Networking Interview Prep Part 1

Technical Answer: The OSI model is a conceptual framework with 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application. Even though real stacks often follow TCP/IP, OSI is essential for structured troubleshooting. For example, no link light indicates Layer 1, MAC table issues indicate Layer 2, missing routes indicate Layer 3, and failed TCP three-way handshake indicates Layer 4. Cisco troubleshooting workflows often start by identifying the failing layer and validating with commands like show interfaces, show mac address-table, and show ip route.

Interview Tip: Explain that OSI is a diagnostic map, not a theory checklist. Give one practical example from each of the first four layers.

Technical Answer: A segment is the Layer 4 PDU for TCP (UDP uses datagram), a packet is the Layer 3 PDU (IP header plus payload), and a frame is the Layer 2 PDU (Ethernet header/trailer plus Layer 3 packet). As data moves down the stack, each layer encapsulates data with its own header; at the receiver, decapsulation happens in reverse. On Ethernet, the frame includes source and destination MAC addresses and FCS for error detection.

Interview Tip: Draw encapsulation quickly on paper. Interviewers value candidates who can explain the data path cleanly.

Technical Answer: Layer 1 includes hubs and media repeaters. Layer 2 includes switches and bridges that forward based on MAC addresses and VLAN tags (802.1Q). Layer 3 includes routers and Layer 3 switches that forward based on IP prefixes and routing tables. Modern firewalls can operate across Layers 3-7, but routing decision logic itself is Layer 3.

Interview Tip: Mention that multilayer devices can work across layers, but forwarding decisions still map to specific headers.

Technical Answer: TCP is connection-oriented and provides reliability, sequencing, acknowledgments, retransmission, and flow control. It suits applications like HTTP/HTTPS (ports 80/443), SSH (22), and SMTP (25). UDP is connectionless with low overhead and no guaranteed delivery, so it suits real-time or lightweight traffic such as DNS queries (53), DHCP (67/68), and voice/video streams. The choice depends on whether the application prefers reliability or minimal latency and overhead.

Interview Tip: State the tradeoff first: reliability vs speed. Then give two concrete protocol examples for each.

Technical Answer: Step 1: client sends SYN with an initial sequence number. Step 2: server replies SYN-ACK with its own sequence number and acknowledgment of client SYN. Step 3: client sends ACK, establishing the session. This process negotiates sequence tracking and confirms bidirectional reachability before application data transfer. If SYNs are sent repeatedly with no SYN-ACK, investigate ACLs, firewalls, routing, or server availability.

Interview Tip: Use directional language: client to server, server to client, client to server. It makes your explanation sound operationally mature.

Technical Answer: MTU defines the maximum Layer 3 packet size carried without fragmentation. Standard Ethernet MTU is typically 1500 bytes. If packets exceed path MTU and DF (Don't Fragment) is set, devices drop the packet and may send ICMP "Fragmentation Needed". PMTUD relies on these ICMP messages. In tunnel or VPN environments, overhead can reduce effective MTU, requiring MSS clamping or MTU tuning. On Cisco interfaces, you can verify with show interface and adjust with mtu or ip tcp adjust-mss where appropriate.

Interview Tip: Mention that blocked ICMP can break PMTUD, leading to "small packets work, large packets fail" symptoms.

Technical Answer: Cat5e supports up to 1 Gbps at 100 meters and can sometimes support 2.5/5G in certain conditions. Cat6 supports 1 Gbps at 100 meters and up to 10 Gbps at shorter distances (commonly up to 55 meters depending on environment). Cat6a is designed for 10 Gbps up to 100 meters with better alien crosstalk performance. For new enterprise horizontal runs targeting 10G readiness, Cat6a is usually preferred.

Interview Tip: Tie cable type to use case and budget, not just raw speed specs.

Technical Answer: Single-mode fiber (SMF) has a small core (about 9 microns), uses laser optics, and is ideal for long-distance links, often kilometers to tens of kilometers. Multi-mode fiber (MMF), usually OM3/OM4/OM5, has larger cores (50 or 62.5 microns), uses VCSEL optics, and is common for shorter data center or building links. SMF optics are typically costlier but scale better over distance.

Interview Tip: State distance first, then optics type. This mirrors real design decision flow.

Technical Answer: Duplex mismatch occurs when one side uses full duplex and the other side uses half duplex. Symptoms include low throughput, high late collisions/FCS errors, and poor application performance despite link up status. Auto-negotiation should usually be enabled on both sides unless a strict design standard says otherwise. Validate on Cisco with show interfaces and check input errors, CRC, collisions, and duplex/speed status.

Interview Tip: Emphasize that "link up" does not mean "healthy link." Mention error counters explicitly.

Technical Answer: Star topology is simple and common in LANs, with centralized control but potential central-point dependency. Full mesh provides high redundancy and path diversity but is expensive and complex to scale. Bus topology is low-cost and simple historically, but poor fault tolerance and scalability make it rare in modern enterprise LANs. Most real networks use hybrid topologies combining hierarchical star with partial mesh uplinks.

Interview Tip: Give one sentence per topology and finish with why hybrid designs are used in practice.

Technical Answer: A switch creates separate collision domains per port, reducing collisions compared with hub-based designs. By default, a VLAN on a switch is one broadcast domain. Routers and Layer 3 interfaces break broadcast domains, because Layer 3 forwarding does not propagate Layer 2 broadcasts across interfaces. VLANs plus routing provide scalable segmentation in enterprise networks.

Interview Tip: Keep it crisp: switch separates collisions, router separates broadcasts.

Technical Answer: ARP resolves IPv4 addresses to MAC addresses so hosts can build Ethernet frames for local delivery. If a destination is local subnet, host ARPs for target IP; if remote, host ARPs for default gateway IP. ARP entries are cached temporarily. Problems like stale ARP, spoofing, or duplicate IPs can cause intermittent or misdirected traffic. Verification commands include arp -a on endpoints and show ip arp on Cisco devices.

Interview Tip: Mention local-destination ARP versus default-gateway ARP to show practical understanding.

Technical Answer: A switch learns source MAC addresses by examining incoming frames and mapping source MAC to ingress port in the CAM table. For known destination MACs, it forwards only out the mapped port. For unknown unicast destinations, it floods within the VLAN except ingress port. Broadcast and multicast handling also depends on VLAN scope and control features like IGMP snooping for multicast optimization.

Interview Tip: Use a quick "learn, look up, forward or flood" sequence. It is easy for interviewers to follow.

Technical Answer: Ethernet Frame Check Sequence (FCS), based on CRC, detects corruption in transmitted frames. The receiver recalculates CRC and compares it to the FCS value. If mismatch occurs, frame is discarded. FCS detects errors, but it does not correct them. Recovery is handled by higher-layer mechanisms, such as TCP retransmission.

Interview Tip: Say "detect, discard, recover at higher layer" in that exact order.

Technical Answer: Attenuation is signal loss over distance and media characteristics. On copper, attenuation increases with frequency and cable quality issues; on fiber, attenuation depends on wavelength, connector quality, and splice loss. Excessive attenuation can cause bit errors, retransmissions, and flapping links. Validation may include interface optical power readings (on supported transceivers), error counters, and certification testing for structured cabling.

Interview Tip: Connect attenuation to business impact: intermittent links and unstable applications.

Technical Answer: Key ports include SSH 22, Telnet 23, DNS 53 (TCP/UDP), DHCP 67/68 (UDP), HTTP 80, HTTPS 443, FTP 20/21, TFTP 69 (UDP), SNMP 161/162 (UDP), NTP 123 (UDP), SMTP 25, POP3 110, IMAP 143, RDP 3389. You should also understand when protocols can use both TCP and UDP, such as DNS.

Interview Tip: Group ports by function (management, web, infrastructure, email) instead of listing randomly.

Technical Answer: Latency is one-way or round-trip delay; high latency impacts interactive apps and transaction response times. Jitter is variation in delay; it degrades real-time audio/video quality. Packet loss forces retransmissions for TCP and can directly degrade UDP streams. Baseline thresholds vary by application, but voice traffic is especially sensitive to jitter and loss. Tools like ping, traceroute, and interface counters help isolate where impairment starts.

Interview Tip: Tie each metric to one app type, for example VoIP for jitter and web transactions for latency.

Technical Answer: Bandwidth is theoretical link capacity, while throughput is actual delivered data rate after protocol overhead, contention, latency effects, and device limitations. For example, Ethernet, IP, and TCP headers consume bytes, and retransmissions reduce effective throughput further. Good performance tuning focuses on bottlenecks, error rates, duplex consistency, and end-to-end path behavior, not only link speed.

Interview Tip: Give a practical number example: "1 Gbps link, but 930 Mbps real throughput under ideal conditions."

Technical Answer: Start with Layer 1 checks: cable seated, link LEDs, transceiver compatibility, interface admin state. Then verify Layer 2 status and errors (show interfaces status, show interfaces counters). Next confirm Layer 3 addressing and gateway (ipconfig/ifconfig, show ip interface brief). Finally test reachability in scope order: local gateway, remote subnet, then application endpoint. Document findings and changes for handoff and incident tracking.

Interview Tip: Present this as a top-down checklist. It demonstrates composure under pressure.

Technical Answer: Accurate diagrams and interface descriptions reduce troubleshooting time, prevent mispatching, and support safer change execution. At minimum, document device names, management IPs, uplinks, VLAN intent, and circuit/provider references. On Cisco devices, interface descriptions can be configured directly with description under each interface. Good documentation also supports root cause analysis and compliance requirements.

Interview Tip: Mention that "if it is not documented, it is not operationally complete." Interviewers value this mindset.

Technical Answer: An IPv4 address is 32 bits, written as four octets in dotted decimal format, for example 192.168.10.25. It has a network portion and a host portion, defined by the subnet mask or prefix length. Routers forward based on the network prefix, while hosts identify endpoints inside that subnet using the host bits.

Interview Tip: Start with "32 bits, 4 octets," then explain network vs host bits with one example.

Technical Answer: A subnet mask marks network bits as 1 and host bits as 0. For example, 255.255.255.0 means /24, so the first 24 bits are network and the last 8 bits are host. Hosts in the same network can communicate directly at Layer 2; traffic to other networks is sent to the default gateway. Incorrect masks can cause local delivery attempts for remote networks or unnecessary gateway usage.

Interview Tip: Use one quick example: "10.1.1.10/24 is in network 10.1.1.0."

Technical Answer: CIDR /n means n leading 1s in the subnet mask. Common conversions include /24 = 255.255.255.0, /25 = 255.255.255.128, /26 = 255.255.255.192, /27 = 255.255.255.224, /28 = 255.255.255.240, /30 = 255.255.255.252. To convert manually, count full octets of 8 bits, then calculate partial octet values using powers of two.

Interview Tip: Memorize /24 through /30 cold. It speeds up whiteboard subnetting dramatically.

Technical Answer: /26 means block size 64 in the last octet (0, 64, 128, 192). Address 192.168.50.130 falls in the 128-191 block. So network address is 192.168.50.128, broadcast address is 192.168.50.191, and usable hosts are 192.168.50.129 to 192.168.50.190.

Interview Tip: Say "block size method" and show the ranges quickly. That demonstrates production-ready subnetting speed.

Technical Answer: RFC1918 private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These addresses are not routable on the public internet and are used inside organizations. Internet access from private hosts typically requires NAT or PAT at the edge firewall or router.

Interview Tip: Mention all three ranges from memory and add one practical use case like branch office LANs.

Technical Answer: Public IP addresses are globally unique and internet routable. Private IP addresses are internally scoped and require translation for internet connectivity. Enterprises often use private addressing for endpoints and reserve public addresses for edge interfaces, public services, or load balancers. This design reduces public IP consumption and improves internal architecture flexibility.

Interview Tip: Frame your answer as "inside addressing strategy plus edge translation strategy."

Technical Answer: 169.254.0.0/16 is link-local IPv4 (APIPA) assigned automatically when a host cannot reach a DHCP server and no static IP is configured. It allows limited local subnet communication but usually indicates DHCP failure in managed networks. Troubleshoot by checking VLAN assignment, DHCP scope availability, relay configuration, and uplink path to DHCP server.

Interview Tip: State that APIPA is a symptom, not the root cause, then list likely DHCP path checks.

Technical Answer: The default gateway is the Layer 3 next hop a host uses for destinations outside its local subnet. If gateway IP is wrong, unreachable, or in a different subnet, off-subnet traffic fails while same-subnet traffic may still work. On endpoints, verify with ipconfig or ip route. On network devices, validate SVI and routing with show ip interface brief and show ip route.

Interview Tip: Use the phrase "same subnet direct, different subnet via gateway" to keep your explanation crisp.

Technical Answer: Hosts per subnet in IPv4 are calculated as 2^(host bits) - 2 for traditional subnets (excluding network and broadcast). For example, /27 leaves 5 host bits, so 2^5 - 2 = 30 usable hosts. /30 gives 2 usable hosts, often used on point-to-point links. For /31 links on modern routers, both addresses can be used for point-to-point per RFC 3021.

Interview Tip: Explain both formula and one exception like /31 to show depth.

Technical Answer: Variable Length Subnet Masking allows different prefix lengths within the same major network block, matching subnet size to actual host needs. This reduces waste compared with fixed-length subnetting. For example, a user VLAN may need /24, a server segment /27, and WAN links /30 or /31. VLSM requires classless routing support and careful planning to avoid overlaps.

Interview Tip: Mention "efficiency plus scalability" and provide a simple multi-subnet example.

Technical Answer: Allocate largest first. 100 hosts needs /25 (126 usable): 10.10.0.0/25. 50 hosts needs /26 (62 usable): 10.10.0.128/26. 20 hosts needs /27 (30 usable): 10.10.0.192/27. Remaining addresses 10.10.0.224/27 can be reserved for growth. This avoids fragmentation and preserves contiguous blocks.

Interview Tip: Always say "largest-to-smallest allocation" before doing calculations.

Technical Answer: Supernetting combines multiple contiguous networks into a shorter prefix summary route. Example: 192.168.0.0/24 through 192.168.3.0/24 can be summarized as 192.168.0.0/22. Benefits include smaller route tables, faster convergence behavior, and reduced update overhead. Summaries must align on binary boundaries and represent only valid contiguous blocks.

Interview Tip: Explain one exact summary example and why it improves scalability.

Technical Answer: IPv6 is 128 bits, written as eight 16-bit hexadecimal blocks, for example 2001:0db8:0000:0000:02aa:00ff:fe9a:4ca2. Leading zeros in each block can be omitted, and one consecutive run of all-zero blocks can be replaced with :: once per address. So the example can become 2001:db8::2aa:ff:fe9a:4ca2.

Interview Tip: Show one expansion and one compression example to prove comfort with notation.

Technical Answer: Global unicast addresses are internet-routable and generally fall under 2000::/3. Link-local addresses are FE80::/10 and exist on every IPv6 interface for local-link communication and next-hop operations. Unique local addresses are FC00::/7 (commonly FD00::/8 in practice) and are private-like internal addresses. IPv6 also uses multicast extensively, for example FF02::1 for all nodes on the local link.

Interview Tip: Emphasize scope: global, local-link, internal-only.

Technical Answer: Hosts can use SLAAC based on Router Advertisements (ICMPv6) to generate interface addresses from advertised prefixes, typically /64. DHCPv6 can provide stateful assignment and options like DNS settings, depending on RA flags (M and O bits). Many environments use a hybrid model: SLAAC for address plus DHCPv6 for additional options. Core protocols include ICMPv6 Neighbor Discovery rather than ARP.

Interview Tip: Mention RA flags and the hybrid pattern, it sounds practical and current.

Technical Answer: With EUI-64, the host interface ID is derived from the 48-bit MAC by inserting FFFE in the middle and flipping the universal/local bit. This can expose hardware identity patterns, so modern systems often use temporary privacy addresses (RFC 4941) for outbound connections. Stable addresses may still be retained for inbound management or policy consistency.

Interview Tip: Explain EUI-64 quickly, then highlight privacy addresses as the security-aware improvement.

Technical Answer: /64 is the standard subnet size for most IPv6 LANs because SLAAC expects a 64-bit interface ID boundary. Shorter or longer prefixes are possible in special cases, but deviating from /64 on user LANs can break expected behavior. Point-to-point links may use /127 in some designs to reduce certain neighbor-related issues. Enterprises usually allocate larger blocks per site, then standardize /64 per VLAN.

Interview Tip: Say "standardize /64 for LAN consistency" and mention /127 only as a targeted design choice.

Technical Answer: Dual-stack runs IPv4 and IPv6 simultaneously, providing maximum compatibility but operational complexity. Tunneling (for example GRE or 6in4 variants) encapsulates one protocol over another where native support is missing. Translation methods like NAT64 and DNS64 allow IPv6-only clients to reach IPv4 services. Most enterprises prefer phased dual-stack with selective translation at boundaries.

Interview Tip: State that dual-stack is operationally common, then explain when translation is required.

Technical Answer: Start by validating local interface config with ipconfig /all (Windows) or ip a and ip route (Linux). Check subnet mask and whether gateway is in the same subnet. Test path in sequence: ping self, ping gateway, ping remote IP, then test DNS name resolution. For duplicate IP, review ARP behavior (arp -a), look for MAC flapping or gateway ARP instability, and verify DHCP reservation conflicts.

Interview Tip: Present checks in fixed order and say what each result means before moving to the next test.

Technical Answer: /20 corresponds to mask 255.255.240.0, so subnets increment by 16 in the third octet. Host 172.16.34.77 belongs to 172.16.32.0/20 (range 172.16.32.0-172.16.47.255). Destination 172.16.48.10 is in a different subnet (172.16.48.0/20), so traffic must go via default gateway. First checks: correct gateway config on source host, gateway reachability, and route presence on upstream router for 172.16.48.0/20.

Interview Tip: Verbally compute the /20 boundary before troubleshooting steps, it signals confident subnet logic.

Technical Answer: VLANs create separate Layer 2 broadcast domains on the same physical switching infrastructure. Without VLANs, all hosts share one broadcast domain, increasing noise and security risk. By assigning ports to VLANs, traffic is isolated until routed by a Layer 3 device. Common examples include separate VLANs for users, servers, voice, and management.

Interview Tip: Start with "one switch, multiple logical LANs" and then mention broadcast reduction and segmentation.

Technical Answer: An access port carries traffic for a single VLAN and typically connects end devices such as PCs, printers, or IP phones (with voice VLAN configured separately). Frames on access ports are normally untagged on ingress and egress for data VLAN traffic. Typical Cisco configuration includes switchport mode access and switchport access vlan .

Interview Tip: Mention that access mode prevents unintended trunk negotiation in many designs.

Technical Answer: A trunk port carries multiple VLANs across one link by adding VLAN tags to frames, most commonly using IEEE 802.1Q. Trunks are used between switches, and between switches and routers/firewalls when multiple VLANs must traverse one physical interface. Typical command is switchport mode trunk, with optional restrictions such as switchport trunk allowed vlan.

Interview Tip: Explain trunking as multiplexing multiple VLANs over one cable.

Technical Answer: 802.1Q inserts a 4-byte tag into the Ethernet frame after source MAC. The tag includes TPID (typically 0x8100) and TCI fields. TCI contains PCP (priority bits), DEI, and VLAN ID (12 bits, supporting VLAN IDs 1-4094 usable). This lets switches identify VLAN membership and QoS priority on trunk links.

Interview Tip: Mention "4-byte tag, VLAN ID in 12 bits" to sound precise.

Technical Answer: The native VLAN is the VLAN whose frames are sent untagged on an 802.1Q trunk by default. On Cisco devices, VLAN 1 is default native VLAN unless changed. Both trunk ends should agree on native VLAN to avoid traffic leaks and misforwarding. Best practice is to use an unused dedicated native VLAN and avoid carrying user traffic on it.

Interview Tip: Call out native VLAN mismatch as a classic troubleshooting and security issue.

Technical Answer: By default, trunks may carry many VLANs, which can unnecessarily expand broadcast domains and attack surface. Explicitly setting allowed VLANs ensures only required VLANs traverse each trunk. Cisco command example: switchport trunk allowed vlan 10,20,30. This also simplifies troubleshooting because unexpected VLAN propagation is minimized.

Interview Tip: State that least-privilege applies to VLAN carriage too, not only to users.

Technical Answer: On a phone-plus-PC port, the switchport can use an access VLAN for PC data and a separate voice VLAN for IP phone traffic. The phone tags voice frames (often via 802.1Q), while PC data remains untagged in the access VLAN. Cisco configuration often includes switchport access vlan and switchport voice vlan . QoS policies commonly prioritize voice traffic.

Interview Tip: Mention that the switch can logically separate two traffic types on one physical edge port.

Technical Answer: VLAN IDs are 1-4094 usable in 802.1Q context. Historically on Cisco, normal range is 1-1005 and extended range is 1006-4094. VLAN 1 is default and generally avoided for user traffic. VLANs 1002-1005 are legacy reserved VLANs on many platforms. Exact handling can vary by switch OS version and feature set.

Interview Tip: Quote both ranges and then add "avoid user data on VLAN 1" as a practical rule.

Technical Answer: Different VLANs are different Layer 2 broadcast domains and subnets. A Layer 2 switch forwards frames within VLAN boundaries but does not route between subnets. Inter-VLAN communication requires a Layer 3 function, such as a router-on-a-stick subinterface or a multilayer switch SVI with routing enabled.

Interview Tip: Keep the phrase "switch forwards, router routes" in your answer.

Technical Answer: Router-on-a-stick uses one physical router interface configured as an 802.1Q trunk with multiple subinterfaces, one per VLAN. Each subinterface has encapsulation dot1Q and an IP address serving as default gateway for that VLAN. Traffic between VLANs enters the router, gets routed at Layer 3, and exits back out the same physical interface to the trunk.

Interview Tip: Mention this is functional but can become a throughput bottleneck at scale.

Technical Answer: DTP is a Cisco proprietary protocol used between switches to negotiate whether a link becomes a trunk. Modes include dynamic desirable, dynamic auto, trunk, access, and nonegotiate. It is useful in controlled Cisco-only environments but often disabled in hardened designs to avoid unintended trunk formation.

Interview Tip: Say that DTP is convenience-oriented but explicit static trunk config is safer.

Technical Answer: Dynamic desirable actively attempts to form a trunk, while dynamic auto passively waits for the other side to request trunking. Auto plus auto typically does not form a trunk. Desirable with auto usually forms a trunk. Operational behavior can differ if one side is hard-set to access or trunk.

Interview Tip: Use a pairing example like "desirable plus auto equals trunk" to show practical memory.

Technical Answer: switchport nonegotiate disables DTP frames on a port. It is typically used when trunk state is statically configured and negotiation is unnecessary, especially on links to non-Cisco devices or security-sensitive uplinks. If used, ensure both sides are manually configured correctly, since auto-negotiation assistance is removed.

Interview Tip: Emphasize explicit configuration discipline when negotiation is disabled.

Technical Answer: VLAN Trunking Protocol (VTP) distributes VLAN configuration information across switches in the same VTP domain over trunk links. It reduces repetitive manual VLAN creation on each switch. VTP includes advertisements containing revision numbers, and switches compare revisions to determine database updates.

Interview Tip: Mention both benefit and risk in one answer, centralized consistency versus blast radius.

Technical Answer: In VTP server mode, a switch can create, modify, and delete VLANs and advertise updates. In client mode, it cannot modify VLANs locally but learns updates from servers. In transparent mode, it does not apply received VTP updates to its own VLAN database in classic behavior, but can forward advertisements. VTP version and platform specifics should always be validated in production.

Interview Tip: Explain operational authority clearly: who can edit VLANs and who only listens.

Technical Answer: A switch with a higher VTP revision number can overwrite VLAN information in the domain if domain name/password/version align. Introducing a previously used switch without resetting revision can propagate stale or incorrect VLAN database entries, potentially removing active VLANs and causing widespread outages. Best practice includes resetting VTP state and validating before connecting to production trunks.

Interview Tip: Give a brief cautionary scenario, then explain the preventive checklist.

Technical Answer: VTP pruning reduces unnecessary flooded traffic for VLANs that have no active ports on downstream switches, helping optimize trunk bandwidth. It does not replace allowed VLAN configuration, and it does not block all VLAN traffic types universally. It mainly affects flooded traffic behavior and should be combined with explicit trunk design controls.

Interview Tip: Say "optimization feature, not a security boundary" to sound exact.

Technical Answer: Common commands include show vlan brief (VLAN and access-port membership), show interfaces trunk (trunk status, native VLAN, allowed VLANs), show interfaces switchport (per-port mode details), show vtp status (domain, mode, revision), and show dtp interface (if supported) for DTP negotiation details. For MAC learning context, show mac address-table is also useful.

Interview Tip: Group commands by purpose: VLAN database, trunk status, negotiation status, forwarding evidence.

Technical Answer: Symptoms may include intermittent inter-switch connectivity issues, control-plane warnings, and traffic appearing in wrong VLANs. Troubleshooting starts by checking both trunk ends for encapsulation, mode, native VLAN, and allowed VLAN list. Use show interfaces trunk and review logs for mismatch alerts. Correct by aligning native VLAN and trunk policies on both devices.

Interview Tip: Mention configuration parity checks first, not packet capture first.

Technical Answer: Use explicit access/trunk modes, restrict allowed VLANs, avoid user traffic on VLAN 1, use dedicated management VLANs, document VLAN ID purpose, and standardize trunk/native VLAN templates. Disable unused ports and place them in an unused VLAN. Use consistent naming and verification checks after changes. For environments not using VTP centrally, prefer transparent or off modes to limit unintended propagation.

Interview Tip: Present best practices as a repeatable deployment checklist to show operational maturity.

Technical Answer: STP (IEEE 802.1D) prevents Layer 2 loops by creating a loop-free logical topology while keeping physical redundancy. It elects a root bridge and blocks selected redundant paths. Without STP, flooded traffic (broadcast, unknown unicast, multicast) can circulate indefinitely, leading to broadcast storms, duplicate frames, and MAC address table flapping.

Interview Tip: Explain that STP is not optional in switched redundancy, it is the control-plane safety net.

Technical Answer: Bridge Protocol Data Units (BPDUs) are Layer 2 control frames exchanged by switches to build and maintain the spanning tree. They carry bridge ID, root ID, path cost, and timer information. Switches compare received BPDUs to determine best path to the root bridge and decide which ports forward or block.

Interview Tip: Say "BPDUs are STP control messages" first, then mention root ID and path cost fields.

Technical Answer: The root bridge is the switch with the lowest Bridge ID (BID). BID is composed of bridge priority plus MAC address. If priorities are equal, the lower MAC wins. Best practice is to set root bridge intentionally using lower priority values, for example on Cisco: spanning-tree vlan 10 root primary.

Interview Tip: Mention "lowest BID wins" and immediately add that production networks should never rely on default election.

Technical Answer: A root port is each non-root switch's best path toward the root bridge (one per switch). A designated port is the forwarding port for a segment with the best path from that segment toward the root. Non-designated ports are alternate redundant ports placed in blocking state in classic STP to prevent loops.

Interview Tip: Use "best path to root" as your anchor phrase for role explanation.

Technical Answer: Classic STP states are Blocking, Listening, Learning, Forwarding, and Disabled. In Listening, ports process BPDUs but do not learn MACs. In Learning, MAC learning starts but data forwarding still does not occur. Forwarding allows normal traffic. These staged transitions reduce loop risk but increase convergence time.

Interview Tip: Connect states to behavior: "when does it learn, when does it forward."

Technical Answer: RSTP (802.1w) accelerates convergence by redefining port roles/states and using handshake mechanisms (proposal/agreement) on point-to-point links. It replaces several legacy states with Discarding, Learning, and Forwarding. It also introduces alternate and backup roles to rapidly transition when failures occur, typically much faster than 802.1D timer-based behavior.

Interview Tip: Emphasize that RSTP is event-driven and handshake-oriented, not purely timer-driven.

Technical Answer: STP selects the path with the lowest cumulative root path cost. Cost is based on link bandwidth using standardized values, and total path cost is additive hop by hop. If costs tie, STP uses tie-breakers such as lowest upstream BID and then lowest port ID. You can inspect results with show spanning-tree.

Interview Tip: Describe the decision order: lowest cost first, then deterministic tie-breakers.

Technical Answer: In classic STP, Hello timer controls BPDU transmission interval (default 2 seconds), Max Age controls BPDU aging (default 20 seconds), and Forward Delay controls Listening/Learning duration (default 15 seconds each). These defaults contribute to slower convergence in 802.1D. RSTP reduces dependence on these long transitions for many scenarios.

Interview Tip: State defaults confidently, then note that manual timer tuning should be done carefully and consistently.

Technical Answer: PVST+ runs a separate STP instance per VLAN (Cisco), allowing per-VLAN root control but higher CPU/control overhead. Rapid PVST+ brings RSTP speed per VLAN. MST (802.1s) maps multiple VLANs into fewer spanning tree instances, reducing overhead while preserving design control. Large campus networks often use MST for scale.

Interview Tip: Explain tradeoff in one line: flexibility vs control-plane scale.

Technical Answer: PortFast allows access ports to transition quickly to forwarding, bypassing normal STP delay states. It is intended for edge ports connected to end hosts, not switch-to-switch links. Typical Cisco command: spanning-tree portfast on access interfaces. Misuse on transit links can create loops.

Interview Tip: Always pair PortFast with edge-host context and mention risk on inter-switch links.

Technical Answer: BPDU Guard protects edge ports by err-disabling a PortFast interface if a BPDU is received, indicating an unexpected switch connection. This prevents accidental or malicious topology influence from edge ports. On Cisco, it can be enabled globally for PortFast ports: spanning-tree portfast bpduguard default.

Interview Tip: Phrase it as "trust boundary for edge ports." That framing sounds operational and security-focused.

Technical Answer: Root Guard prevents a port from becoming a root port by blocking superior BPDUs on designated interfaces. If superior BPDUs are seen, the port enters root-inconsistent state until condition clears. This helps ensure access or distribution boundaries do not accidentally replace intended root bridge locations.

Interview Tip: Explain Root Guard as policy enforcement for "where root is allowed to exist."

Technical Answer: Loop Guard prevents non-designated ports from incorrectly moving to forwarding if expected BPDUs stop due to one-way failures. UDLD (Unidirectional Link Detection) actively detects one-way fiber/copper faults by exchanging protocol messages and can err-disable affected interfaces in aggressive mode. Together they reduce risk from partial link failures.

Interview Tip: Mention that physical link up does not guarantee bidirectional control-plane health.

Technical Answer: EtherChannel combines multiple physical links into one logical port-channel. STP treats the bundle as a single logical link, so member links do not get individually blocked for loop prevention. This increases aggregate bandwidth and resiliency. If one member fails, traffic continues over remaining links.

Interview Tip: Highlight both benefits together: active-active throughput and fault tolerance.

Technical Answer: LACP (IEEE 802.3ad/802.1AX) is standards-based and interoperable across vendors. PAgP is Cisco proprietary. Static "on" mode forms channel without negotiation, requiring exact manual parity on both ends. In LACP, active initiates, passive responds; active-active or active-passive forms channel, passive-passive does not.

Interview Tip: Recommend LACP by default in multi-vendor or future-proof designs.

Technical Answer: Member interfaces must match in speed, duplex, VLAN mode, allowed VLAN list, native VLAN, and trunk/access configuration. Protocol mode compatibility (LACP/PAgP/static) must also align. Mismatches can place links in suspended or standalone states. Verification commands include show etherchannel summary and show interfaces port-channel.

Interview Tip: Answer with "match all Layer 2 characteristics before bundling" to show disciplined implementation mindset.

Technical Answer: Traffic distribution uses a hash of selected header fields, such as source/destination MAC, IP, or Layer 4 port values depending on platform settings. A single flow usually stays on one member link, while multiple flows can distribute across members. Therefore, throughput gain is best with many conversations, not one elephant flow.

Interview Tip: State clearly that EtherChannel is flow-based load sharing, not per-packet striping in most enterprise switching.

Technical Answer: Storm control limits broadcast, multicast, and sometimes unknown unicast traffic rates on interfaces. When thresholds are exceeded, the switch can drop excess traffic and optionally generate logs/traps. This mitigates impact from loops, misbehaving hosts, or malware generating excessive flood traffic.

Interview Tip: Mention it as a mitigation control, not a replacement for correct STP and topology design.

Technical Answer: DHCP Snooping classifies ports as trusted/untrusted and builds binding tables from valid DHCP exchanges, blocking rogue DHCP server replies on untrusted ports. Dynamic ARP Inspection (DAI) uses those bindings to validate ARP packets and block spoofed ARP responses. Together they reduce man-in-the-middle and address-poisoning risks on access VLANs.

Interview Tip: Explain them as a pair: DHCP Snooping builds trust data, DAI enforces ARP integrity.

Technical Answer: IP Source Guard filters traffic on untrusted access ports based on DHCP Snooping bindings (IP/MAC/port mapping). It blocks packets with spoofed source IP addresses that do not match learned bindings. This feature is often deployed alongside Port Security, DHCP Snooping, and DAI to harden user-facing switchports.

Interview Tip: Present this as first-hop anti-spoofing tied directly to validated endpoint bindings.

Technical Answer: A router forwards packets between different IP networks using a routing table. It examines the destination IP address, performs longest prefix match, selects a next hop or exit interface, rewrites Layer 2 headers, and forwards the packet. Unlike switches, routers do not forward Layer 2 broadcasts by default.

Interview Tip: Start with "routers connect different subnets" and add longest prefix match for technical depth.

Technical Answer: Routers choose the most specific route, meaning the route with the longest prefix length. For example, if both 10.0.0.0/8 and 10.10.20.0/24 exist, traffic to 10.10.20.15 uses /24. If multiple routes have equal prefix length, selection can depend on administrative distance and metric.

Interview Tip: Use one clear example with /8 and /24 to demonstrate deterministic matching.

Technical Answer: A static route is a manually configured route that defines destination prefix and next hop or exit interface. Example Cisco command: ip route 192.168.50.0 255.255.255.0 10.0.0.2. Benefits include predictability, low overhead, and security control. Drawbacks include manual scaling and maintenance burden in large topologies.

Interview Tip: Explain where static routes are strong, branch stubs and internet edge defaults, not large dynamic cores.

Technical Answer: A static route can point to a next-hop IP, an exit interface, or both. Next-hop routes require recursive lookup to find how to reach the next hop. Exit-interface routes are common on point-to-point links. On multi-access Ethernet, next-hop form is often preferred to avoid excessive ARP behavior tied to interface-only routes.

Interview Tip: Mention "point-to-point versus multi-access" to show implementation awareness.

Technical Answer: A default route (0.0.0.0/0 in IPv4) matches any destination not found in the routing table. It is used to send unknown traffic toward an upstream router, commonly at branch or access layers. Cisco example: ip route 0.0.0.0 0.0.0.0 203.0.113.1.

Interview Tip: Describe it as the "last-resort path" for unknown destinations.

Technical Answer: Gateway of last resort refers to the next hop used by the default route. In Cisco show ip route output, it indicates where packets go when no specific route matches. If missing in a stub router, off-net traffic can fail even when local routes are correct.

Interview Tip: Tie this directly to default route presence and internet reachability checks.

Technical Answer: Administrative Distance is route source trust value; lower is preferred. Connected routes have AD 0, static routes usually AD 1, and dynamic protocols have higher defaults (for example OSPF 110). A static route generally overrides OSPF if prefixes are equal, unless static AD is raised for backup behavior.

Interview Tip: Use one sentence: "same prefix, lowest AD wins."

Technical Answer: A floating static route is a static route configured with higher AD so it stays inactive until the primary route fails. Example: ip route 192.168.10.0 255.255.255.0 10.1.1.2 200. This creates deterministic failover without running a dynamic protocol on all links.

Interview Tip: Emphasize that the route "floats" below the primary due to AD.

Technical Answer: Recursive lookup happens when a route points to a next-hop IP, and the router must find another route to reach that next-hop address. If that supporting route disappears, the dependent static route becomes unusable. This is why next-hop reachability and connected path validation are critical in static route troubleshooting.

Interview Tip: Explain it as "route to route" resolution before forwarding can happen.

Technical Answer: A static route to Null0 discards matching traffic. It is commonly used with summary routes so packets for unknown sub-prefixes inside the summary are safely dropped instead of looping. Example: ip route 10.10.0.0 255.255.0.0 Null0.

Interview Tip: Frame this as controlled discard for stability, not as accidental packet loss.

Technical Answer: VLANs are separate Layer 2 domains and usually separate IP subnets. Communication between VLANs requires a Layer 3 gateway that can route between those subnets. This can be done using router-on-a-stick or multilayer switch SVIs.

Interview Tip: Keep it direct: different VLAN means different subnet, so routing is mandatory.

Technical Answer: Configure switch uplink as trunk, then create router subinterfaces per VLAN with encapsulation dot1Q and gateway IPs. Example: interface g0/0.10, encapsulation dot1Q 10, ip address 192.168.10.1 255.255.255.0. Validate with show ip interface brief on router and show interfaces trunk on switch.

Interview Tip: Mention both sides, switch trunk plus router subinterfaces, to show end-to-end thinking.

Technical Answer: A multilayer switch creates Switch Virtual Interfaces for VLANs, assigns gateway IPs, and enables Layer 3 routing with ip routing. Hosts use SVI IP as default gateway. Traffic between VLANs is routed internally in hardware forwarding path, usually faster and simpler than external router-on-a-stick at scale.

Interview Tip: Compare it briefly to router-on-a-stick and mention performance and scalability benefits.

Technical Answer: Each VLAN subnet needs a gateway IP, commonly the first or last usable address, such as .1 or .254 by policy. Consistent standards improve operations and automation. Redundant gateways can use FHRPs like HSRP or VRRP, but the host still points to one virtual default gateway address.

Interview Tip: Mention consistency and redundancy together, it signals production design mindset.

Technical Answer: Use show ip route to view installed routes and route codes, show running-config | include ^ip route to view configured static routes, and show ip interface brief for interface status. For path tests, use ping and traceroute from the router with source options when needed.

Interview Tip: Give commands in a logical order: table, config, interfaces, active path tests.

Technical Answer: Asymmetric routing occurs when forward and return traffic use different paths due to route preferences or partial static entries. In stateful firewall environments, this can break sessions if return traffic bypasses expected inspection points. Good design uses consistent route policies, complete return routes, and validation with traceroute from both ends.

Interview Tip: Mention that asymmetry is not always wrong, but it must be intentional and compatible with security devices.

Technical Answer: Branch stubs often have one upstream path, so a default static route to HQ or ISP is simple and effective. Core side may add specific static routes back to branch subnets or use summarization. This reduces protocol complexity and control-plane overhead on small devices.

Interview Tip: Explain static routing as operationally efficient when topology is simple and predictable.

Technical Answer: IPv6 default route is ::/0. Cisco example: ipv6 route ::/0 2001:db8:100::1. It functions like IPv4 default route by matching destinations that lack more-specific IPv6 entries.

Interview Tip: State both notations quickly, 0.0.0.0/0 and ::/0, to show dual-stack readiness.

Technical Answer: A misconfigured static route can send traffic to a dead next hop or incorrect interface, creating a black hole. Symptoms include one-way reachability or total timeout despite link-up states. Troubleshoot using show ip route, next-hop reachability ping, interface status, and traceroute hop analysis.

Interview Tip: Explain that static routes do exactly what configured, so verification of intent versus config is critical.

Technical Answer: First confirm Layer 3 path between VLAN gateways, including SVI or subinterface status and IP routing enabled on multilayer switch. Then verify VLAN 30 gateway IP/mask, host default gateway correctness, and ACL policies that may block inter-VLAN traffic. On Cisco, use show ip interface brief, show run interface vlan 20, show run interface vlan 30, show ip route, and ACL checks.

Interview Tip: Present checks in sequence: gateway, routing, policy, endpoint config.