Network Engineer Interview Questions & Answers (with Model Answers)

Model Answer

I work the OSI model from the bottom up, confirming physical links and interface errors before moving to layer 2 and 3. I gather data from monitoring, syslogs, and interface counters to find correlation in time, then form a hypothesis and test one change at a time. I document each step so I can roll back cleanly and so the team learns from it. Intermittent faults usually point to flapping links, duplex mismatches, or marginal optics, so I look there early.

Model Answer

I write a detailed change plan with the exact commands, a back-out procedure, and a validation checklist, then schedule it in a maintenance window. I take pre-change captures of routing tables and configs so I can compare afterward. I stage changes on a lab or single device first when possible and have a rollback trigger if validation fails. Clear communication to stakeholders before and after keeps surprises to a minimum.

Model Answer

A data center lost reachability to a key segment during peak hours. I quickly isolated it to a routing loop after a misapplied OSPF cost change, confirmed by traceroute and topology review. I reverted the change, restored convergence, then ran a blameless review that led to a peer-review requirement for routing changes. Downtime was contained and the safeguard prevented a repeat.

Model Answer

I segment the network with VLANs and firewalls, apply least-privilege ACLs, and harden device management with SSH, role-based access, and centralized AAA. I keep firmware patched, disable unused services and ports, and monitor for anomalies. I treat the management plane as a high-value target and isolate it. Security is layered, so I assume any single control can fail.

Model Answer

I keep an accurate topology diagram, an IP address management system, and version-controlled configuration backups. I deploy monitoring for interface health, latency, and bandwidth with alerting on thresholds, plus NetFlow for traffic visibility. Good documentation turns a 2 a.m. outage into a quick fix instead of an investigation. I review and update records after every significant change.

TCP is connection-oriented and reliable, using handshakes, sequencing, and retransmission, which suits web, email, and file transfer. UDP is connectionless and lightweight with no delivery guarantee, which suits latency-sensitive traffic like VoIP, video streaming, and DNS queries. The choice trades reliability against speed and overhead.

OSPF is an interior gateway protocol that uses link-state and Dijkstra's algorithm to find shortest paths within an autonomous system and converges quickly. BGP is the path-vector exterior gateway protocol that routes between autonomous systems on the internet and selects paths using policy attributes like AS-path and local preference rather than pure metrics. OSPF optimizes for speed inside your network; BGP optimizes for policy and scale between networks.

Borrowing two bits gives a /26 mask, 255.255.255.192, yielding four subnets of 64 addresses each with 62 usable hosts. The networks are 192.168.10.0, .64, .128, and .192. Each has its own network and broadcast address at the start and end of the block.

A VLAN logically segments a switch into separate broadcast domains, improving security and reducing broadcast traffic without needing separate hardware. Trunking with 802.1Q carries multiple VLANs over a single link between switches by tagging frames, so you do not need a physical link per VLAN. Inter-VLAN routing then connects them through a layer-3 device.

A collision domain is the set of devices that can collide on a shared medium; switches break collision domains per port so modern switched networks rarely collide. A broadcast domain is the set of devices that receive a broadcast frame, and it is bounded by a router or separated by VLANs. Routers stop broadcasts while switches forward them within a VLAN.

Situation: a core switch failure coincided with a scheduled migration window. Task: I had to restore service and manage the migration team's expectations. Action: I declared the outage the priority, paused the migration, failed traffic over to the redundant switch, and communicated a revised timeline. Result: service was restored within minutes thanks to redundancy, and the migration ran cleanly later that week.

Situation: users reported slow file transfers between two sites. Task: I had to find and fix the bottleneck. Action: I analyzed interface counters and found a duplex mismatch and an undersized WAN link, so I corrected the duplex setting and implemented QoS to protect business traffic. Result: throughput improved markedly and complaints stopped, and I added monitoring to catch mismatches automatically.

Situation: a planned ISP migration would cause a brief outage and managers were anxious. Task: I needed to set expectations without jargon. Action: I explained the change as switching lanes on a highway with a short, planned pause, gave a clear window, and described the safety net of the backup link. Result: stakeholders approved confidently and the migration completed within the promised window.

Situation: during an audit I found management interfaces reachable from the user VLAN. Task: I had to close the exposure without disrupting operations. Action: I built a dedicated out-of-band management VLAN, applied ACLs, and enforced SSH with centralized authentication. Result: the attack surface shrank significantly and the change passed the follow-up audit cleanly.