Interview prep · 🕸️ Network Engineer
Network Engineer interview questionsand answers (30, by level).
The questions Indian employers actually ask for this role — fresher, mid-level and senior — with model answers written by engineers who sit on the other side of the table. Use with the role path and the 30-day lab plan.
Fresher / L1
Fundamentals they test on day one
1What is the difference between a hub, a switch and a router?
A hub repeats every frame to all ports (collision domain shared). A switch forwards frames by MAC address (each port its own collision domain). A router forwards packets between networks by IP address and separates broadcast domains.
2Explain the OSI layers with one protocol each.
Physical (Ethernet cabling), Data link (Ethernet/802.1Q, ARP), Network (IP, ICMP), Transport (TCP/UDP), Session (NetBIOS/RPC), Presentation (TLS), Application (HTTP, DNS, SMTP). Interviewers want you to place a problem on a layer quickly.
3What is a subnet mask? What is /26?
It splits an IP into network and host bits. /26 = 255.255.255.192 → 64 addresses per block, 62 usable hosts.
4How does ARP work?
A host broadcasts “who has IP X?”; the owner replies with its MAC; the mapping is cached in the ARP table. Gratuitous ARP announces a change.
5TCP vs UDP — when do you use which?
TCP: reliable, ordered, connection-oriented (HTTP, SSH, DB). UDP: no handshake, lower latency, loss-tolerant (DNS, VoIP, streaming, syslog).
6What is a VLAN and what is a trunk?
A VLAN is a logical layer-2 segment; a trunk (802.1Q) carries multiple VLANs between switches by tagging frames. The native VLAN is untagged.
7What is the default gateway?
The router a host sends traffic to when the destination is outside its own subnet.
8What does ping and traceroute tell you?
Ping tests reachability and RTT via ICMP echo; traceroute shows each hop by increasing TTL, revealing where latency or loss begins.
9Private IP ranges?
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (RFC 1918); 100.64.0.0/10 for CGNAT.
10What is NAT and PAT?
NAT translates private to public addresses; PAT (overload) maps many private hosts to one public IP using different source ports — what home/office routers do.
2–5 years / L2
What a working engineer must know
1OSPF vs BGP — when is each used?
OSPF is a link-state IGP inside an organisation (fast convergence, areas). BGP is a path-vector EGP between autonomous systems and for policy-rich designs, including data-center fabrics (eBGP leaf-spine).
2What is STP and why do you still need it?
Spanning Tree blocks redundant layer-2 paths to prevent loops/broadcast storms. RSTP/MSTP converge faster; you still enable it as a safety net even with LACP/MLAG.
3Explain LACP and MLAG.
LACP bundles links into one logical port-channel (802.3ad). MLAG/vPC lets a device bundle links to two different switches, giving redundancy without STP blocking.
4How does a stateful firewall differ from an ACL?
ACLs match packets statelessly; a stateful firewall tracks connections so return traffic is allowed automatically and can inspect application layers (NGFW: app-ID, IPS, TLS inspection).
5What happens when you type a URL and press Enter (network view)?
DNS resolution (cache → resolver → recursion), TCP handshake, TLS handshake (SNI, cert validation), HTTP request, response; CDN/anycast may change which server answers.
6What is MTU and what breaks when it is wrong?
Maximum frame payload (1500 default). Mismatches cause fragmentation or black-holed packets when DF is set and PMTUD is blocked — classic VPN/tunnel issue (use 1400–1450 inside tunnels).
7Site-to-site IPsec: phases and common failures.
IKE phase 1 (authentication, DH, SA), phase 2 (IPsec SAs per proxy IDs). Failures: mismatched proposals, lifetime, NAT-T, overlapping subnets, wrong proxy IDs.
8How do you troubleshoot slow network for one application?
Isolate layer: ping/traceroute for path, iperf for throughput, capture with tcpdump/Wireshark for retransmissions/window, check duplex/errors on interfaces, QoS, DNS latency, MTU.
9What is QoS and how would you prioritise VoIP?
Classify (DSCP EF 46 for voice), mark at the edge, queue with priority/LLQ on WAN links, police bulk traffic; verify with jitter/loss metrics.
10VRF, VXLAN, EVPN — one line each.
VRF: separate routing tables on one device. VXLAN: layer-2 over layer-3 overlay (24-bit VNI). EVPN: BGP control plane that distributes MAC/IP reachability for VXLAN fabrics.
Senior / L3
Design, judgement and leadership
1Design a two-data-center network with HA for 50 racks.
Leaf-spine per DC (25/100 GbE), eBGP underlay, EVPN-VXLAN overlay, MLAG at leaves for dual-homed servers, dedicated OOB management, redundant edge firewalls in HA, DCI via dark fibre/DWDM or L3 with VXLAN stretched only where needed, BGP to two ISPs with own ASN/prefix, DDoS scrubbing, automation (Ansible/NetBox as source of truth).
2How do you plan a cutover of a core switch with minimal downtime?
Pre-stage config, MOP with rollback, verify spares/licences, drain traffic via STP/BGP costs, maintenance window and change ticket, console access, step checks (CRC, CPU, routes), post-change monitoring, document.
3BGP: route reflectors vs full mesh; communities; prefix filtering?
RRs avoid n² iBGP sessions; communities tag routes for policy; always filter inbound/outbound prefixes (max-prefix, bogons, RPKI) to avoid leaks.
4Zero-trust network: what changes practically?
Identity-based access (ZTNA) instead of flat VPN, micro-segmentation (host firewalls, NSX/eBPF), continuous posture checks, least privilege, logging everything; 802.1X/NAC on campus.
5How do you detect and stop a layer-2 loop in production fast?
Symptoms: CPU spike, MAC flapping, broadcast storm. Check STP topology changes and MAC flaps, shut the suspected port/uplink, enable storm control, BPDU guard on edge ports, root guard.
6Explain SD-WAN benefits and limits for an Indian multi-branch company.
Mixes broadband/4G/MPLS with app-aware steering, central policy, cheaper than MPLS-only; limits: underlay quality, last-mile reliability, vendor lock-in, needs good monitoring.
7Capacity: how do you decide uplink oversubscription?
Measure east-west vs north-south, p95 utilisation, growth; 3:1 at leaf is common for general compute, 1:1 for storage/AI fabrics; plan for 70% headroom thresholds.
8How would you automate configuration across 200 devices safely?
Source of truth (NetBox), templates (Jinja2), Ansible/Nornir with dry-run diffs, pre/post checks, canary groups, Git-based change review, backups before push, rollback plan.
9Describe an incident you led and what changed afterwards.
Structure: impact, timeline, root cause (not blame), fix, and the permanent change (monitoring, runbook, design). Interviewers test ownership and learning.
10IPv6 adoption plan for an enterprise?
Dual-stack from the edge inward, obtain PI space, SLAAC/DHCPv6 policy, firewall parity, DNS AAAA, monitoring, training; Indian mobile networks are IPv6-first so customer-facing services need it now.
How to answer
Four habits that pass interviews
- Say the structure first“I’d check three things: …” — interviewers reward a method more than a lucky answer.
- Numbers and namesMention real tools, versions and figures from your lab; vague answers lose.
- Admit gaps cleanly“I haven’t run X in production; here is how I’d approach it” beats bluffing.
- Ask about the environmentScale, on-call, tooling — it shows you think like an operator.
Ready to be hired, or ready to hire?
Engineers: join our vetted network for projects and placements. Companies: we shortlist network engineers within 48 hours.