Networking Interview Prep Part 2

Technical Answer: Dynamic routing protocols automatically discover, share, and adapt routes when topology changes. This reduces manual configuration overhead compared with static routes, especially in medium to large networks. They improve convergence and resiliency, but add control-plane complexity and require protocol design discipline.

Interview Tip: Explain tradeoff clearly: static is simple, dynamic is scalable and adaptive.

Technical Answer: OSPF is a link-state interior gateway protocol that uses the SPF algorithm (Dijkstra) to compute shortest paths. Its metric is cost, typically derived from interface bandwidth. OSPF packets are carried directly in IP using protocol number 89, not TCP or UDP ports.

Interview Tip: Mention "link-state plus SPF plus cost" in one concise sentence.

Technical Answer: Area 0 is the OSPF backbone and all non-backbone areas should connect to it, directly or through accepted design mechanisms. Inter-area routes are exchanged through the backbone by ABRs. If Area 0 continuity is broken, inter-area communication can fail.

Interview Tip: Say "Area 0 is the transit core for OSPF areas" to show architectural understanding.

Technical Answer: Common states include Down, Init, 2-Way, ExStart, Exchange, Loading, and Full. On broadcast networks, not all neighbors form Full with each other due to DR/BDR design; many remain 2-Way with non-DR peers. Full adjacency is expected with DR/BDR and on point-to-point links.

Interview Tip: Focus on where things fail most: neighbors stuck in ExStart/Exchange often indicate MTU or parameter mismatch.

Technical Answer: OSPF neighbors on the same segment must agree on key parameters, including Hello and Dead intervals. If these values differ, adjacency formation fails. Typical broadcast defaults are Hello 10 seconds and Dead 40 seconds, though values depend on network type and platform.

Interview Tip: Mention timers alongside area ID and authentication as the first mismatch checks.

Technical Answer: On broadcast and NBMA networks, DR and BDR reduce adjacency count and LSA exchange overhead. Instead of full mesh adjacencies between all routers, DROTHER routers form full adjacency primarily with DR and BDR. DR election is based on highest OSPF interface priority, then highest router ID as tie-breaker.

Interview Tip: Explain using scaling math: fewer adjacencies means less control traffic.

Technical Answer: OSPF Router ID is a 32-bit value selected by manual configuration first, then highest loopback IP, then highest active physical interface IP if not manually set. It uniquely identifies the router in OSPF LSDB and protocol operations. Changing router ID often requires process reset to take effect.

Interview Tip: Recommend manually setting router IDs for deterministic operations.

Technical Answer: In classic OSPF configuration, the network statement matches local interfaces by wildcard mask and enables OSPF on those interfaces, assigning them to an area. It does not simply advertise arbitrary remote networks. Example: network 10.10.10.0 0.0.0.255 area 0.

Interview Tip: Use the phrase "match interfaces, then advertise connected prefixes on those interfaces."

Technical Answer: OSPF interface cost is typically reference bandwidth divided by interface bandwidth. On Cisco, default reference bandwidth may be too low for modern high-speed links unless adjusted with auto-cost reference-bandwidth. You can also set per-interface cost directly using ip ospf cost for deterministic traffic engineering.

Interview Tip: Mention consistent reference bandwidth across all OSPF routers to avoid inconsistent path decisions.

Technical Answer: Core commands include show ip ospf neighbor, show ip ospf interface, show ip route ospf, and show ip protocols. For deep analysis, show ip ospf database confirms LSA visibility. Ping and traceroute validate data-plane outcome after control-plane checks.

Interview Tip: Present checks in order: neighbors, interfaces, LSDB/routes, then data-plane tests.

Technical Answer: EIGRP is an advanced distance-vector protocol using the DUAL algorithm for loop-free and rapid convergence behavior. It sends updates incrementally after initial exchange rather than periodic full table updates. EIGRP uses IP protocol number 88 and commonly multicasts to 224.0.0.10 for neighbor communication on IPv4.

Interview Tip: Emphasize DUAL and fast convergence with loop-free calculations.

Technical Answer: By default EIGRP metric uses minimum bandwidth along the path and cumulative delay. Reliability and load exist as optional components but are not used with default K-values. MTU is tracked but not part of metric calculation. Accurate interface bandwidth settings are therefore very important for predictable routing.

Interview Tip: Say "bandwidth and delay by default" first, then mention K-values.

Technical Answer: K-values determine which parameters contribute to EIGRP composite metric. If neighbors have mismatched K-values, adjacency will not form. In most deployments, defaults are used to avoid instability and incompatibility. Adjusting K-values is rare and should be done only with strong design justification.

Interview Tip: Mention adjacency failure on K-value mismatch, interviewers often look for that detail.

Technical Answer: Feasible Distance (FD) is the total best metric from the local router to a destination. Reported Distance (RD), also called Advertised Distance, is the metric a neighbor reports for that destination from its own perspective. EIGRP uses FD and RD comparisons to determine successor and feasible successor paths.

Interview Tip: Use local versus neighbor perspective to make the distinction easy.

Technical Answer: A route qualifies as feasible successor if the neighbor's RD is less than the local router's current FD to that destination. This feasibility condition ensures loop-free backup paths. If a feasible successor exists, failover is fast without active recomputation queries.

Interview Tip: Say "RD < current FD" exactly, then explain it provides prevalidated backup.

Technical Answer: passive-interface prevents routing hello packets on selected interfaces while still allowing connected networks on those interfaces to be advertised. This reduces unnecessary neighbor attempts and limits routing exposure on user-facing segments. It is a standard hardening and control-plane cleanup technique.

Interview Tip: Explain it as "advertise network, do not form neighbor there."

Technical Answer: OSPF is open standard, link-state, and common in multi-vendor environments; EIGRP is traditionally Cisco-centric though standards information exists. OSPF uses cost and LSDB with SPF calculations, while EIGRP uses DUAL with composite metric based on bandwidth and delay. Both converge well when designed correctly, but selection often depends on interoperability requirements and operational familiarity.

Interview Tip: Anchor your comparison around standards support, metric logic, and operational environment.

Technical Answer: Summarization reduces routing table size, decreases update volume, and limits failure-domain visibility. In OSPF, summarization is commonly done on ABRs/ASBRs. In EIGRP, summarization can be configured per interface. Good summaries improve convergence behavior and operational readability but must be aligned on contiguous boundaries.

Interview Tip: Mention both benefits and risk: wrong summary can black-hole traffic.

Technical Answer: First verify Layer 1 and Layer 2 status, then IP addressing and subnet match on both sides. For OSPF, validate area ID, timers, authentication, network type, and MTU. For EIGRP, validate AS number, K-values, and authentication if configured. Use show ip ospf neighbor or show ip eigrp neighbors, then inspect interface and protocol configs.

Interview Tip: Present as layers: physical, IP, protocol parameters, then route table impact.

Technical Answer: Full adjacency does not guarantee every prefix is present. Possible causes include missing network statement/interface enablement, passive interface behavior, area type filtering, route summarization mistakes, distribute-list or route filtering policies, or route not installed due to better AD/longest prefix from another source. Check show ip route, show ip ospf database, and running config for interface-to-area mapping.

Interview Tip: Explain that control-plane adjacency and prefix policy are separate verification steps.

Technical Answer: DHCP (Dynamic Host Configuration Protocol) automates IP configuration by providing IP address, subnet mask, default gateway, DNS servers, and other options to clients. Without DHCP, manual addressing does not scale and increases configuration errors. DHCP uses UDP ports 67 (server) and 68 (client) in IPv4.

Interview Tip: Start with business value: rapid onboarding and centralized address control.

Technical Answer: DORA stands for Discover, Offer, Request, Acknowledge. A client broadcasts DHCP Discover, server responds with Offer, client broadcasts Request selecting an offer, and server confirms with Acknowledge. If no ACK is received, address assignment is incomplete and client may retry.

Interview Tip: Explain each step with sender and receiver direction, then mention UDP 67/68.

Technical Answer: DHCP broadcasts do not cross Layer 3 boundaries by default. DHCP relay on the gateway interface forwards client DHCP messages as unicast to remote DHCP servers. On Cisco, this is typically configured with ip helper-address on SVIs or routed interfaces.

Interview Tip: Use the phrase "broadcast containment requires relay for central DHCP."

Technical Answer: A scope should define network/prefix, default gateway option, DNS servers, lease duration, exclusions, and reservations as needed. You should reserve static ranges for infrastructure devices and size scopes based on user counts and growth. Monitoring utilization is important to avoid lease exhaustion.

Interview Tip: Mention exclusions and reservations explicitly, interviewers look for those practical details.

Technical Answer: A client attempts renewal at T1 (typically 50 percent of lease time) by unicasting to the original DHCP server. At T2 (typically 87.5 percent), it may broadcast to any available DHCP server. If lease expires with no renewal, client must stop using that address and restart acquisition.

Interview Tip: Mention T1/T2 percentages to demonstrate protocol-level depth.

Technical Answer: NAT (Network Address Translation) modifies IP addressing information, typically translating private inside addresses to public outside addresses at an edge device. It conserves public IPv4 space and hides internal addressing structure. NAT can be static, dynamic, or port-based (PAT).

Interview Tip: Explain NAT as address translation at trust boundary, not encryption or firewalling by itself.

Technical Answer: PAT (Port Address Translation), also called NAT overload, maps many internal hosts to one or a few public IPs by differentiating sessions using Layer 4 source ports. One-to-one static NAT maps a single internal IP to a single external IP. PAT improves public IP utilization but relies on unique port mappings per session.

Interview Tip: Give one practical example: "hundreds of users share one ISP address via PAT."

Technical Answer: Static NAT is used when an internal service must be consistently reachable from external networks, such as web servers, mail gateways, or remote-access endpoints. It provides fixed mapping between inside local and inside global addresses. This predictability simplifies ACL and DNS records.

Interview Tip: Mention that static NAT is common for published services, not general outbound client traffic.

Technical Answer: Inside local is internal host address as seen inside network, often private. Inside global is translated address representing inside host to outside world, often public. Outside global is real external host address on outside network. Outside local is external host address as represented inside, often same as outside global unless additional translation occurs.

Interview Tip: Anchor explanation around one inside host and one internet server to keep terms clear.

Technical Answer: Common commands include show ip nat translations, show ip nat statistics, and show run | section nat. You should also verify inside/outside interface roles and ACLs used for NAT match rules. End-to-end tests with ping, traceroute, and application traffic confirm live translation behavior.

Interview Tip: Present checks in order: config intent, translation table, traffic test.

Technical Answer: DNS (Domain Name System) resolves hostnames to IP addresses and supports records like A, AAAA, CNAME, MX, and PTR. DNS primarily uses UDP port 53 for queries and responses, and TCP port 53 for zone transfers and larger responses when needed.

Interview Tip: Mention both UDP and TCP usage on port 53, interviewers check that detail.

Technical Answer: In recursive resolution, the DNS resolver returns a final answer to the client after performing all lookups. In iterative resolution, a DNS server returns the best referral it has, and the requester follows referrals to continue lookup. Enterprise clients typically use recursive resolvers, while authoritative infrastructure participates in iterative chain behavior.

Interview Tip: Explain from client perspective first, then server referral behavior.

Technical Answer: Important records include A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail exchange), NS (name server), TXT (policy/verification), PTR (reverse mapping), and SRV (service location). Knowing record purpose helps isolate resolution and application issues quickly.

Interview Tip: Group records by function: host resolution, mail, delegation, reverse lookup.

Technical Answer: TTL (Time To Live) defines how long resolvers cache DNS records before re-querying authoritative sources. High TTL reduces query load but slows change propagation; low TTL improves agility during migrations but increases query volume. Pre-change TTL planning is important before DNS cutovers.

Interview Tip: Mention lowering TTL ahead of planned migration windows as a practical best practice.

Technical Answer: NTP synchronizes system clocks across network devices and servers using UDP port 123. Accurate time is essential for log correlation, certificate validation, SIEM analysis, and forensic investigations. Unsynchronized clocks can make root cause analysis significantly harder.

Interview Tip: Tie NTP directly to incident response quality and compliance requirements.

Technical Answer: Stratum indicates distance from authoritative reference clock, where lower stratum is closer to source. Good practice uses redundant internal NTP servers synchronized to trusted upstream sources. Network devices should use internal servers where possible, with authentication and access controls for integrity.

Interview Tip: Mention redundancy and controlled hierarchy, not direct internet NTP on every device.

Technical Answer: SNMP (Simple Network Management Protocol) enables monitoring and management data exchange between network devices and management systems. SNMP uses UDP port 161 for queries and 162 for traps/informs. Versions include v1, v2c, and v3, with SNMPv3 preferred for authentication and encryption.

Interview Tip: Always recommend SNMPv3 in modern environments due to security improvements.

Technical Answer: OIDs (Object Identifiers) uniquely identify managed variables. MIBs (Management Information Bases) define structure and meaning of those objects. Traps/informs are unsolicited notifications sent by devices to management systems on events like link down. Polling and traps are usually combined for visibility.

Interview Tip: Explain SNMP as "poll for state, trap for events" for a concise, practical answer.

Technical Answer: SNMPv1/v2c use community strings and lack strong encryption/authentication, making them vulnerable to interception and misuse. SNMPv3 supports authentication (auth) and privacy encryption (priv), providing integrity and confidentiality. Access should also be restricted by ACLs and management-plane segmentation.

Interview Tip: Use layered answer: secure protocol version plus access control around it.

Technical Answer: First verify client IP, mask, gateway, and DNS assignment from DHCP scope/options. Next test reachability to gateway and internet IP (for example ping 8.8.8.8) to separate routing/NAT from DNS issues. Check NAT translations and outside interface state on edge router. If IP reachability works but names fail, test DNS queries directly to resolver and validate resolver reachability and records.

Interview Tip: Present triage sequence as dependency chain: addressing, path/NAT, then name resolution.

Technical Answer: An Access Control List (ACL) is an ordered set of permit or deny statements used to filter packets based on fields such as source IP, destination IP, protocol, and ports. ACLs are applied to interfaces in inbound or outbound direction, or to management lines such as VTY. They enforce security policy and can reduce unnecessary traffic.

Interview Tip: Define ACL as "ordered filtering logic" and mention first-match processing.

Technical Answer: ACL entries are processed top to bottom, first match wins. If a packet matches a statement, action is taken and evaluation stops. If no statement matches, implicit deny at the end drops the packet. This is why rule ordering and explicit permits are critical.

Interview Tip: Say clearly: "top-down, first match, implicit deny at the end."

Technical Answer: Standard ACLs filter based only on source IPv4 address. They do not inspect destination address or Layer 4 ports, so they are less granular than extended ACLs. Example command: access-list 10 permit 192.168.10.0 0.0.0.255. Traditional guidance places standard ACLs closer to destination.

Interview Tip: Mention source-only matching first, then placement rule near destination.

Technical Answer: Extended ACLs can match source and destination IP addresses, protocol types (IP, TCP, UDP, ICMP), and Layer 4 ports. This enables fine-grained control such as permitting HTTPS while denying Telnet. Example: access-list 101 permit tcp 10.1.0.0 0.0.255.255 any eq 443.

Interview Tip: Use an example policy to show practical value, not only definitions.

Technical Answer: In Cisco ACLs, wildcard mask 0 means must match, and 1 means ignore. It is inverse of subnet mask logic. Example: 192.168.1.0 0.0.0.255 matches /24 network. Host-specific match can be done with host 192.168.1.10, equivalent to wildcard 0.0.0.0.

Interview Tip: Explain wildcard as "match bits versus dont-care bits" and give one quick conversion.

Technical Answer: Standard ACLs are generally placed near destination because they only know source. Extended ACLs are generally placed near source to stop unwanted traffic early and save bandwidth. Real placement also considers operational risk, routing asymmetry, and existing policy architecture.

Interview Tip: Give the textbook rule first, then add that real designs account for topology and change control.

Technical Answer: Inbound ACL filters packets as they enter an interface before routing decision. Outbound ACL filters packets as they leave an interface after routing decision. Same ACL can behave very differently depending on direction and interface location.

Interview Tip: Draw traffic arrow on interface and map where filtering occurs.

Technical Answer: Numbered ACLs use numeric ranges (for example 1-99 standard, 100-199 extended in legacy style). Named ACLs use descriptive labels and support easier editing with sequence numbers. Named ACLs are generally preferred for operational clarity and change control.

Interview Tip: Recommend named ACLs in modern environments and explain why documentation quality improves.

Technical Answer: Sequence numbers allow insertion, deletion, and reordering of ACL entries without recreating entire ACL. This is useful for controlled changes and minimizes policy disruption. Example in named ACL mode: 15 permit tcp any any eq 443.

Interview Tip: Mention sequence numbers as a safer way to implement incremental policy updates.

Technical Answer: Appending log to ACL deny or permit entries can generate syslog messages when matches occur, for example deny ip any any log. This helps validate policy behavior and detect suspicious traffic. Logging should be used thoughtfully to avoid excessive control-plane overhead on busy links.

Interview Tip: Say "use logging for validation and security insight, but avoid noisy blanket logging in high-volume paths."

Technical Answer: A frequent mistake is forgetting explicit permit entries before the implicit deny, causing intended traffic to be dropped. Another common issue is applying ACL in wrong direction or wrong interface. Safe practice includes staged testing, comments/documentation, and rollback-ready change windows.

Interview Tip: Mention implicit deny and pre-change verification checklist in the same answer.

Technical Answer: Create a standard ACL permitting only trusted management subnets, then apply it to VTY lines with access-class. Example: access-list 50 permit 10.10.50.0 0.0.0.255; line vty 0 4; access-class 50 in. This limits who can initiate remote management sessions.

Interview Tip: Explain that data-plane ACL and management-plane ACL serve different control goals.

Technical Answer: Telnet uses TCP port 23 and transmits credentials and session data in clear text. SSH uses TCP port 22 and provides encrypted, integrity-protected remote shell access with key exchange and authentication. Modern best practice is to disable Telnet and use SSHv2 only.

Interview Tip: State the risk plainly: Telnet is clear text, SSH is encrypted and authenticated.

Technical Answer: Typical steps include setting hostname and ip domain-name, creating local username/secret, generating RSA keys, enabling SSHv2, and restricting VTY transport. Example commands: crypto key generate rsa modulus 2048, ip ssh version 2, line vty 0 4, transport input ssh, login local.

Interview Tip: Present as ordered build steps from identity to key generation to VTY hardening.

Technical Answer: Harden SSH by limiting source IPs with ACL on VTY, disabling password-only auth where possible, using strong secrets, enforcing timeouts and login retries, and centralizing authentication with AAA (TACACS+ or RADIUS). Also disable unused management services and monitor login events.

Interview Tip: Answer in layers: protocol choice, access restriction, authentication strength, monitoring.

Technical Answer: Port security limits MAC addresses allowed on a switch access port. It helps prevent unauthorized devices, simple MAC flood behavior, and accidental hub expansion at edge ports. It is configured on access interfaces and can use static or sticky learned MAC addresses.

Interview Tip: Explain it as access-layer identity control for endpoint attachment.

Technical Answer: protect drops violating frames silently. restrict drops violating frames and increments counters, often with notifications. shutdown places interface into err-disabled state on violation, requiring recovery action. Many enterprises prefer shutdown for strict enforcement, or restrict where continuity is prioritized with visibility.

Interview Tip: Compare response severity and logging behavior, not only names.

Technical Answer: Sticky MAC learns source MAC addresses dynamically on a secured port and converts them into running config secure entries. This simplifies rollout without manually typing each MAC address. Example commands: switchport port-security, switchport port-security maximum 2, switchport port-security mac-address sticky.

Interview Tip: Mention that sticky entries should be saved to startup config if persistence is required.

Technical Answer: Use show port-security, show port-security interface , and show running-config interface to verify state, learned MACs, violation count, and mode. If interface is err-disabled, check logs and recovery settings, then apply corrective action and recovery command sequence.

Interview Tip: State that validation includes both operational counters and configuration intent.

Technical Answer: First verify device reachability and TCP 22 path from management subnet. Then check VTY ACL access-class rules, line transport settings (transport input ssh), SSH key/version status, AAA/login configuration, and interface ACLs that may block port 22. Confirm source IP belongs to permitted management subnet and review logs for denied attempts.

Interview Tip: Break the answer into dependency checks: path, policy, service readiness, authentication.

Technical Answer: WAN technologies connect geographically distributed sites, cloud environments, data centers, and remote users. They provide controlled routing, security, segmentation, and service quality across long-distance links. Typical enterprise goals include resilient connectivity, predictable application performance, and secure internet and cloud access.

Interview Tip: Start with business outcomes, then map them to technical controls such as routing, encryption, and policy.

Technical Answer: MPLS provides private carrier-managed transport with QoS and predictable SLAs, often at higher cost. Internet WAN is lower cost and broadly available but less deterministic without overlay controls. Enterprises often combine both using SD-WAN overlays for policy-based path selection and resiliency.

Interview Tip: Present tradeoff clearly: predictability and SLA versus flexibility and cost.

Technical Answer: BGP is a path-vector routing protocol used to exchange routes between autonomous systems (AS). It is the protocol of the internet and also used in enterprise edge, data center, and cloud interconnect designs. BGP sessions use TCP port 179 for reliable route exchange.

Interview Tip: Say "BGP is policy-driven inter-domain routing" to show conceptual clarity.

Technical Answer: eBGP runs between different autonomous systems, while iBGP runs within the same AS. eBGP neighbors are typically directly connected unless multihop is configured. iBGP has split-horizon behavior requiring route reflectors or full mesh to propagate routes at scale.

Interview Tip: Mention route reflectors when describing scalable iBGP design.

Technical Answer: ASNs uniquely identify routing domains in BGP. Public ASNs are used for internet-facing routing, while private ASNs are often used internally and removed or rewritten at provider boundaries. Correct ASN planning is necessary for clean policy control and predictable AS_PATH behavior.

Interview Tip: Explain ASN as the identity label for policy decisions in BGP.

Technical Answer: Commonly discussed attributes include LOCAL_PREF (higher preferred inside AS), AS_PATH length (shorter preferred), and MED (lower preferred between certain neighboring AS paths). Other factors include origin, eBGP over iBGP, and next-hop reachability. Exact decision order depends on platform implementation, but policy attributes are key.

Interview Tip: Lead with LOCAL_PREF and AS_PATH to show enterprise policy awareness.

Technical Answer: In iBGP, learned eBGP routes may carry external next-hop addresses that internal routers cannot reach. The next-hop-self setting on iBGP speakers rewrites next hop to the advertising router, ensuring internal reachability. Without it, routes may appear in BGP table but fail in forwarding path.

Interview Tip: Explain that route learning and next-hop reachability are separate checks.

Technical Answer: Prefix lists filter which prefixes are permitted or denied. Route maps apply policy actions such as setting LOCAL_PREF, MED, communities, or AS path prepending. Together they control inbound and outbound routing behavior and reduce risk from accidental route leaks.

Interview Tip: Describe policy pipeline: match prefixes, then set attributes.

Technical Answer: Both peers need IP reachability, correct neighbor IP and remote-as configuration, TCP 179 accessibility, and compatible update source settings where loopbacks are used. If using authentication, keys must match. Common checks include show ip bgp summary and transport reachability tests.

Interview Tip: Present in layers: IP path, TCP 179, BGP parameters.

Technical Answer: Start with show ip bgp summary for neighbor states and prefixes received. Use show ip bgp for route table and attributes, show ip route bgp for installed routes, and show run | section bgp for policy intent. For session problems, use ping and traceroute to neighbor and validate ACL/firewall path to TCP 179.

Interview Tip: Keep command sequence consistent: neighbors, routes, policy, transport.

Technical Answer: Site-to-site VPN connects entire networks over untrusted transport using gateways at each side. Remote-access VPN connects individual users to corporate resources securely from external locations. Site-to-site is network-to-network, while remote-access is user-to-network with identity-centric controls.

Interview Tip: Explain from endpoint perspective: branch gateway versus individual user client.

Technical Answer: IPsec provides confidentiality, integrity, authentication, and anti-replay protection for IP traffic. IKE negotiation commonly uses UDP 500, and NAT traversal uses UDP 4500. ESP carries encrypted payloads using IP protocol 50, while AH uses protocol 51 but is less common in enterprise deployments.

Interview Tip: Mention UDP 500 and UDP 4500 immediately, then ESP protocol 50.

Technical Answer: IKEv2 offers improved efficiency, reliability, and support for modern authentication and mobility features compared with IKEv1. It simplifies negotiation and is generally easier to scale and troubleshoot in current enterprise environments. Most modern platforms and cloud VPN services recommend IKEv2.

Interview Tip: Keep answer concise: stronger operational behavior and better modern compatibility.

Technical Answer: SSL VPN (often TLS based) is common for remote users and browser or client-based access with simpler firewall traversal. IPsec VPN is common for full-tunnel site-to-site or robust remote-access clients requiring broad network reach. Choice depends on application model, endpoint control, and operational policy.

Interview Tip: Tie decision to user type: workforce remote users versus branch gateway links.

Technical Answer: GRE provides multiprotocol encapsulation and supports routing protocol carriage, while IPsec provides encryption and integrity. GRE over IPsec is used when you need dynamic routing across encrypted overlays. The tradeoff is additional overhead and MTU considerations.

Interview Tip: Explain each layer's role separately: GRE for transport flexibility, IPsec for security.

Technical Answer: DMVPN uses mGRE, NHRP, and IPsec to build scalable hub-and-spoke overlays with on-demand spoke-to-spoke tunnels. It reduces need for static full-mesh tunnel configuration while maintaining secure transport. It is useful for large branch networks requiring dynamic path flexibility.

Interview Tip: Mention mGRE plus NHRP plus IPsec as the core component trio.

Technical Answer: SD-WAN centralizes policy and path control across multiple transports such as MPLS, broadband, and LTE. It separates control and data planes with centralized orchestration and application-aware routing. Unlike static per-device configuration, SD-WAN applies intent-driven policies consistently across sites.

Interview Tip: Explain SD-WAN as centralized policy and transport abstraction, not just a new tunnel type.

Technical Answer: SD-WAN continuously measures path metrics such as latency, jitter, and loss and steers applications according to SLA policies. Real-time traffic can prefer low-jitter links, while bulk traffic can use lower-cost paths. If quality degrades, traffic can fail over dynamically without manual route changes.

Interview Tip: Map one app to one SLA policy example, such as voice on low-jitter path.

Technical Answer: Common patterns include IPsec VPN over internet and dedicated private circuits such as AWS Direct Connect or Azure ExpressRoute. BGP is often used for dynamic route exchange across these links. Strong design includes segmentation, route filtering, and redundant paths across zones or regions.

Interview Tip: Mention both quick-start VPN and dedicated circuit options with BGP policy control.

Technical Answer: First validate SD-WAN policy and path health metrics for the primary transport, including loss, latency, jitter thresholds, and application classification. Then check BGP route preference and NAT behavior on primary egress path, plus DNS resolution path for SaaS endpoints. Compare with fallback tunnel policy to identify misclassification, degraded underlay, or policy mismatch.

Interview Tip: Present this as control-plane, policy-plane, and data-plane checks in sequence.

Technical Answer: Use a structured flow: define scope and impact, verify recent changes, establish a baseline, test by layers, isolate fault domain, implement controlled fix, and validate recovery. Start with physical and interface health, then addressing and routing, then application dependencies like DNS. Document findings and timeline throughout.

Interview Tip: Present your process as a checklist and mention change control before remediation in production.

Technical Answer: Ping tests ICMP reachability and round-trip time between source and destination. Successful ping confirms basic Layer 3 path and return path for ICMP, but does not confirm application-specific ports, policy allowance for TCP/UDP, or full service health. Failed ping can be caused by ACL/firewall ICMP filtering, route issues, or host state.

Interview Tip: Say "ping is a signal, not proof of application health."

Technical Answer: Extended ping lets you define source interface/IP, packet size, timeout, and repeat count. This helps test specific VRF, VLAN gateway, or routed segment paths and validates return routing symmetry. On Cisco, extended ping is useful to confirm whether failures are source-dependent.

Interview Tip: Mention source-interface testing to demonstrate path-validation maturity.

Technical Answer: Traceroute sends probes with increasing TTL values to reveal each hop along a path via ICMP Time Exceeded responses. It helps locate where latency increases or packet loss starts. It does not always show true forwarding path in load-balanced networks and can be affected by ICMP rate-limits or policy filtering.

Interview Tip: Explain hop-by-hop visibility and call out control-plane filtering caveats.

Technical Answer: MTR combines traceroute and continuous ping, showing per-hop latency and loss over time. It is useful for identifying transient jitter/loss patterns and distinguishing consistent impairments from temporary spikes. A hop showing loss but downstream hops healthy may indicate ICMP de-prioritization at that hop, not transit packet loss.

Interview Tip: Highlight trend analysis over one-time snapshots.

Technical Answer: One-way success often indicates asymmetric routing, missing return route, stateful firewall path mismatch, ACL direction errors, or source-NAT inconsistencies. Verify forward and reverse route tables, security policy directions, and source addresses used during tests.

Interview Tip: State early that network paths are bidirectional dependencies, not single-direction checks.

Technical Answer: Test both name and IP directly. If ping or TCP connection to IP works but hostname fails, suspect DNS resolver, records, or reachability to DNS server. Use tools like nslookup/dig and verify UDP/TCP 53 path. If both fail, investigate core path, routing, ACL, and NAT.

Interview Tip: Describe this as a dependency chain: IP path first, name resolution second.

Technical Answer: Watch for CRC/FCS errors, input errors, output drops, late collisions, alignment errors, and interface flaps. Rising CRC with stable traffic can indicate cable/transceiver issues or duplex mismatch. Queue drops can indicate congestion and QoS tuning needs. Use show interfaces and time-correlated logs.

Interview Tip: Mention trend direction, increasing counters matter more than static historical values.

Technical Answer: ARP tables verify IP-to-MAC resolution and can expose duplicate IP or stale entry issues. MAC tables show where endpoints are learned and can reveal unexpected movement or loops. Use show ip arp and show mac address-table to confirm expected host placement and gateway resolution.

Interview Tip: Explain that unresolved ARP or unstable MAC learning often points to local-segment problems before routing.

Technical Answer: Check destination prefix presence, next-hop reachability, longest-prefix overlaps, default route correctness, and administrative distance interactions. Validate both forward and return routes on relevant devices. Commands include show ip route, show ip cef, and targeted traceroute.

Interview Tip: Say "no route, wrong route, or unreachable next hop" as your primary triage branches.

Technical Answer: Confirm interface and direction where ACL is applied, inspect rule order, and check for matching permit statements before implicit deny. Use ACL hit counters and optional logging entries to validate matching behavior. Correlate with source/destination/protocol/port of failing flow.

Interview Tip: Emphasize first-match logic and direction mistakes as top failure patterns.

Technical Answer: If NAT/PAT translations are missing, inside traffic may never be translated for outbound access. Verify NAT rules, inside/outside interface roles, ACL/object matches, and translation table entries using show ip nat translations and show ip nat statistics. Also validate return traffic and firewall policy.

Interview Tip: Explain that routing may be correct while translation policy still blocks effective connectivity.

Technical Answer: Baseline latency, jitter, packet loss, interface utilization, error rates, routing neighbor stability, and critical service response times. Also maintain normal path maps for key applications. During incidents, compare current metrics against baseline to identify anomaly location and magnitude.

Interview Tip: Mention that baselines convert "it feels slow" into measurable deviation.

Technical Answer: Access layer connects endpoints and enforces edge controls. Distribution layer aggregates access switches, applies policy, and performs inter-VLAN routing in many designs. Core layer provides high-speed, resilient transport between distribution blocks with minimal policy complexity. This hierarchy improves scalability and operations.

Interview Tip: Map each tier to a primary function in one sentence.

Technical Answer: Collapsed core combines core and distribution functions, often suitable for small to medium campuses where full three-tier design is unnecessary. It reduces cost and complexity while preserving structured hierarchy at smaller scale. As network size and east-west traffic grow, separation into full core and distribution can become preferable.

Interview Tip: Frame decision around scale, budget, and growth trajectory.

Technical Answer: Use redundant links and devices, dynamic routing with fast convergence, first-hop redundancy protocols (HSRP/VRRP), dual power paths, and diverse WAN transports. Add monitoring and tested failover runbooks. Resiliency requires both design redundancy and operational readiness.

Interview Tip: Mention that redundancy without tested failover is incomplete high availability.

Technical Answer: Pre-change: capture baseline metrics, confirm maintenance window, review rollback plan, and validate config syntax. Post-change: verify interface status, routing adjacencies, key application tests, and monitoring alarms. Document outcomes and close with stakeholder confirmation.

Interview Tip: Emphasize rollback preparedness as part of professional change discipline.

Technical Answer: Current diagrams and inventories provide path context, ownership mapping, and dependency visibility. During incidents, they reduce guesswork and prevent risky exploratory changes. Strong documentation includes logical and physical topology, IP plans, VLAN mapping, routing policy summary, and external circuit references.

Interview Tip: State that undocumented networks increase outage duration and change risk.

Technical Answer: Collect path metrics for latency, jitter, and packet loss during affected windows. Check WAN path selection, QoS marking/trust boundaries, queue drops, and codec bandwidth assumptions. Use continuous tests (MTR where possible), interface counters, and call-quality telemetry. Correlate issue timing with link utilization and policy changes.

Interview Tip: Lead with voice-sensitive metrics first, then discuss transport and QoS validation.

Technical Answer: Validate client IP/gateway/DNS in affected VLAN, then test local gateway reachability and external IP path. Compare successful VLAN traffic against failing VLAN to isolate policy differences. Review firewall rules, NAT policy, route tables, and DNS resolution for the cloud endpoint. Confirm whether update introduced ACL/object changes affecting source subnet, destination FQDN, or required ports.

Interview Tip: Present your plan as layered checkpoints with explicit evidence at each step before applying fixes.