The short answer: networking interviews test the same core areas whatever the title: the OSI and TCP/IP models, IP addressing and subnetting, TCP versus UDP, DNS, DHCP and ARP, switching (VLANs, spanning tree), routing (static routes, OSPF, BGP), security basics, and above all how you troubleshoot. Below are 45 questions with short answers you can say out loud, grouped by topic, followed by troubleshooting scenarios and the behavioral questions network engineers get.
What networking interviews cover
Cisco’s CCNA (exam 200-301, currently v1.1) is the most common map of what employers expect at the associate level. It covers six areas: network fundamentals, network access, IP connectivity, IP services, security fundamentals, and automation and programmability. The questions below follow the same order.
What changes with the role is depth:
| Role | What they focus on |
|---|---|
| IT support / help desk | Fundamentals, DNS and DHCP, basic troubleshooting commands |
| Network administrator | VLANs, IP addressing, routing basics, firewalls, monitoring |
| Network engineer | Routing protocols, design choices, troubleshooting under pressure, change management |
| Senior / architect | Design trade-offs, redundancy, BGP, security architecture, automation |
Fundamentals
1. What are the layers of the OSI model?
Seven: Physical, Data Link, Network, Transport, Session, Presentation, Application. In practice, say where common things live: cables and signals at layer 1, MAC addresses and switches at layer 2, IP and routers at layer 3, TCP and UDP at layer 4, and protocols like HTTP and DNS at layer 7.
2. How does the TCP/IP model differ from OSI?
TCP/IP is the model the Internet actually uses. RFC 1122 describes four layers: Link, Internet, Transport and Application. OSI’s top three layers fold into Application, and its bottom two into Link.
3. What’s the difference between a hub, a switch and a router?
A hub repeats every signal to every port (layer 1). A switch learns MAC addresses and forwards frames only to the right port (layer 2). A router forwards packets between different IP networks (layer 3).
4. What’s the difference between TCP and UDP?
TCP is connection-oriented: it sets up a connection, numbers the data, retransmits what’s lost and delivers it in order. UDP just sends datagrams, with no connection or delivery guarantee, which makes it lighter and faster. Web pages, email and SSH use TCP; DNS queries, VoIP, video streaming and online games commonly use UDP.
5. Describe the TCP three-way handshake.
The client sends a SYN, the server answers with a SYN-ACK, and the client replies with an ACK. Both sides have then agreed on starting sequence numbers and the connection is open. Closing normally uses FIN and ACK from each side.
6. What does DNS do, and which record types should I know?
DNS translates names into IP addresses and other data. Know A (IPv4 address), AAAA (IPv6 address), CNAME (alias), MX (mail server), NS (authoritative name servers), PTR (reverse lookup) and TXT (text, often used for email verification such as SPF). DNS uses UDP port 53 for most queries, and TCP port 53 for zone transfers and responses too large for UDP.
7. How does DHCP work?
Four messages, often remembered as DORA: the client broadcasts a Discover, the server sends an Offer, the client sends a Request, and the server confirms with an Acknowledgment. The server uses UDP port 67 and the client UDP port 68. When the server is on another subnet, a relay agent (on Cisco, ip helper-address) forwards the requests.
8. What does ARP do?
ARP finds the MAC address that belongs to an IPv4 address on the local network: the host broadcasts “who has this IP?” and the owner replies with its MAC. IPv6 doesn’t use ARP; it uses Neighbor Discovery instead.
9. What’s the difference between a MAC address and an IP address?
A MAC address is a 48-bit hardware address used within one local network (layer 2). An IP address is a logical address used to route between networks (layer 3). Frames get new source and destination MACs at every router; the IP addresses stay the same end to end (unless NAT changes them).
10. Which port numbers should I know?
| Port | Protocol |
|---|---|
| 20, 21 | FTP |
| 22 | SSH |
| 23 | Telnet |
| 25 | SMTP |
| 53 | DNS |
| 67, 68 | DHCP |
| 80 | HTTP |
| 110 | POP3 |
| 123 | NTP |
| 143 | IMAP |
| 161, 162 | SNMP (162 for traps) |
| 443 | HTTPS |
| 3389 | RDP |
11. What are unicast, broadcast and multicast?
Unicast goes to one host, broadcast to every host on the local network, multicast to a group of hosts that joined it. IPv6 has no broadcast; it uses multicast instead, and adds anycast (the nearest of several hosts sharing an address).
12. What’s the difference between a collision domain and a broadcast domain?
Each switch port is its own collision domain; a hub shares one across all its ports. A broadcast domain is everything that receives a broadcast: by default a whole VLAN. Routers separate broadcast domains.
13. What happens when you type a URL into a browser?
The browser resolves the name through DNS, opens a TCP connection to the server’s IP (port 443 for HTTPS), negotiates TLS, sends an HTTP request and renders the response. Along the way, ARP finds the default gateway’s MAC, and routers forward the packets hop by hop. This question tests whether you can connect the layers, so walk through it in order.
IP addressing and subnetting
14. What are the private IPv4 ranges?
RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. They aren’t routed on the Internet; NAT translates them to public addresses.
15. What is CIDR notation?
The number after the slash is how many bits of the address are the network part. /24 means a 255.255.255.0 mask; /26 means 255.255.255.192.
16. How many usable hosts are in a /26? What are its subnets?
A /26 leaves 6 host bits: 2 to the power 6 is 64 addresses, minus the network and broadcast addresses, so 62 usable hosts. In 192.168.10.0/24 the /26 subnets start at .0, .64, .128 and .192. The first runs from .0 (network) to .63 (broadcast), with hosts .1 to .62. Expect at least one question like this, and practice doing it without a calculator.
17. Why use a /30 or a /31 on a point-to-point link?
A /30 gives exactly two usable addresses. RFC 3021 allows /31 on point-to-point links, which saves the network and broadcast addresses entirely.
18. What are NAT and PAT?
NAT translates private addresses to public ones at the network edge. PAT (port address translation, also called NAT overload) lets many internal hosts share one public address by tracking the source port of each connection. It’s what most home and office routers do.
19. What are the main differences in IPv6?
128-bit addresses written in hexadecimal, no broadcast, no ARP (Neighbor Discovery instead), a simpler fixed header, and hosts can configure their own address with SLAAC. Every IPv6-enabled interface has a link-local address in fe80::/10.
20. A PC has a 169.254.x.x address. What does it mean?
It’s an IPv4 link-local address (169.254.0.0/16), assigned automatically when the PC didn’t get an answer from a DHCP server. Troubleshoot DHCP: the cable or Wi-Fi, the VLAN, the relay agent and whether the server’s pool is exhausted.
21. What is a default gateway?
The router a host sends traffic to when the destination isn’t on its own subnet. A wrong gateway is the classic reason a host can reach its neighbors but not the Internet.
Switching
22. What is a VLAN, and why use one?
A VLAN splits one physical switch into separate layer 2 networks (separate broadcast domains). It’s used to separate traffic by department or function, such as users, voice, servers and guests, for security and to limit broadcasts.
23. What’s the difference between an access port and a trunk port?
An access port carries one VLAN, untagged, usually to an end device. A trunk carries several VLANs between switches (or to a router), with IEEE 802.1Q tags that say which VLAN each frame belongs to. Frames on the native VLAN cross the trunk untagged.
24. How do devices in different VLANs talk to each other?
Through a layer 3 device: a router with a subinterface per VLAN on one trunk (“router on a stick”), or a layer 3 switch with a virtual interface (SVI) per VLAN.
25. What does Spanning Tree Protocol do?
STP prevents layer 2 loops, which would otherwise cause broadcast storms. The switches elect a root bridge (the lowest bridge ID: priority, then MAC address) and block redundant ports, which take over if an active link fails. Rapid STP (originally IEEE 802.1w) converges much faster.
26. How does a switch learn where to send frames?
It reads the source MAC of each incoming frame and records which port it came in on. For a destination it doesn’t know yet, it floods the frame to all ports in that VLAN.
27. What is EtherChannel or link aggregation?
Bundling several physical links into one logical link for more bandwidth and redundancy. LACP, standardized in IEEE 802.1AX (originally 802.3ad), negotiates the bundle.
Routing
28. What’s the difference between static and dynamic routing?
Static routes are configured by hand: simple and predictable, but they don’t adapt to failures. Dynamic protocols (OSPF, EIGRP, BGP) share routes and reconverge automatically when the network changes.
29. How does a router pick a route?
First, longest prefix match: the most specific matching route wins. When the same prefix is learned from different sources, the lowest administrative distance wins. Cisco’s defaults: connected 0, static 1, eBGP 20, internal EIGRP 90, OSPF 110, RIP 120, iBGP 200. Within one protocol, the lowest metric wins.
30. What is a default route?
0.0.0.0/0, the route used when nothing more specific matches, usually pointing toward the Internet.
31. Explain OSPF in a few sentences.
OSPF is a link-state interior gateway protocol. Routers flood information about their links, build the same map of the area, and each runs the shortest path first (Dijkstra) algorithm. Cost is based on bandwidth. Large networks are split into areas, all connected to the backbone, area 0.
32. What’s the difference between distance-vector and link-state protocols?
Distance-vector routers (RIP) share their routing tables with neighbors and trust what they hear. Link-state routers (OSPF, IS-IS) share the state of their links, and each builds a full map of the network. Link-state converges faster and scales better.
33. What is BGP, and when is it used?
BGP is the path-vector protocol that exchanges routes between autonomous systems: it’s what holds the Internet together. It runs over TCP port 179. eBGP runs between different organizations or providers; iBGP within one. Companies use it to connect to several ISPs; cloud and data center networks use it widely inside too.
34. What is a first hop redundancy protocol?
It gives hosts a virtual default gateway shared by two or more routers, so one can take over if the other fails. HSRP is Cisco’s; VRRP is the open standard.
Security
35. What’s the difference between a stateful and a stateless firewall?
A stateless filter checks each packet against rules on its own. A stateful firewall tracks connections, so it can let return traffic in automatically and drop packets that don’t belong to a known connection.
36. What are ACLs, and what’s the implicit deny?
Access control lists permit or deny traffic by rules, read top to bottom until the first match. On Cisco devices, a standard ACL matches only the source address; an extended ACL can match source, destination, protocol and port. Every ACL ends with an invisible “deny everything”, so traffic that matches no rule is dropped.
37. What’s the difference between a site-to-site and a remote-access VPN?
Site-to-site connects whole networks, such as a branch to headquarters, usually with IPsec between two gateways. Remote access connects one user’s device to the network, using IPsec or a TLS-based client.
38. Which layer 2 attacks should a network engineer defend against?
MAC flooding (port security), DHCP spoofing and starvation (DHCP snooping), ARP spoofing (dynamic ARP inspection, which relies on DHCP snooping), and VLAN hopping (disable auto-trunking, don’t use the native VLAN for users).
39. RADIUS or TACACS+?
Both centralize authentication. RADIUS uses UDP (ports 1812 and 1813), encrypts only the password and is common for network access such as Wi-Fi and VPN. TACACS+ uses TCP port 49, encrypts the whole payload and separates authentication, authorization and accounting, which is why it’s preferred for administering network devices.
Troubleshooting scenarios
These are where interviews are won. Interviewers want a method, not a lucky guess: work from the bottom of the stack up, and say what each test rules out.
40. “A user can’t reach a website. How do you troubleshoot?”
- Is it just this user, or everyone? That tells you whether to look at the host or the network.
- Physical link and IP settings:
ipconfigon Windows orip addron Linux. Does the host have a valid address, mask, gateway and DNS server? pingthe default gateway, then an outside IP address.- Test name resolution with
nslookupordig. If the IP works but the name doesn’t, it’s DNS. traceroute(tracerton Windows) to see where packets stop.- Test the port itself, with
curlorTest-NetConnectionon Windows, then check proxies and firewall rules.
41. “Users in one VLAN can’t reach another VLAN.”
Check that the VLAN is allowed on the trunks, that the SVI or subinterface is up with the right IP, that hosts use the right gateway, the routing between them, and any ACLs applied to those interfaces.
42. “The network is slow, intermittently.”
Measure first: where and when? Check interface counters for errors and drops (CRC errors often mean a bad cable, or a duplex mismatch), link utilization, packet loss and latency over time (continuous ping or mtr), and whether QoS is prioritizing the right traffic.
43. “How do you tell if it’s a network problem or an application problem?”
If you can reach the server, resolve its name and open a TCP connection to the application’s port quickly and consistently, the network is probably fine and the application logs are the next stop. A packet capture settles it: it shows whether requests arrive and how long the server takes to respond.
44. “You need to find the IP address and software version of the device on the other end of a link.”
Use CDP (show cdp neighbors detail on Cisco) or LLDP, the vendor-neutral equivalent (show lldp neighbors detail).
45. Which show commands do you use most on Cisco devices?
show ip interface brief (interface status and IPs), show interfaces (errors and counters), show ip route (routing table), show vlan brief, show interfaces trunk, show spanning-tree, show mac address-table and show running-config.
Behavioral questions for network engineers
Expect at least two of these, and answer them with a real story in STAR order (Situation, Task, Action, Result):
- Tell me about an outage you handled. What was the cause and what did you change afterward?
- Describe a change that went wrong. How did you roll back? (Interviewers look for change windows, rollback plans and honest post-mortems.)
- How do you explain a technical problem to someone non-technical?
- How do you prioritize when several tickets are urgent at once?
- How do you keep your skills current?
Our guide to describing a challenging project shows how to structure the outage story in two minutes.
How to answer technical questions well
- Start with the concept, then give an example. “OSPF is a link-state protocol… in my last job we used it across three sites.”
- Think out loud on scenarios. The method matters more than the answer.
- Say when you don’t know, then how you’d find out. Guessing confidently and being wrong is worse.
- Practice the core explanations out loud: subnetting, the TCP handshake, DHCP, STP and “what happens when you type a URL”. They come up in almost every interview.
Frequently asked questions
What are the most common networking interview questions?
How do I prepare for a network engineer interview?
How many usable hosts are in a /24, /26 and /30?
What is the difference between TCP and UDP?
Do I need a CCNA to get a networking job?
How should I answer a troubleshooting question in an interview?
Sources
- Cisco, 200-301 CCNA exam (v1.1, six topic areas). Read on 29 September 2026.
- IETF: RFC 1122 (Internet host layers), RFC 9293 (TCP), RFC 768 (UDP), RFC 826 (ARP), RFC 2131 (DHCP), RFC 1035 (DNS), RFC 1918 (private addresses), RFC 3021 (/31 links), RFC 3927 (IPv4 link-local), RFC 8200 (IPv6), RFC 4861 (Neighbor Discovery), RFC 2328 (OSPFv2), RFC 4271 (BGP-4).
- IANA, Service Name and Transport Protocol Port Number Registry.
