Network engineer role-specific interview questions

As asked

Traffic to your public service suddenly starts routing through an unexpected provider and latency triples. How would you investigate and respond to a possible BGP route leak?

Sample answer outline

Start with external visibility: route collectors, looking glasses, RPKI status, traceroutes from multiple regions, and provider status channels. Confirm whether your prefixes are being originated or propagated incorrectly, then work with upstream providers to filter or withdraw bad routes. Ensure your own route objects, ROAs, prefix filters, and max-prefix limits are correct before blaming the internet. Mitigate user impact with traffic engineering, alternate providers, or CDN routing where available. Candidates should understand that BGP convergence and provider coordination are operational realities, not instant local fixes.

Expect these follow-ups

• How does RPKI help, and what does it not prevent?
• What prefix filtering would you expect from a responsible upstream?
• How would you communicate customer impact during a routing incident?

As asked

Walk me through the full BGP best-path selection algorithm in order. Where do Weight, LOCAL_PREF, AS_PATH, MED, and IGP cost each fit, and which attributes are locally significant versus propagated to peers?

Sample answer outline

A strong answer lists the full decision process: highest Weight (Cisco-local), highest LOCAL_PREF (iBGP-propagated), locally originated, shortest AS_PATH, lowest Origin code, lowest MED (compared only between routes from same AS), eBGP over iBGP, lowest IGP cost to next-hop, then tiebreakers. Candidate distinguishes locally significant attributes from those crossing AS boundaries and knows that MED comparison is disabled by default when routes come from different ASes.

Expect these follow-ups

• If two eBGP peers advertise the same prefix and all attributes tie, what finally breaks the tie?
• How do you influence inbound traffic from a remote AS when you can only set outbound BGP attributes?

As asked

Describe exactly what happens at the packet level during TCP connection setup and teardown, including the sequence and acknowledgment number mechanics. What can go wrong at each step, and how does TIME_WAIT affect a server under load?

Sample answer outline

Answer covers SYN, SYN-ACK, ACK with ISN selection; four-way FIN/FIN-ACK teardown; and the 2MSL TIME_WAIT state that holds the local port pair. Strong candidates explain that TIME_WAIT prevents stale segments from a previous connection being misinterpreted, that high-connection-rate servers can exhaust ephemeral ports, and mitigations such as SO_REUSEADDR, tcp_tw_reuse, or reducing 2MSL via sysctl.

Expect these follow-ups

• What is TCP RST and when would you send one instead of a FIN?
• How does TCP Fast Open skip the handshake latency and what security risks does it introduce?

As asked

A browser on a corporate laptop queries example.com for the first time. Walk me through every step from the stub resolver through the recursive resolver, root servers, TLD servers, and authoritative servers. What caching happens at each layer, and how do negative caches and NXDOMAIN TTLs work?

Sample answer outline

Answer traces: OS stub resolver checks local cache and /etc/hosts, forwards to recursive resolver (usually ISP or corporate DNS), recursive resolver checks its cache, then iteratively queries root for .com NS, TLD for example.com NS, then authoritative NS for the A record. Caching is governed by TTL on each RRset. Negative caching (RFC 2308) caches NXDOMAIN for the SOA MINIMUM TTL. Strong candidates mention DNSSEC chain of trust and how a broken DS record can black-hole a domain.

Expect these follow-ups

• What is the difference between an authoritative and a recursive resolver, and why should they not run on the same host?
• How does DNS over HTTPS change the trust model compared to plain DNS?

As asked

Compare stateful inspection to simple packet filtering. How does a stateful firewall track TCP connections in its session table, what happens when asymmetric routing breaks that tracking, and how do you handle UDP pseudo-sessions?

Sample answer outline

Packet filtering evaluates each packet independently against ACL tuples; stateful inspection maintains a connection table keyed on 5-tuple and validates that packets belong to an established flow. Asymmetric routing means return traffic arrives on a different firewall instance with no matching session entry, causing drops. Mitigations include session sync between HA pairs, ECMP flow pinning, or moving to a stateless design for specific traffic. UDP pseudo-sessions use a configurable idle timeout since there is no SYN/FIN to anchor state.

Expect these follow-ups

• How does a next-generation firewall layer application inspection on top of stateful tracking?
• What is the security risk of the SYN flood and how does SYN cookie protect the session table?

As asked

A customer reports that API calls to our service take 3+ seconds sporadically. You SSH to the server. Without installing anything, walk me through the exact tcpdump command you would run, what fields in the capture you would look at, and how you would identify whether the delay is in the network, the server, or the client.

Sample answer outline

Run tcpdump with -nn (no name resolution), -s 0 (full packet), -w to file for Wireshark, filtering on the customer IP and port. Look at TCP timestamps: time from client SYN to server SYN-ACK measures network RTT; time from client sending the request (PSH+ACK) to server first response byte measures server processing time; time from server last byte to client ACK measures return network time. Retransmits (duplicate ACKs, RTO events), zero-window advertisements, or delayed ACKs (40ms gaps) all point to specific layers.

Expect these follow-ups

• How would you identify TCP retransmits specifically with tcpdump output rather than Wireshark?
• What is TCP delayed ACK and when does it interact badly with Nagle's algorithm?

As asked

In AWS VPC, you have both Network ACLs and Security Groups. Explain the fundamental difference in how they evaluate return traffic, why you need to explicitly allow ephemeral ports in an NACL, and in what scenario you would use a NACL to block traffic that a Security Group cannot.

Sample answer outline

Security Groups are stateful: if inbound TCP port 443 is allowed, the return traffic is automatically permitted regardless of outbound rules. NACLs are stateless: each direction is evaluated independently, so you must allow both inbound port 443 and outbound ephemeral ports (1024-65535 for Linux kernel range) or return packets are dropped. NACLs evaluate at the subnet level and process rules in order with an explicit deny, making them useful for blocking an IP range that has already been allowed into a Security Group (Security Groups have no explicit deny rule, only allow).

Expect these follow-ups

• How do VPC flow logs help you debug a connection that is blocked by a NACL but not a Security Group?
• What is the order of evaluation between NACLs and Security Groups for inbound traffic?

As asked

We have a multi-area OSPF deployment. Explain LSA types 1 through 7, which ones cross area boundaries, which ones stay within an area, and how Type 5 versus Type 7 external routes behave when you have an NSSA.

Sample answer outline

Strong answer covers: Type 1 (Router, intra-area), Type 2 (Network, intra-area), Type 3 (Summary, inter-area from ABR), Type 4 (ASBR Summary), Type 5 (External, flooded everywhere except stub areas), Type 7 (NSSA External, only within NSSA, converted to Type 5 at ABR). Candidate explains that in a stub area no Type 5 LSAs are flooded and a default route is injected, and that NSSA allows external routes via a local ASBR without full Type 5 flooding.

Expect these follow-ups

• Why would you choose a totally stubby area over a regular stub area?
• How does OSPF elect the DR/BDR on a multi-access segment and what problem does it solve?

As asked

You have 200 iBGP speakers in a single AS. Explain why a full mesh becomes unmanageable, how route reflectors solve it, and what the CLUSTER_LIST and ORIGINATOR_ID attributes do to prevent routing loops in a multi-RR hierarchy.

Sample answer outline

Full iBGP mesh requires n(n-1)/2 sessions, which hits 19,900 for 200 routers. Route reflectors relay iBGP routes to clients without requiring full mesh. ORIGINATOR_ID carries the BGP router-ID of the original route announcer; if a router receives a route with its own router-ID in ORIGINATOR_ID it discards it. CLUSTER_LIST is appended at each RR hop; a loop is detected when a router sees its own cluster-ID. Candidate should explain that redundant RRs in the same cluster share a cluster-ID.

Expect these follow-ups

• What problem does route-reflector hierarchy introduce that confederations avoid?
• How do you validate that all iBGP routes are consistently visible across a large RR deployment?

As asked

Explain how a CDN edge node decides whether to serve from cache or fetch from origin. Walk through Cache-Control directives like max-age, s-maxage, no-store, and stale-while-revalidate, and explain how Vary headers can fragment your cache badly.

Sample answer outline

CDN checks the cache key (URL by default) for a valid non-expired object. Cache-Control max-age applies to any cache including browsers; s-maxage overrides it for shared caches like CDN edges. no-store prevents caching entirely. stale-while-revalidate lets the edge serve a stale object while fetching a fresh copy in the background, reducing latency spikes. Vary tells the CDN to key on additional request headers (Accept-Encoding, Accept-Language), which can multiply cache entries and tank hit rates if Vary: * or Vary: Cookie is set carelessly.

Expect these follow-ups

• How do you purge a cached object from a multi-PoP CDN when you push a hotfix?
• What is the difference between a CDN pull zone and a push zone?

As asked

Your router has four equal-cost paths to a destination. Describe how ECMP hashing selects a path per flow, what tuple fields are typically hashed, and give me two real scenarios where ECMP hashing produces badly unbalanced traffic.

Sample answer outline

ECMP uses a hash of packet fields (commonly src/dst IP, src/dst port, protocol) modulo the number of paths to pick a consistent path per flow. Bad scenarios: (1) a large file transfer from one client monopolizes one path because it is one flow, (2) traffic behind NAT with a fixed source IP collapses to a two-tuple hash and all flows land on one link. Solutions include adaptive load balancing or flowlet switching (ECMP per small burst instead of per flow), and ensuring L4 ports are included in the hash.

Expect these follow-ups

• How does flowlet-based ECMP differ from traditional per-flow ECMP in terms of reordering risk?
• What happens to ECMP when you add a fifth path in the middle of active sessions?

As asked

Walk through a TLS 1.3 handshake at the message level: what is exchanged in the ClientHello and ServerHello, when are keys derived, and why is it faster than TLS 1.2? Then explain how mTLS differs and where you would use it in a service mesh.

Sample answer outline

TLS 1.3: ClientHello includes supported cipher suites and key shares; ServerHello selects cipher and provides its own key share; both sides derive traffic keys from the ECDHE shared secret immediately after ServerHello, so encrypted data can flow in 1-RTT. TLS 1.2 required two round trips. mTLS adds a CertificateRequest message so the client also presents a certificate the server validates; it establishes mutual identity, used in service meshes (Istio, Linkerd) for pod-to-pod auth. Candidate should mention session resumption via PSK for 0-RTT.

Expect these follow-ups

• What are the security risks of TLS 1.3 0-RTT and how do you mitigate replay attacks?
• How does certificate rotation work without downtime in an mTLS mesh?

As asked

We want to extend Layer 2 segments across a routed data center fabric using VXLAN. Explain the encapsulation, the role of the VTEP, how BUM traffic is handled in flood-and-learn versus EVPN control plane, and what MTU considerations you must address on the underlay.

Sample answer outline

VXLAN wraps an Ethernet frame in a UDP packet (dst port 4789) with a 24-bit VNI, allowing 16M segments. VTEPs terminate the tunnel at the hypervisor or ToR switch. Without a control plane, BUM (broadcast/unknown-unicast/multicast) is handled by IP multicast or ingress replication to all VTEPs. EVPN (RFC 7432 over BGP) provides a control plane that distributes MAC and IP reachability via Type-2 routes, eliminating most flooding. MTU: the underlay needs at least 50 extra bytes for VXLAN overhead, so if overlay frames are 1500 the underlay MTU must be at least 1550.

Expect these follow-ups

• How does EVPN handle ARP suppression and why does it reduce broadcast domains?
• What is the difference between VXLAN and GENEVE encapsulation?

As asked

You need to prioritize voice (RTP), video conferencing, and interactive SSH over bulk file transfers on a WAN link. Walk me through DSCP marking strategy, queuing disciplines you would use, and how you prevent low-priority traffic from starving completely.

Sample answer outline

Mark voice RTP EF (DSCP 46) for strict priority queue, video AF41 for bandwidth-guaranteed queue, interactive SSH CS2 or AF11 for a moderate queue, and bulk transfers CS1/LE for a low-priority queue with bandwidth cap. Use CBWFQ for bandwidth guarantees and LLQ (strict PQ + CBWFQ) for voice. Starvation prevention: cap the strict-priority queue so it cannot consume more than, say, 30% of link bandwidth, and use WRED on bulk queues to drop early before tail-drop cascades. End with policing inbound and shaping outbound where asymmetric.

Expect these follow-ups

• How does WRED differ from tail-drop and what problem does it solve for TCP flows?
• Where should DSCP marking happen and why should you not trust markings from endpoints outside your control?

As asked

Users report intermittent packet loss lasting about 30 seconds every few hours. You suspect spanning tree topology changes. Explain how you would confirm this, what the MAC flush behavior is during a TCN, and how Rapid PVST+ reduces the outage compared to classic 802.1D.

Sample answer outline

Confirm with 'show spanning-tree detail' looking for TC count incrementing and last TCN source; check syslog for Topology Change notifications. Classic STP flushes the entire MAC table on TCN and ports re-learn over the 15-second forward delay twice (30 seconds total). Rapid PVST+ uses proposal/agreement handshake to transition edge ports immediately (PortFast) and synchronizes only the affected segment, typically converging in under 1 second. Root cause investigation should identify the unstable port, check for BPDU drops, NIC flapping, or a rogue switch.

Expect these follow-ups

• What is BPDU Guard and why should it be on every PortFast edge port?
• How does MST reduce spanning tree instances in a large VLAN environment?

As asked

A corporate NAT device with one public IP is serving 5000 clients. Explain how PAT (NAT overload) works, what limits the number of concurrent sessions, and what happens when the session table fills up. How would you scale beyond one public IP?

Sample answer outline

PAT maps (private IP, private port) to (public IP, ephemeral port), using a unique public ephemeral port per active session. Each public IP supports roughly 65,000 port values per protocol, so approximately 65,000 concurrent sessions per public IP per protocol in total. Table exhaustion causes new connection attempts to be dropped silently. Mitigations: add more public IPs to the NAT pool and distribute sessions across them, reduce session idle timers to reclaim entries faster, implement per-subscriber session limits to prevent one host from exhausting the pool. Advanced: CGNAT with port-block allocation meets logging requirements for ISP-scale deployments.

Expect these follow-ups

• How does a port-restricted cone NAT affect WebRTC peer-to-peer connectivity?
• Why does NAT break IPsec ESP and what mechanism fixes it?

As asked

Major DNS resolvers like 8.8.8.8 are served from hundreds of locations simultaneously. Explain how anycast BGP advertisements make this work, how the nearest PoP is selected, and what happens to in-flight DNS queries when a PoP goes down.

Sample answer outline

Each PoP announces the same IP prefix (e.g., /32 for 8.8.8.8) via BGP. Routers in the internet select the closest PoP based on BGP best-path, effectively nearest by AS_PATH or MED. When a PoP fails, its BGP session drops, the prefix withdraws, and clients re-converge to the next-best PoP. Because DNS is UDP and stateless, in-flight queries simply time out and retry; the client resolves to the new PoP on retry. Anycast does not work for long-lived TCP sessions without additional care.

Expect these follow-ups

• Why is anycast generally unsuitable for TCP-based services without session persistence mechanisms?
• How does a CDN decide which anycast PoP to add capacity to?

As asked

A 100 Gbps volumetric DDoS attack is saturating an upstream link to one of your customers. Walk me through the layered mitigation approach from upstream scrubbing to on-premise controls, including BGP blackhole signaling and RTBH.

Sample answer outline

First line: trigger Remote Triggered Blackhole (RTBH) by advertising the victim prefix with the BLACKHOLE well-known community (65535:666) to upstream peers; they null-route traffic before it reaches your link. This kills the attack but also kills the victim. Better: upstream scrubbing center receives traffic, strips attack packets, and tunnels clean traffic back via GRE or MPLS. On-premise: ACLs to rate-limit UDP floods, SYN cookies for TCP flood, rate limiting specific source ranges. Long-term: anycast distribution to absorb volumetric, CDN offload for application-layer L7 attacks (HTTP floods filtered by WAF).

Expect these follow-ups

• What is the difference between a volumetric attack and an application-layer DDoS, and why do mitigation techniques differ?
• How do you prevent BGP blackhole from being abused by a customer to knock a competitor offline?

As asked

We need to provide IPv6 connectivity to users while still reaching IPv4-only origins. Compare dual-stack, 6to4/6rd tunneling, and NAT64 with DNS64. What are the operational tradeoffs and failure modes of each approach?

Sample answer outline

Dual-stack: every node has both v4 and v6, simplest operationally but requires sufficient IPv4 space. 6to4/6rd: tunnel IPv6 over IPv4 infrastructure; 6to4 relies on well-known relay routers that may be unreliable; 6rd (RFC 5969) uses ISP-controlled relays with better reliability. NAT64+DNS64: DNS64 synthesizes AAAA records pointing to a NAT64 prefix; the NAT64 gateway translates IPv6 packets to IPv4. Failure modes: DNS64 breaks DNSSEC validation for A records; applications that embed raw IPv4 addresses bypass DNS and fail; some protocols encode address families in the payload (FTP, SIP) and need ALGs.

Expect these follow-ups

• Why does DNSSEC validation fail with DNS64 and how do you work around it?
• How does 464XLAT work and why is it used in mobile carrier networks?

As asked

Walk me through the tools you use for network observability: what does NetFlow/IPFIX tell you that SNMP polling does not, how does sFlow differ from NetFlow, and where does streaming telemetry with gRPC/gNMI fit in compared to SNMP?

Sample answer outline

SNMP polling gives interface counters at coarse intervals (60s typically), good for capacity planning but misses short bursts. NetFlow/IPFIX exports per-flow records (5-tuple plus byte/packet counts) from the router, giving visibility into who is talking to whom and how much. sFlow uses packet sampling (e.g., 1-in-1000) and is lower overhead, better for high-speed interfaces, but less accurate for small flows. Streaming telemetry via gNMI/gRPC pushes sub-second counter data directly from the device without polling overhead, enabling near-real-time detection of microbursts. Candidate should mention collectors like Prometheus + Grafana, ELK, or commercial tools like ThousandEyes for active probing.

Expect these follow-ups

• How would you use NetFlow data to detect a DDoS attack in progress?
• What is the difference between model-driven telemetry and legacy SNMP MIB polling architecturally?

As asked

A customer reports that SSH works but large SCP transfers hang. You suspect PMTUD black hole. Explain how PMTUD works, why ICMP filtering breaks it, and what the TCP MSS clamp does to work around it.

Sample answer outline

PMTUD sends packets with DF (Don't Fragment) bit set and relies on intermediate routers to return ICMP Type 3 Code 4 'fragmentation needed' when a packet exceeds link MTU. If a firewall blocks ICMP, the sender never learns of the smaller MTU, and large packets are silently dropped causing hangs. SSH control packets are small and work; SSH data (SCP) frames fill the MTU and get dropped. TCP MSS clamping in the SYN (via iptables TCPMSS or Cisco ip tcp adjust-mss) adjusts the announced MSS to account for the path MTU at the edge, so TCP peers never send segments too large for the path.

Expect these follow-ups

• What MTU would you set on a GRE-over-IPsec tunnel carrying Ethernet frames of 1500 bytes?
• How does DPLPMTUD (RFC 8899) extend PMTUD to QUIC and UDP transports?

As asked

Explain how an ARP spoofing attack works on a shared LAN segment, what traffic an attacker can intercept, and how Dynamic ARP Inspection (DAI) on a managed switch detects and blocks the attack.

Sample answer outline

ARP has no authentication: any host can send a gratuitous ARP claiming to be the default gateway, causing other hosts to update their ARP cache and send traffic to the attacker (man-in-the-middle). DAI intercepts ARP packets on untrusted ports and validates them against the DHCP Snooping binding table (IP-to-MAC-to-port). Packets not matching a valid binding are dropped. Uplinks and trusted servers go on trusted ports. Candidate should note that static ARP entries and 802.1X port authentication complement DAI, and that DAI rate-limits ARP to prevent ARP flood DoS.

Expect these follow-ups

• How does IPv6 NDP differ from ARP and what is the equivalent of DAI for IPv6?
• Why does DHCP Snooping need to be enabled before DAI can function?

As asked

A retail chain has 200 branches each with a broadband and an LTE link. Design an SD-WAN overlay: what control plane mechanism distributes routing information, how do you enforce application-aware routing, and how do you handle a dual-link failure at a branch?

Sample answer outline

SD-WAN controllers (vBond, vSmart in Cisco's model) distribute OMP routes and policy to vEdge CPE. Each branch builds IPsec tunnels to regional hub sites (or data centers) over both ISP links. Application-aware routing uses real-time SLA probes (loss, latency, jitter) per tunnel; DIA (Direct Internet Access) sends SaaS traffic directly while sensitive apps tunnel to hub. Dual-link failure: branch falls back to LTE if not already using it; if both links fail, local policy can provide survivability via cached DNS and local breakout for critical apps. Candidate should discuss centralized policy vs distributed data plane.

Expect these follow-ups

• How does TLOC (Transport Location) in Cisco SD-WAN allow multi-path across WAN transports?
• What telemetry would you monitor to detect WAN link degradation before it affects users?

As asked

Kubernetes pods get their own network stack. Explain how Linux network namespaces isolate them, how veth pairs connect a pod namespace to the host namespace, and how a CNI plugin like Calico or Flannel extends this to cross-node pod routing.

Sample answer outline

Each pod gets a separate network namespace with its own routing table, interfaces, and iptables rules. A veth pair (like a virtual crossover cable) links the pod namespace (eth0) to a bridge or to a host-side interface. Flannel uses VXLAN or UDP tunnels to send pod traffic across nodes; Calico uses host routing and BGP to distribute pod CIDR routes between nodes, avoiding encapsulation overhead. Calico's eBPF dataplane bypasses iptables entirely for better performance. Candidate should understand how Service ClusterIP is implemented via iptables DNAT rules or eBPF maps.

Expect these follow-ups

• How does Kubernetes kube-proxy implement Service ClusterIP load balancing using iptables?
• What is a CNI and what interface contract does Kubernetes expect it to implement?

As asked

A service provider is choosing between IS-IS and OSPF as the IGP for a 500-router backbone. Walk through the key architectural differences, why most large ISPs historically chose IS-IS, and where OSPF is a better fit.

Sample answer outline

Both are link-state protocols using Dijkstra, but IS-IS runs directly over Layer 2 (not IP), so it is immune to IP misconfiguration and easier to protect from spoofing. IS-IS scales better historically because its PDU format uses TLV extensions (easy to add new capabilities like traffic engineering or IPv6 without a new protocol version), and its two-level hierarchy (L1/L2) maps well to SP backbone versus access. OSPF is IP-native, has richer vendor documentation, and is more common in enterprise environments. IS-IS is dominant in large ISP backbones (Tier-1 carriers); OSPF dominates enterprise data centers.

Expect these follow-ups

• How does IS-IS handle IPv6 compared to OSPF with OSPFv3?
• Explain IS-IS Level 1 versus Level 2 routing and what an L1/L2 router does.