Computer Networks Interview Questions: 16 Worked Answers
Prepare for a networking interview with 16 precise answers and troubleshooting scenarios covering TCP, DNS, routing, subnetting, evidence and change verification.
Use these questions to practise explaining a network problem, choosing a test and interpreting the result. They suit an early-career support or network engineering interview. Device commands depend on the platform and configuration, so this guide focuses on reasoning rather than a universal command script.
How to practise
For a definition, explain the mechanism and one limitation. For a scenario, state the affected users and service, compare a working path with a failing one, and propose the least disruptive next check. Explain what each possible result would tell you.
The troubleshooting responses below are illustrative approaches. Adapt them to your actual access, evidence and incident process. Do not claim that you ran a production change when your experience was a lab exercise.
Interview questions & answers
Fundamentals
1.How do TCP and UDP differ?
TCP provides a reliable, ordered byte stream while a connection remains usable, using acknowledgements and retransmission. UDP sends datagrams without built-in delivery or ordering guarantees. TCP cannot make a failed network deliver indefinitely, and an acknowledgement does not prove the receiving application completed a business action. Choose transport based on the application’s needs, not a blanket claim that UDP is always faster.
2.What does a switch do differently from a router?
A typical Ethernet switch forwards frames within a local network using MAC-address information. A router forwards IP packets between networks using its routing table. Some switches also perform routing, so the device label alone is not enough. In an interview, explain which forwarding function you mean and where the traffic is trying to go.
3.How would you explain a subnet with an example?
An IP prefix identifies a network range. For the ordinary IPv4 subnet 192.0.2.0/26, the range is 192.0.2.0 through 192.0.2.63, with .0 as the network address and .63 as the broadcast address. The usual host range is .1 through .62. Explain the prefix calculation rather than applying that host-count rule to every special-purpose prefix.
4.Are a VLAN and an IP subnet the same thing?
No. A VLAN separates Ethernet broadcast domains; an IP subnet defines a network-layer address range. They are often mapped one-to-one in an enterprise design, but they are different concepts. Communication between VLANs normally requires a routing function and appropriate policy. Creating a VLAN alone does not define all access restrictions.
5.What happens during a DNS lookup?
A client asks a resolver for a record. The resolver may answer from its cache or follow DNS referrals to obtain an authoritative answer, then return the result. DNS stores several record types, not just addresses. For troubleshooting, record the queried name, type, resolver and returned status rather than saying only that DNS is broken.
6.What does the TCP handshake establish?
The usual opening exchange is SYN, SYN-ACK and ACK. It synchronises sequence information and establishes connection state. It does not authenticate a website or encrypt application data. If the client repeatedly sends SYN without receiving SYN-ACK, investigate the path, policy and listening service before treating it as an application response problem.
Troubleshooting
1.A service works by IP but not by hostname. What would you check?
Check the exact name and its DNS response from the affected client, including the configured resolver and any local override. Compare with a working client. Confirm that the returned address is the intended destination. A browser test by bare IP can behave differently because virtual hosting and TLS use the hostname, so it is evidence to interpret, not a complete diagnosis.
2.The user can reach the gateway but not an external service. What next?
Confirm the destination and application port, then compare name resolution, route information and the same service from another client. Check whether the problem affects one application or all external traffic. Review relevant policy and device evidence within your access. Reaching the gateway narrows the problem but does not prove that upstream routing or the service is healthy.
3.Does a successful ping prove an application works?
No. A ping response shows that the tested ICMP exchange succeeded. The application can still have a blocked port, TLS error, failed authentication or unhealthy backend. Conversely, a host may not answer ICMP while its application works. Test the actual service and interpret ping as one observation among others.
4.How would you investigate intermittent packet loss?
Record timing, source, destination and affected applications. Compare repeated measurements across a working and failing path and examine interface errors, congestion indicators and recent changes. A router may rate-limit diagnostic replies, so apparent loss at one traceroute hop is not automatically end-to-end forwarding loss. Correlate the observation with destination results before changing a device.
5.What would you check for recurring Wi-Fi disconnections?
Establish whether the issue follows the client, location, access point or time. Compare signal and roaming observations, authentication events, client driver information and access-point load with a working device. Avoid changing several settings together. Test one supported hypothesis, document the result and use the organisation’s change process for infrastructure adjustments.
6.How would you investigate a suspected duplicate IP address?
Compare the affected host’s configuration with DHCP lease and reservation records, then inspect address-resolution observations from the relevant segment. Look for an unintended static address or conflicting assignment. Confirm the responsible devices before changing either address. Document the corrective action and verify that the intended host remains reachable after the conflict is resolved.
7.How would you distinguish latency from throughput?
Latency describes elapsed time for an exchange; throughput describes data transferred per unit time. A path can have high throughput yet noticeable round-trip delay. State the endpoints, workload and measurement method. For a slow file transfer, consider loss, protocol behaviour, server limits and concurrent traffic instead of assuming that one ping measurement explains the result.
Application context
1.Does HTTPS fix every network security problem?
HTTPS uses HTTP over a protected transport, but it does not make the application’s logic, permissions or endpoints automatically safe. A valid connection still needs the correct destination, certificate validation and application controls. In an interview, distinguish transport protection from authentication, authorisation and the security of stored data.
Operations
1.How would you plan a network change?
Define the affected service, intended change, dependencies, approval, maintenance window and rollback trigger. Save the relevant baseline and configuration through the approved process. Verify both the intended path and critical unaffected paths after the change. A command that completed successfully is not sufficient evidence that users can perform their work.
2.How should you describe an outage you helped resolve?
Give the symptoms, scope, evidence you collected, your own decision and the observed recovery. For example: “I compared resolver answers on affected and working clients, found an outdated local setting and verified the service after the approved correction.” Use a real incident if you have one, label lab practice honestly, and avoid taking credit for another engineer’s change.
Check your own material with the Free interview answer grader.
