely reaches devices within the exact same subnet, and it improves genuine security and organization, letting different departments or genuine functions be logically isolated from each other on their own separate, dedicated subnets.

The broadcast address is the genuinely last address in a subnet's range, reserved specifically for sending a message to every single device on that particular subnet simultaneously, rather than to one genuinely specific individual host.

Static routing genuinely requires a network administrator to manually configure every single route by hand, which works fine for a genuinely small, simple, and stable network. Dynamic routing uses a genuine routing protocol to automatically discover and adjust routes as the actual network's own topology genuinely changes over time.

A routing table stores the genuine paths a router knows about for actually reaching different destination networks, including the destination network's address, the genuine next hop to actually forward traffic to, and a metric indicating how genuinely preferred that particular route actually is.

An interior gateway protocol, like OSPF, genuinely routes traffic within a single organization's own network. An exterior gateway protocol, like BGP, genuinely routes traffic between entirely separate, independent networks, like different internet service providers, which is exactly the kind of routing the actual internet itself genuinely relies on.

A default gateway is the genuine router a device sends traffic to whenever the actual destination isn't on its own local network, acting as the genuine exit point toward every other network the device doesn't have a more specific, genuinely known route to reach directly.

A metric is a genuine numeric value representing a route's relative cost, based on factors like hop count, bandwidth, or genuine delay, depending on the specific routing protocol actually in use. A router genuinely prefers the route with the lowest overall metric when multiple genuinely possible paths to the exact same destination actually exist.

A VLAN logically genuinely segments a single physical network into multiple, separate logical networks, letting devices be genuinely grouped together based on function rather than their genuine physical location, without requiring genuinely separate physical switches or cabling for each individual group.

VLANs provide genuine logical separation and improved security and traffic management, similar in effect to physically separate networks, but without the genuine cost and inflexibility of actually running genuinely separate physical infrastructure for every single department or function.

A trunk port carries traffic for genuinely multiple different VLANs across a single genuine physical link between two switches, tagging each frame with its actual VLAN identifier so the receiving switch knows exactly which specific VLAN that traffic genuinely belongs to.

STP prevents a genuine network loop from forming when redundant physical connections exist between switches, which would otherwise cause traffic to genuinely circulate endlessly and overwhelm the network, by logically genuinely disabling a redundant link unless it's actually needed as a backup path.

ARP resolves a genuine IP address into its corresponding MAC address on a local network, letting a device actually know which specific physical hardware address to actually send a frame to when it only genuinely knows the destination's IP address.

A firewall monitors and controls genuine incoming and outgoing network traffic based on a set of defined security rules, acting as a genuine barrier between a trusted internal network and a genuinely untrusted external network, like the internet.

A stateless firewall genuinely evaluates each individual packet in isolation, based purely on fixed rules. A stateful firewall genuinely tracks the actual state of an active connection, automatically allowing a genuine response to a previously allowed outgoing request, without needing a genuinely separate, explicit rule for that specific return traffic.

Port forwarding configures a router to genuinely direct incoming traffic on a specific port to a genuinely specific device on the internal, private network. It solves the genuine problem of needing an internal server, behind NAT, to actually be reachable from the outside internet on a genuinely specific service port.

A DMZ is a genuinely separate network segment sitting between a trusted internal network and a genuinely untrusted external network, hosting a genuinely public-facing service, like a web server, in a way that limits the actual damage if that specific service is ever genuinely compromised, since it's isolated from the truly sensitive internal network.

FTP (File Transfer Protocol) is used to actually transfer files between a client and a server over a network, though it's genuinely largely been superseded by more secure alternatives, like SFTP, for anything involving genuinely sensitive data, since plain FTP transmits data unencrypted.

SMTP (Simple Mail Transfer Protocol) is the genuine protocol used to actually send an email from a client to a mail server, and between mail servers themselves, though a genuinely different protocol, like IMAP or POP3, is typically used for an actual client to retrieve and read received email.

POP3 genuinely downloads email to a client and typically removes it from the server afterward, syncing genuinely poorly across multiple devices. IMAP genuinely keeps email synchronized on the server, letting multiple devices all see the exact same, genuinely consistent mailbox state.

DHCP (Dynamic Host Configuration Protocol) automatically assigns a genuine IP address, along with other network configuration details, to a device joining a network, solving the genuine problem of needing to manually configure every single device's own network settings by hand.

A link-state protocol genuinely shares the complete network topology with every router, letting each one independently calculate the genuinely best path using full information. A distance-vector protocol genuinely only shares distance information with its immediate neighbors, which converges more genuinely slowly and can occasionally produce a genuinely suboptimal routing decision.

BGP (Border Gateway Protocol) is the genuine protocol that routes traffic between entirely separate, independent networks (autonomous systems) across the internet, making genuine routing decisions based on policy and path attributes rather than purely a simple, fixed metric, which is exactly why it's genuinely essential to how the internet's own overall traffic actually flows.

An autonomous system is a genuinely large network or group of networks under a single administrative control, like an internet service provider, identified by a genuinely unique AS number, and BGP genuinely routes traffic between these separate autonomous systems rather than between individual devices directly.

Route summarization combines genuinely several smaller, contiguous network routes into one single, larger summarized route advertisement. It solves the genuine problem of a routing table growing excessively large, reducing the genuine memory and processing overhead a router needs to actually maintain and calculate routes across a genuinely large network.

Route redistribution shares genuine routing information learned through one routing protocol with a genuinely different routing protocol running elsewhere in the network. It's genuinely needed when a network uses multiple different routing protocols in different genuine segments and needs those segments to actually be aware of each other's routes.

A VPN (Virtual Private Network) creates a genuinely encrypted tunnel between a device and a remote network, letting traffic travel securely over an genuinely untrusted network, like the public internet, as if the device were genuinely, directly connected to that private network locally.

A site-to-site VPN genuinely connects two entire networks together, like two office locations, letting devices on either side communicate securely as one genuinely combined network. A remote access VPN genuinely connects a single individual device, like an employee's laptop, securely into a genuinely specific remote network.

An IDS genuinely monitors network traffic and alerts on suspicious activity, without itself actually blocking anything. An IPS genuinely does the same monitoring but can also actually block or prevent a detected malicious activity in real time, rather than genuinely only alerting a person to investigate it afterward.

A man-in-the-middle attack happens when an attacker genuinely intercepts communication between two parties, potentially reading or altering it without either party genuinely noticing. TLS encryption genuinely prevents an intercepted message from actually being read or meaningfully altered, since the attacker genuinely lacks the cryptographic keys needed to actually decrypt or convincingly forge that traffic.

A DDoS (Distributed Denial of Service) attack genuinely floods a target with overwhelming traffic from many genuinely different sources simultaneously, aiming to actually exhaust its resources and make it unavailable to legitimate users. Mitigation strategies include traffic filtering, rate limiting, and using a genuinely specialized DDoS protection service that can absorb and filter that malicious traffic before it actually reaches the target.

A DoS (Denial of Service) attack originates from a single source overwhelming a target with traffic. A DDoS attack is genuinely distributed, coming from many separate, often compromised sources simultaneously, which makes it far harder to actually block, since simply blocking one specific source IP address does nothing to stop traffic from the many other genuinely separate sources also participating in the attack.

The core layer genuinely handles high-speed backbone traffic between major network segments. The distribution layer genuinely handles routing, filtering, and policy enforcement between the core and access layers. The access layer genuinely connects end devices, like computers and phones, directly to the network.

Deploy redundant hardware, dual routers, dual switches, and redundant physical links between genuinely critical points, combined with a protocol like STP or a genuinely modern equivalent that can automatically detect a failure and reroute traffic through an available backup path without requiring genuinely manual human intervention.

Convergence time is how long it genuinely takes for every router in a network to actually update its own routing tables and agree on the current, genuinely correct topology after a change, like a link failure. A genuinely faster convergence time means less time spent with actually incorrect or missing routes during that transition.

Connect each office location with a genuine site-to-site VPN or a dedicated WAN link, design each individual office's own internal network with genuinely appropriate segmentation through VLANs, and centralize genuinely shared resources and security policy enforcement rather than managing each office as a genuinely completely independent, isolated network.

QoS lets a network genuinely prioritize certain kinds of traffic, like real-time voice or video, over less time-sensitive traffic, like a file download, ensuring genuinely latency-sensitive applications actually get the bandwidth and priority they genuinely need even when the network is under real, significant load.

I'd analyze actual current traffic patterns and genuine growth trends, identify which specific link or device is genuinely likely to become the actual bottleneck first, core bandwidth, a switch's own port capacity, and upgrade that specific constraint proactively before it actually starts visibly degrading performance for real users.

A VPC is a genuinely logically isolated section of a cloud provider's network, where you define your own genuine IP address range, subnets, and routing, conceptually similar to a traditional on-premises network, but implemented entirely through the cloud provider's own genuine software-defined infrastructure rather than genuinely physical hardware you manage yourself.

The underlying subnetting math is genuinely identical, CIDR notation and address ranges work the exact same way. The genuine difference is that a cloud subnet is typically genuinely tied to a specific Availability Zone, and creating or resizing one is a genuinely quick, software-driven configuration change rather than a genuinely physical, hardware-dependent reconfiguration.

A load balancer distributes genuinely incoming network traffic across multiple backend servers, improving both availability and the ability to actually scale, while also genuinely providing a single, stable entry point that hides the actual, potentially changing set of backend instances from the client entirely.

VPC peering connects two genuinely separate VPCs, letting resources in each communicate directly using genuinely private IP addresses, as if they were part of the exact same network, solving the genuine problem of two separate teams or accounts needing their own resources to actually communicate directly and securely.

A cloud provider typically genuinely provides its own internal DNS service automatically, resolving internal resource names without needing a genuinely separately managed, on-premises DNS server, and it's typically genuinely, tightly integrated with the cloud's own networking and service discovery mechanisms.

Security groups act as a genuinely instance-level virtual firewall, and network ACLs act at a genuinely broader subnet level, together providing layered network security genuinely similar in spirit to a traditional firewall and VLAN segmentation, but implemented entirely through the cloud provider's own genuinely software-defined configuration.

I'd run it incrementally, establishing genuine connectivity, like a VPN or a dedicated link, between the old and new environments during a transition period, migrating one genuinely bounded workload at a time, and validating actual connectivity and performance thoroughly before fully cutting over any single specific piece.

I check whether it genuinely accounts for redundancy and eliminates a genuinely obvious single point of failure, whether the actual IP addressing and subnetting scheme leaves genuinely reasonable room to grow, and whether it's genuinely consistent with security best practices, rather than only optimizing for today's genuinely immediate, narrow requirement.

I'd document the handful of conventions that actually matter most, with the genuine reasoning behind each one, and where genuinely possible, encode them directly into infrastructure-as-code templates so a genuinely new network segment is created consistently by default, rather than relying purely on someone remembering to follow a written guideline.

I'd weigh the actual, genuine cost of past network incidents that better visibility would have caught earlier, or resolved faster, against the real cost of the platform itself. The investment is worth it once genuinely recurring, real network issues are actually costing more in lost time and reliability than the platform itself would cost.

I'd check for a genuinely shared underlying cause first, a specific switch or router, a genuinely failing physical link, or a routing configuration issue, rather than assuming each individual affected service is genuinely, independently having its own separate, unrelated problem at the exact same coincidental moment.

Track link utilization, latency, packet loss, and device health across genuinely critical infrastructure, alerting on meaningful deviation from an established, normal baseline rather than only on an outright, hard failure. A slowly increasing latency or packet loss trend is often a genuine early warning sign well before it actually causes a full, hard outage.

Treat the addressing scheme and any shared network policy as a genuine contract with every dependent team. A genuinely significant change, like re-addressing an existing subnet, needs a documented migration plan and direct, proactive communication well before actual implementation, rather than a change that silently breaks another team's own configuration.

I'd check the physical layer first, cabling, a specific interface's own status, since a genuinely large fraction of real network outages trace back to a genuinely simple physical issue, before moving on to investigating a genuinely more complex routing or configuration problem.

I'd analyze actual current utilization trends and genuine growth projections, identify which specific link or device is genuinely most likely to become the actual bottleneck first, and upgrade that specific constraint proactively, rather than waiting for real, visible performance degradation to actually surface the problem.

This is a judgment question interviewers use to see how you reason under genuine uncertainty, not to test a specific textbook fact. A strong answer names the actual constraint that forced the decision, the realistic options that were genuinely on the table, why you picked one knowing it wasn't guaranteed to be right, and what you'd do differently with what you know now.

I'd walk through an actual, real design decision together, tracing exactly what would genuinely happen to that specific configuration if the network grew significantly larger, rather than treating architecture-level thinking as an entirely genuinely separate skill someone else always simply handles for them.

I wouldn't lead with automation as an abstract best practice. I'd point to a specific, real, already-experienced incident caused by a manual configuration mistake or genuine inconsistency, and show concretely how automated, version-controlled configuration would have genuinely prevented that exact same specific problem.

I'd try to find the actual, genuine middle ground rather than treating it as security against operational convenience. Often there's a way to get most of the genuine security benefit with meaningfully less operational friction, and bringing concrete alternatives rather than a single, rigid, non-negotiable position tends to resolve this kind of disagreement faster.

I'd translate the investment into terms leadership already tracks: the cost of a specific past outage traced back to the current infrastructure, and what continued growth in traffic or connected devices would do to that same problem if left unaddressed. Framed as risk reduction with a concrete, already-incurred cost behind it, it competes far better for prioritization than framed as a technical upgrade for its own sake.