Top 50 Networking Interview Questions and Answers [2025]

Networking interview questions test your knowledge of OSI model, TCP/IP, subnetting, routing protocols (BGP, OSPF), switching (VLANs, STP), security (firewalls, VPNs), and troubleshooting. This guide covers the 50 most commonly asked questions across beginner, intermediate, and advanced levels.

Basic Networking Interview Questions (Beginner)

Q1. What is the OSI model and what are its 7 layers?

The OSI (Open Systems Interconnection) model is a conceptual framework that divides network communication into 7 layers:

1. Physical — cables, signals, bits
2. Data Link — MAC addresses, Ethernet frames, switches
3. Network — IP addresses, routing, routers
4. Transport — TCP/UDP, ports, end-to-end delivery
5. Session — session establishment and management
6. Presentation — encryption, compression, data formatting
7. Application — HTTP, DNS, FTP, end-user services

Memory aid: “Please Do Not Throw Sausage Pizza Away”

Q2. What is the difference between TCP and UDP?

Q3. What is a subnet mask and what does /24 mean?

A subnet mask defines which portion of an IP address is the network and which is the host. /24 means the first 24 bits are the network portion, leaving 8 bits for hosts. This equals 256 addresses — 254 usable hosts (2^8 minus network and broadcast addresses).

Example: 192.168.1.0/24 → subnet mask 255.255.255.0 → hosts: 192.168.1.1 to 192.168.1.254

Q4. What is the difference between a hub, switch, and router?

Full explanation here. In brief: Hub = Layer 1, broadcasts to all ports, obsolete. Switch = Layer 2, forwards using MAC addresses. Router = Layer 3, routes between different IP networks using routing tables.

Q5. What is NAT and why is it used?

NAT (Network Address Translation) allows devices with private IP addresses to communicate with the internet by translating their private IPs to a single public IP. This conserves public IPv4 addresses and provides a basic level of security by hiding internal IP addressing from the internet.

Q6. What is DNS and how does it work?

DNS translates domain names to IP addresses. Resolution process: Your browser checks its cache → OS cache → asks your configured DNS resolver (usually ISP or 8.8.8.8) → resolver queries Root nameservers → TLD server → Authoritative nameserver → returns the IP address.

Q7. What is DHCP?

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to devices joining a network. The DHCP DORA process: Discover → Offer → Request → Acknowledge. DHCP uses UDP ports 67 (server) and 68 (client).

Q8. What is the difference between IPv4 and IPv6?

Q9. What is a default gateway?

The default gateway is the router’s IP address on the local subnet. When a device wants to send traffic to a destination outside its local network, it sends the packet to the default gateway. The router then forwards it toward the destination.

Q10. What is ARP?

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses within a local network. When Device A wants to send a packet to 192.168.1.5 but doesn’t know its MAC address, it broadcasts an ARP request: “Who has 192.168.1.5?” The device with that IP responds with its MAC address. ARP is a Layer 2/3 boundary protocol.

Intermediate Networking Interview Questions

Q11. What is a VLAN and why is it used?

A VLAN (Virtual LAN) logically segments a physical switch into multiple isolated broadcast domains. Uses: security (isolate sensitive systems), performance (reduce broadcast traffic), flexibility (group users by department regardless of physical location). Devices in different VLANs require a Layer 3 device to communicate.

Q12. What is STP and why is it needed?

STP (Spanning Tree Protocol) prevents Layer 2 loops in networks with redundant switch paths. Without STP, broadcast storms would flood the network. STP elects a Root Bridge, then blocks redundant ports to create a loop-free topology. RSTP (802.1w) replaced STP with faster convergence (1–6 seconds vs 30–50 seconds).

Q13. What is the difference between access ports and trunk ports?

Access ports carry traffic for one VLAN and connect end devices. Trunk ports carry traffic for multiple VLANs using 802.1Q tagging and connect switches to other switches, routers, and WAPs.

Q14. What is OSPF and how does it work?

OSPF is a link-state IGP that uses Dijkstra’s SPF algorithm. Each router builds a complete map of the network (LSDB) and calculates the shortest path to every destination. Uses IP protocol 89, administrative distance 110, and requires Area 0 as the backbone in multi-area deployments. OSPF elects a DR/BDR on multi-access networks to reduce LSA flooding.

Q15. What is BGP?

BGP (Border Gateway Protocol) is the routing protocol of the internet — an EGP that routes between Autonomous Systems. It uses TCP port 179 and makes routing decisions based on path attributes (AS-Path, Local Preference, MED, Weight) rather than just shortest path metrics. eBGP runs between different ASes; iBGP runs within the same AS.

Q16. What is the difference between OSPF and EIGRP?

OSPF: link-state, open standard, uses Dijkstra/SPF, AD 110, uses areas for scalability, metric = cost. EIGRP: advanced distance-vector (Cisco), uses DUAL algorithm, AD 90, composite metric (bandwidth + delay), supports unequal-cost load balancing, faster convergence due to Feasible Successors.

Q17. What is Administrative Distance?

Administrative Distance (AD) determines which routing protocol’s route is preferred when multiple protocols know about the same destination. Lower AD = more trusted. Connected=0, Static=1, EIGRP=90, OSPF=110, RIP=120, iBGP=200.

Q18. What is a VPN and how does it work?

A VPN creates an encrypted tunnel over a public network. IPSec VPNs use IKE for key exchange and either AH (authentication only) or ESP (encryption + authentication) for the tunnel. Site-to-site VPNs connect offices; remote access VPNs connect individual users.

Q19. What is the 3-way TCP handshake?

TCP connection establishment: (1) Client sends SYN (synchronize) → (2) Server responds SYN-ACK (synchronize-acknowledge) → (3) Client sends ACK (acknowledge). Connection is now established. Closing: FIN → FIN-ACK → FIN → ACK (4-way teardown).

Q20. What is QoS?

QoS (Quality of Service) prioritizes certain types of network traffic to ensure acceptable performance for critical applications. Voice (VoIP) and video require low latency and jitter — QoS ensures these packets are forwarded before bulk data transfers. Implemented using DSCP markings, traffic shaping, and queuing mechanisms.

Advanced Networking Interview Questions

Q21. What is BGP Local Preference and when do you use it?

BGP Local Preference is an iBGP attribute (default 100) used to prefer one exit path over another for outbound traffic from your AS. Higher value = more preferred. Used to steer all outbound traffic through a primary ISP while keeping a secondary ISP as backup.

Q22. What causes BGP session flapping?

BGP flapping is when a BGP session repeatedly establishes and drops. Common causes: unstable physical link, CPU overload, hold timer mismatch (default 180s), MTU mismatch on the path, authentication misconfiguration. Diagnose with: show bgp neighbor, show bgp flap-statistics. BGP route dampening suppresses unstable routes.

Q23. Explain OSPF LSA types.

LSA Type 1 (Router LSA): every OSPF router generates, describes its links — flooded within an area. LSA Type 2 (Network LSA): generated by DR on multi-access networks. LSA Type 3 (Summary LSA): generated by ABR, advertises networks between areas. LSA Type 4: ASBR location. LSA Type 5: external routes injected by ASBR — flooded everywhere. LSA Type 7: external routes in NSSA — converted to Type 5 at the ABR.

Q24. What is ECMP and what are its implications?

ECMP (Equal-Cost Multi-Path) allows traffic to be distributed across multiple equal-cost paths simultaneously. It increases bandwidth and provides redundancy. However, ECMP can cause asymmetric routing — forward and return packets take different paths — which breaks stateful firewalls and NAT. Careful design needed in environments with stateful inspection.

Q25. What is CEF and why is it faster than process switching?

CEF (Cisco Express Forwarding) uses a pre-built FIB (derived from routing table) and Adjacency Table (derived from ARP) to forward packets in hardware without CPU involvement. Process switching requires the CPU to make a forwarding decision for every single packet — 100–1000x slower. CEF is enabled by default on all modern Cisco platforms.

Q26. How does STP elect the Root Bridge?

The switch with the lowest Bridge ID (BID) becomes the Root Bridge. BID = Bridge Priority (default 32768) + VLAN ID + MAC address. All ports on the Root Bridge are Designated Ports (forwarding). Other switches then calculate the shortest path to the Root Bridge using port cost (based on link speed) to elect Root Ports. All other paths are Blocked to prevent loops.

Q27. What is EtherChannel and what protocols does it use?

EtherChannel bundles multiple physical links into one logical link. Protocols: LACP (IEEE 802.3ad, Active/Passive modes) — open standard; PAgP (Cisco proprietary, Desirable/Auto modes). STP sees the bundle as one link — no blocked ports. Supports load balancing based on src/dst MAC or IP.

Q28. What is Zero Trust security?

Zero Trust operates on “never trust, always verify” — no user or device is trusted by default regardless of network location. Key pillars: verify identity (MFA), validate device health, enforce least privilege access, microsegment the network, and continuously monitor. Replaces traditional perimeter-based “trust inside the firewall” model.

Q29. What is the difference between RADIUS and TACACS+?

Q30. How do you troubleshoot a network connectivity issue?

Follow the OSI model bottom-up: Layer 1 → check physical (cables, lights, NICs). Layer 2 → check ARP table, check switch MAC table, check VLANs. Layer 3 → ping gateway, check routing table (show ip route), check NAT. Layer 4 → check if port is open (telnet/nc), check firewall rules. Layer 7 → check application logs, DNS resolution, SSL certificates. Key commands: ping, traceroute, ipconfig/ifconfig, show ip route, show arp, show interface.

Subnetting Quick Reference

Use our free Subnet Calculator to practice. Common CIDR chart:

Related Interview Question Sets

• 150+ BGP Interview Questions
• CCNA vs Network+ vs CCNP — Which Cert?
• OSI Model Quiz — Test Yourself