Network Engineer interview questions

The OSI model has Physical, Data Link, Network, Transport, Session, Presentation, and Application layers.

• Physical carries bits as electrical, optical, or radio signals.
• Data Link handles local frames and MAC addressing, while Network handles logical addressing and routing.
• Transport provides end-to-end delivery, and the upper three layers support sessions, data representation, and application services.

The TCP/IP model groups networking into Link, Internet, Transport, and Application layers.

• Link roughly covers OSI Physical and Data Link functions.
• Internet corresponds to the OSI Network layer, and Transport corresponds directly to Transport.
• TCP/IP Application combines the OSI Session, Presentation, and Application layers.

Encapsulation adds protocol information around application data as it moves down the network stack.

• Transport adds a TCP or UDP header to create a segment or datagram.
• IP adds source and destination addresses to form a packet.
• Ethernet adds a frame header and trailer for local delivery, and the receiver removes these layers in reverse order.

A frame is a Data Link unit, a packet is a Network-layer unit, and a TCP segment is a Transport-layer unit.

• Ethernet frames carry source and destination MAC addresses for one local link.
• IP packets carry logical addresses across routed networks.
• TCP segments carry port numbers, sequence information, flags, and application data inside IP packets.

A MAC address identifies a network interface for Data Link delivery on a local network segment.

• Ethernet normally uses 48-bit source and destination MAC addresses.
• Switches learn source MAC addresses and forward frames according to their MAC address tables.
• Routers replace the local frame header at each routed hop, so the MAC addresses usually change while IP endpoints remain.

Unicast targets one receiver, broadcast targets every host in a broadcast domain, and multicast targets an interested group.

• Most client-server traffic is unicast between specific addresses.
• Ethernet and IPv4 broadcasts are confined by routers and are used by protocols such as ARP.
• Multicast uses group addresses and requires receivers and network devices to manage group membership and forwarding.

A switch learns source MAC addresses on incoming ports and uses its table to choose an outgoing port for each destination.

• A known unicast destination is forwarded only through the associated port.
• An unknown unicast is flooded within the VLAN except through the incoming port.
• Learned entries age out so the table can adapt when devices move or disappear.

A collision domain is where simultaneous Ethernet transmissions can conflict, while a broadcast domain is where a Layer 2 broadcast is delivered.

• Each full-duplex switched Ethernet port is effectively its own collision domain.
• All ports in one VLAN normally share one broadcast domain.
• Routers or Layer 3 interfaces separate broadcast domains, while hubs do not separate collision domains.

STP prevents Layer 2 loops by placing redundant switch paths into a loop-free forwarding topology.

• Ethernet frames have no hop limit, so a physical loop can create broadcast storms and unstable MAC tables.
• Switches elect a root bridge and calculate preferred paths toward it.
• Redundant ports can remain blocked and transition to forwarding if the active topology changes.

These topologies describe how network nodes and links are physically or logically arranged.

• A star connects endpoints to a central device and is common in Ethernet LANs.
• A bus shares one backbone, while a ring connects each node to two neighbors in a loop.
• A mesh provides multiple interconnections for resilience but requires more links and ports.

Twisted-pair cable categories specify tested performance characteristics that support particular Ethernet speeds and frequencies over defined distances.

• Cat5e commonly supports 1 Gigabit Ethernet up to 100 meters.
• Cat6 supports higher frequency and can carry 10 Gigabit Ethernet over shorter runs.
• Cat6A is designed for 10 Gigabit Ethernet up to 100 meters with better control of crosstalk.

Fiber is preferred for longer distances, high bandwidth, electrical isolation, and resistance to electromagnetic interference.

• Multimode fiber is common for shorter building and data-center links, while single-mode reaches much farther.
• Copper Ethernet is usually cheaper for short endpoint runs and can deliver Power over Ethernet.
• Fiber type, connector, wavelength, and transceiver must be compatible at both ends.

Speed selects the signaling rate, while duplex determines whether both ends can transmit simultaneously.

• Full duplex allows simultaneous sending and receiving and avoids collisions on a switched link.
• Half duplex shares transmission time and uses collision handling.
• Auto-negotiation should normally be enabled on both ends because a mismatch can produce poor performance and interface errors.

An IPv4 address is a 32-bit logical address whose network and host portions are determined by its prefix length.

• It is written as four decimal octets from 0 to 255.
• The network portion identifies the subnet, while the remaining bits identify an interface within that subnet.
• Routers use destination prefixes to forward packets rather than treating the whole address as one flat identifier.

A subnet mask marks which IPv4 address bits belong to the network prefix and which belong to the host portion.

• Binary 1 bits identify the network portion, followed by 0 bits for hosts.
• 255.255.255.0 is equivalent to a /24 prefix.
• A host uses the mask to decide whether a destination is local or must be sent through a router.

CIDR notation writes an IP prefix as an address followed by the number of network bits, such as 192.0.2.0/24.

• A larger prefix length leaves fewer host bits and creates a smaller subnet.
• CIDR replaced fixed classful boundaries with variable-length prefixes.
• The same notation supports subnetting inside a network and route aggregation between networks.

The network address has all host bits set to 0, while the broadcast address has all host bits set to 1.

• A bitwise AND of the host address and subnet mask produces the network address.
• The broadcast address is the highest address in the subnet.
• In a conventional subnet, usable host addresses lie between those two reserved addresses.

The private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

• Internet routers do not normally route these addresses globally.
• Organizations can reuse them internally without obtaining unique public space.
• Internet access from private hosts commonly uses NAT at the network edge.

Public IP addresses are globally unique and routable on the Internet, while private addresses are intended for internal networks.

• Public address allocation is coordinated through registries and service providers.
• Private ranges can be reused by unrelated organizations and therefore are not globally unique.
• NAT can translate private endpoints to public addresses but does not make the original private address Internet-routable.

A default gateway is the router address a host uses for destinations outside its directly connected subnet.

• The gateway interface must be reachable on the host's local link.
• The host resolves the gateway's local MAC address and sends the frame to it while preserving the remote destination IP.
• If no more specific route exists and the gateway is unavailable, off-subnet communication fails.