Network engineer system design interview questions

As asked

Design a CDN for a video streaming service that must serve 4K video to 50 million concurrent users globally with p99 latency under 100ms for the first segment. Walk me through PoP placement, origin pull strategy, cache hierarchy, and how you handle a viral video that was not pre-warmed.

Sample answer outline

PoPs placed in major IXPs and ISP networks on every continent, selected by anycast BGP or DNS GeoDNS. Two-tier cache: edge PoPs cache popular content, mid-tier (shield) PoPs cache the long tail and protect origin. Origin pull on cache miss uses HTTP Range requests to stream the specific byte range needed. Viral video: shield PoPs absorb the stampede; at the edge, use request coalescing (collapse simultaneous cache misses for the same object into one origin fetch) and pre-push critical manifests. Signed URLs and token auth prevent hotlinking. Monitor cache hit rate per PoP and auto-scale origin.

Expect these follow-ups

• How would you handle adaptive bitrate (ABR) streaming where clients switch between quality levels?
• What is the thundering herd problem at the CDN cache level and how do you prevent it?

As asked

Design a load balancing architecture that handles 1 million requests per second for a REST API. Cover the differences between L4 (DSR or NAT) and L7 load balancing, how health checks work, session persistence, and how you scale the load balancer itself without making it a single point of failure.

Sample answer outline

Anycast VIP with BGP ECMP at L3 distributes traffic across a tier of L4 load balancers (using IPVS in Linux or dedicated hardware), which use consistent hashing to send connection flows to L7 proxies (Envoy, Nginx). L4 DSR (Direct Server Return) removes the L4 box from the return path for high-bandwidth responses. L7 proxies terminate TLS, parse HTTP, apply routing rules, and do active health checks (HTTP 200 on /health endpoint). Session persistence via cookie insertion or consistent hashing on client IP. L4 tier scales horizontally; multiple L7 proxies behind each L4 node. Use ECMP with BFD for fast failover of failed L4 nodes.

Expect these follow-ups

• What is Direct Server Return (DSR) and what hardware/network requirement does it impose on backend servers?
• How does a Kubernetes Ingress controller differ from a standalone Nginx load balancer in terms of configuration management?

As asked

A company wants all application traffic to managed databases and internal APIs to stay off the public internet. Walk me through the cloud networking design.

Sample answer outline

Use private subnets for workloads and private endpoints or PrivateLink-style services for managed databases and vendor APIs that support it. Route outbound internet access through controlled egress points, not from every workload subnet, and restrict security groups or firewall rules by service identity and port. DNS matters: the application should resolve the same service name to a private address inside the VPC or VNet. Discuss overlapping CIDRs, peering limits, transit gateways, and how this changes across AWS, Azure, and GCP. Weak answers often say 'use a VPN' without addressing name resolution, routing tables, or operational debugging.

Expect these follow-ups

• How would you debug an intermittent connection timeout to a private endpoint?
• When is VPC peering the wrong answer?
• How do you prevent all traffic from hairpinning through one expensive NAT path?

As asked

A company has flat network access between office, cloud, and production systems. How would you redesign segmentation using zero-trust principles?

Sample answer outline

Start by inventorying assets, data sensitivity, traffic flows, and identities before drawing new subnet boundaries. Segment by trust level and service purpose, then enforce access with identity-aware proxies, mutual TLS, security groups, firewall policies, and just-in-time admin access. Prefer explicit allow-lists based on service identity over broad IP ranges where the platform supports it. Roll out in observe mode first so legitimate flows are discovered and owners can fix dependencies. The best answers balance security with operability and include logging for denied flows.

Expect these follow-ups

• Where do VPNs fit in a zero-trust design?
• How do you avoid breaking batch jobs that use undocumented network paths?
• What is the difference between segmentation and microsegmentation?

As asked

A global enterprise has 500 branch offices across 50 countries. Design the WAN architecture: topology (hub-and-spoke vs mesh vs hybrid), transport selection, redundancy model, and how you handle latency-sensitive SaaS traffic like Microsoft 365 differently from traffic destined for on-premise data centers.

Sample answer outline

Hub-and-spoke for large branches with full mesh among regional hubs; small branches use hub-and-spoke with SD-WAN CPE for dual-transport resilience. Transport: MPLS for predictable latency to regional hubs, broadband internet plus LTE for backup and DIA. SaaS traffic: SD-WAN application-aware routing sends Office 365 direct to internet (DIA) based on SLA probe results, bypassing the hub backhaul; use Microsoft's peering IPs or Teams Connectivity model. On-prem DC traffic: MPLS primary with IPsec internet backup, route via regional hub. Traffic is monitored per-app with Thousand Eyes or SD-WAN telemetry.

Expect these follow-ups

• How do you enforce consistent security policy (URL filtering, CASB) when branches break out directly to internet?
• What is the impact on routing convergence when you have 500 CPE devices updating BGP simultaneously after a hub failure?

As asked

Design a leaf-spine Clos network fabric for a hyper-scale data center hosting 10,000 servers. Cover tier sizing, oversubscription ratios, east-west versus north-south traffic, BGP unnumbered on the fabric, and how ECMP handles server-to-server traffic.

Sample answer outline

Leaf-spine Clos: each leaf has 48 server-facing ports and 16 uplinks to spine switches; 16 spine switches each connect to every leaf. ECMP with 16 paths between any two leaves. BGP unnumbered (RFC 5549) runs on each leaf-to-spine link using link-local IPv6 for peering and advertising IPv4 and IPv6 host routes, simplifying addressing. Oversubscription: with 48 server ports and 16 uplinks all at the same speed, the ratio is 48:16 = 3:1, which is typical for east-west-heavy workloads. Using higher-speed uplinks (for example, 100G uplinks with 25G server ports) reduces oversubscription further. North-south traffic exits via border leaves connected to edge routers. EVPN and VXLAN overlays provide tenant isolation.

Expect these follow-ups

• When would you add a super-spine tier and what is the scaling limit of a two-tier leaf-spine?
• How does BGP unnumbered eliminate the need for dedicated /30 link addresses on every fabric link?

As asked

Design the DNS infrastructure for a company that cannot afford a single DNS outage. Cover authoritative server architecture, anycast distribution, DNSSEC signing workflow, secondary/hidden primary model, and how you protect against DDoS targeting your DNS servers.

Sample answer outline

Hidden primary (offline signing server, not reachable from internet) holds the master zone. Anycast-distributed secondary servers in 20+ PoPs worldwide pull zone transfers. DNSSEC: KASP (Key and Signing Policy) auto-rotates ZSK every 30 days, KSK annually; DS record is published at the parent TLD. Minimum two geographically distinct registrars with NS records pointing to anycasted NS pools. DDoS protection: UDP rate limiting, response rate limiting (DNS RRL), UDP amplification mitigation by limiting open resolver access, anycast absorption of volumetric attacks. Monitoring: query-per-second alerts, NXDOMAIN spike detection.

Expect these follow-ups

• What is DNS Response Rate Limiting (RRL) and how does it prevent your DNS server from being used as a DDoS amplifier?
• How do you roll a DNSSEC ZSK without causing validation failures during the rollover window?

As asked

A company wants to eliminate implicit trust based on network location and move to zero-trust. Design the architecture: what replaces the VPN, how are user devices verified before accessing resources, how are east-west flows controlled, and what role does identity play in policy enforcement.

Sample answer outline

Replace VPN with an identity-aware proxy (BeyondCorp model, or a commercial ZTNA like Zscaler/Cloudflare Access). Users authenticate with SSO + MFA; device posture (certificate, OS patch level, MDM enrollment) is evaluated before access is granted per-application. East-west: service mesh with mTLS enforces per-pod identity-based policy (SPIFFE/SPIRE for workload identity). Microsegmentation via network policy or eBPF denies by default. Policy enforcement point (PEP) is decoupled from policy decision point (PDP) which queries the identity provider. Logs from PEP feed SIEM for anomaly detection.

Expect these follow-ups

• How does SPIFFE standardize workload identity across different infrastructure providers?
• What is the difference between a ZTNA solution and a traditional VPN from a user experience perspective?

As asked

Design a monitoring platform for a network with 5,000 devices, collecting interface counters every 30 seconds, flow data, and syslog. Cover data ingestion, storage choices, alert latency requirements, and how you avoid alert storms when a core router fails and 500 devices become unreachable simultaneously.

Sample answer outline

Streaming telemetry (gNMI) for counter data feeds a message queue (Kafka) for back-pressure. Time-series DB (InfluxDB or Prometheus + Thanos for long-term) stores metrics. Syslog ingested via Fluentd into Elasticsearch. Alert rules in Grafana or Alertmanager with dependency-aware correlation: when a core router fails, suppress child alerts for devices reachable only through that router (topology-aware alert suppression using parent-child relationships). Flow data (NetFlow/IPFIX) stored in columnar format (ClickHouse) for traffic analysis queries. On-call routing via PagerDuty with escalation tiers.

Expect these follow-ups

• How do you model network topology dependencies to implement alert suppression correctly?
• What is the difference between a pull-based (Prometheus) and push-based (InfluxDB + Telegraf) metrics collection model?

As asked

You need to connect two data centers 500km apart with sub-millisecond failover, carrying both L2 (stretched VLANs) and L3 routed traffic. Design the interconnect: dark fiber vs DWDM, routing protocol choices, L2 extension technology, and how you prevent split-brain during a partial link failure.

Sample answer outline

Dark fiber or DWDM wavelengths for dedicated bandwidth; DWDM multiplexes 80+ wavelengths on one fiber pair, cost-effective at scale. OSPF or IS-IS with BFD for L3 sub-second failover. L2 extension via EVPN-VXLAN or OTV (Overlay Transport Virtualization) to stretch VLANs without STP spanning the WAN. Split-brain during partial failure: use a quorum witness (third site ping-test or dedicated arbitrator) to decide which DC wins if heartbeat between DCs is lost; the losing DC isolates itself. For storage replication, synchronous at this distance adds ~5ms RTT per round-trip, need to measure and budget.

Expect these follow-ups

• What are the STP implications of stretching a VLAN across two data centers over EVPN-VXLAN?
• How does a stretched L2 segment affect ARP traffic and how does EVPN's ARP suppression help?

As asked

A NOC manages 10,000 network devices across a multi-vendor environment (Cisco IOS-XE, Juniper JunOS, Arista EOS). Design an automation platform that supports configuration drift detection, bulk change deployment with rollback, and integration with a ticketing system. Cover the API abstraction layer and how you handle the multi-vendor problem.

Sample answer outline

Multi-vendor abstraction: NAPALM or Nornir with device-specific drivers; NETCONF/YANG for structured config on modern gear, SSH+Netmiko for legacy. Source of truth: Netbox or Infrahub as the CMDB storing intended state. Drift detection: periodic config pull compared to Netbox expected state, alerting on diff. Change pipeline: Git-based config templates (Jinja2), CI pipeline validates configs (syntax check, policy rules), staged rollout with pre/post diff, automatic rollback if health checks fail post-change. Ticketing integration: ITSM API creates/closes tickets on change events.

Expect these follow-ups

• What is the difference between NETCONF and RESTCONF and when would you choose each?
• How do YANG models help with multi-vendor normalization compared to screen-scraping CLI?

As asked

A load balancer keeps sending traffic to unhealthy application nodes during deploys. How would you redesign health checks and draining?

Sample answer outline

Distinguish liveness, readiness, and dependency health. A node should be live if the process can keep running, ready only when it can serve real traffic, and draining when it should finish existing requests but reject new ones. Health checks should hit a cheap endpoint that validates critical dependencies without causing a cascading outage when one shared dependency is slow. Configure thresholds, intervals, slow-start, connection draining, and deregistration delay to match the application's startup and shutdown behaviour. Candidates often fail by using one shallow /health endpoint for every purpose.

Expect these follow-ups

• Should database connectivity be part of readiness?
• How do long-lived WebSocket connections change draining?
• What happens if all targets fail the health check at once?