Skip to content
Log in Sign up My account

Network Engineer Interview Prep

This article explains how network engineering interviews are usually structured, gives 30 technical questions with model answers across routing, switching, troubleshooting, design and automation, and covers the behavioural questions that decide close calls. The answers are short on purpose. In the room, give the short answer first, then expand if the interviewer wants more.

How the process usually runs

graph LR
    A["Recruiter screen"] --> B["Hiring manager call"]
    B --> C["Technical interview(s)"]
    C --> D["Practical or whiteboard"]
    D --> E["Behavioural / team fit"]
    E --> F["Offer"]
  • Recruiter screen: availability, location, compensation expectations, and a check for the required keywords. Keep it short and factual.
  • Hiring manager: your experience, what you want next, how you work. Prepare a two-minute summary of your last role.
  • Technical rounds: one or two engineers ask questions at increasing depth. Some roles add a lab or a troubleshooting scenario, and senior roles add a design discussion.
  • Practical: could be a take-home, a live lab, or a whiteboard of a network design. Talk through your reasoning, and state assumptions.
  • Behavioural: past incidents, conflict, handling pressure and communication.

Interviewers test depth by following up. If you say you know BGP, expect "walk me through best path selection" and then "what do you do when it picks the wrong path?". Only claim what you can defend.

How to answer

  1. State the direct answer in a sentence.
  2. Give the mechanism in a few more.
  3. Give an example from experience or a command you would use.
  4. If you do not know, say what you do know, and how you would find out.

Routing questions

1. How does OSPF elect a DR and BDR, and why? On broadcast and NBMA segments, OSPF elects a designated router to reduce adjacencies. Routers form full adjacencies only with the DR and BDR. Highest interface priority wins, then highest router ID. Election is non-preemptive, so a higher priority router joining later does not take over. Priority 0 means never eligible.

2. What are the OSPF LSA types you meet most often? Type 1 router LSA and type 2 network LSA within an area. Type 3 summary LSAs between areas. Type 5 external LSAs for redistributed routes, with type 4 describing the ASBR. Type 7 is used in NSSA and converted to type 5 at the ABR.

3. Explain BGP best path selection. In the common order: highest weight (Cisco), highest local preference, locally originated, shortest AS path, lowest origin code, lowest MED (for paths from the same neighbouring AS by default), eBGP over iBGP, lowest IGP metric to next hop, then tie-breakers such as oldest path, lowest router ID and lowest neighbour address. I would add that vendors differ slightly, so I check the platform's documentation.

4. What is the difference between iBGP and eBGP, and why does iBGP need a full mesh? eBGP is between different ASNs; iBGP is within one. iBGP does not prepend its own AS, so it cannot detect loops with the AS path. To avoid loops, a route learned from an iBGP peer is not advertised to another iBGP peer. That requires a full mesh, or route reflectors or confederations to reduce it.

5. How would you influence inbound traffic from the internet? Outbound is controlled with local preference. Inbound needs the other AS to cooperate: AS-path prepending, advertising more specific prefixes on the preferred link, MED (when honoured), and provider communities that set local preference on their side.

6. What is the difference between OSPF and EIGRP? OSPF is an open-standard link-state protocol with areas, and every router in an area has the same database and runs SPF. EIGRP is advanced distance-vector, using DUAL to compute loop-free paths, with feasible successors for fast backup. EIGRP is now documented in an RFC but is still mostly deployed on Cisco gear. I would choose OSPF or IS-IS in multi-vendor networks.

7. What does a route redistribution loop look like and how do you prevent it? Routes redistributed from protocol A into B, then back into A, can create loops and suboptimal paths, especially with two-way redistribution at multiple points. Prevent it with route tags and filters (deny routes carrying the tag when redistributing back), distribute lists or route maps, and consistent administrative distance. Keep the number of redistribution points small.

8. When would you use route summarization and what is the risk? At area or domain boundaries to shrink tables and contain instability. The risk is blackholing: if the summary stays advertised while a more specific route disappears, traffic can be sent toward a router that has no path. A discard route (null0) for the summary helps avoid loops.

Switching questions

9. How does spanning tree choose a root bridge and which ports forward? The lowest bridge ID (priority, then MAC) becomes root. Each non-root switch selects the root port with the lowest path cost to the root. Each segment has one designated port. The rest block. I set priorities explicitly so the root is predictable, not chosen by the lowest MAC.

10. What is the difference between STP, RSTP and MST? STP (802.1D) converges in tens of seconds. RSTP (802.1w) uses a proposal-agreement handshake and fast port roles, converging in seconds. MST (802.1s) maps VLANs to a small number of instances to reduce the load of per-VLAN STP while still allowing load balancing.

11. What are trunk, access and native VLAN? An access port carries one VLAN untagged. A trunk carries multiple VLANs with 802.1Q tags. The native VLAN is the one sent untagged on a trunk. Mismatched native VLANs cause errors and are a security concern, so I change the native VLAN to an unused one and prune allowed VLANs.

12. Explain EtherChannel and how it differs from a plain redundant link. EtherChannel bundles links into one logical link, so STP sees a single link and traffic is load balanced by a hash of header fields (MAC, IP, ports). LACP (802.3ad) negotiates the bundle. Per-flow hashing means one flow never exceeds one member's speed.

13. What is the purpose of VXLAN and how does EVPN relate to it? VXLAN encapsulates Layer 2 frames in UDP so Layer 2 segments can be extended over a routed Layer 3 underlay with a 24-bit VNI, beyond the 4094 VLAN limit. EVPN is the BGP control plane that distributes MAC and IP reachability between VTEPs, which replaces flood-and-learn.

14. What does a switch do when it receives a frame with an unknown destination MAC? It floods it out all ports in the VLAN except the one it arrived on. This is unknown unicast flooding. Large amounts of it can indicate MAC table overflow, an asymmetric path or a loop.

Troubleshooting questions

15. Users cannot reach a server. What is your approach? Define the scope first: one user, one subnet, or everyone? Then work up or down the layers. Check link and VLAN, then IP and gateway, then ARP, routing, ACLs and firewalls, then DNS and the application. Use ping, traceroute, show ip route, show arp and packet captures. I change one thing at a time and write down what I tried.

16. Ping works, but the application fails. What next? ICMP only proves basic IP reachability. I test the specific TCP or UDP port, check firewalls and ACLs, look for MTU problems (larger packets drop), check DNS, and look at the server's listening state and logs. A capture at both ends shows where packets stop.

17. An OSPF neighbour is stuck in EXSTART/EXCHANGE. What causes this? Usually an MTU mismatch between the two interfaces, so the large database descriptor packets are dropped. Other causes are duplicate router IDs and unicast reachability problems. I check show ip ospf neighbor, interface MTUs and debug output carefully.

18. A BGP session is in Active state. What do you check? Active means it is trying to connect and has not succeeded. Check reachability to the neighbour address, the correct source interface (update-source), the ASN and neighbour configuration on both sides, TCP port 179 not being blocked, authentication, and for eBGP multihop settings or TTL.

19. How do you troubleshoot intermittent packet loss? Check interface counters for errors, CRCs, drops and duplex or speed problems. Check the physical layer (optics levels, cabling). Look at queue drops and congestion. Run sustained pings or iperf in both directions at several packet sizes. Compare timestamps to events such as STP changes or flapping routes in the logs.

20. What is a typical cause of a network slowing down every day at the same time? A scheduled job, such as backups or replication, saturating a link; a loop or broadcast storm; a spike in DNS or authentication load. I look at utilisation graphs and flow data (NetFlow/IPFIX) around that time, and compare with a quiet period.

Design questions

21. How would you design a campus network? A layered approach: access, distribution and core, or a collapsed core for small sites. Routed access where possible to limit Layer 2 failure domains. Redundant uplinks and devices, VLANs scoped by building or closet, a defined IP plan with summarization points, QoS for voice and video, and segmentation for guest, IoT and management.

22. When do you choose a leaf-spine data centre fabric? When traffic is mostly east-west and you want predictable latency with equal-cost paths. Every leaf connects to every spine. Scale out by adding leaves or spines. Use BGP or OSPF for the underlay and EVPN-VXLAN for the overlay.

23. How would you design WAN connectivity for 100 branches? Dual transport at each site, such as MPLS or business internet plus broadband or LTE backup, with SD-WAN or DMVPN for overlay and application-aware path selection. Use central policy, local internet breakout for SaaS where security allows, and a hub design that scales. Plan the IP addressing and the hub redundancy first.

24. How do you design for high availability? Remove single points of failure at every layer: links, devices, power, paths, providers. Use protocols with fast detection (BFD), keep failure domains small, test failover, and make sure redundancy is not shared (the same conduit, the same power feed). Document the failure modes you accept.

25. How would you segment a network for security? By risk and function: users, servers, management, guest, IoT, and so on, using VLANs and VRFs, with firewalls or ACLs between zones. Apply least privilege between segments. In larger environments, use identity-based segmentation or microsegmentation. Start with the data flows, not with a diagram.

Automation questions

26. What network tasks would you automate first? Repetitive, low-risk tasks with clear outcomes: configuration backups, inventory collection, compliance checks, and read-only show command collection. Then standard changes such as VLAN creation or NTP and SNMP settings, with validation and rollback.

27. What is the difference between imperative and declarative automation? Imperative describes steps to run (a script that sends commands). Declarative describes the desired end state and the tool works out the changes (Terraform, many Ansible modules with state). Declarative tools are easier to run repeatedly because they are idempotent.

28. How do you use Python for network work? Netmiko or Scrapli for CLI over SSH, NAPALM for multi-vendor getters and config replace, requests for REST APIs, and ncclient for NETCONF. I keep devices in an inventory, store credentials in a vault or environment variables, and parse output into structured data (TextFSM, Genie) before acting on it.

29. What are NETCONF, RESTCONF and YANG? YANG is a data modelling language that defines the structure of configuration and state. NETCONF is an RPC protocol over SSH that uses XML to read and edit data defined by YANG, with candidate datastores and commit. RESTCONF exposes the same models over HTTP with JSON or XML.

30. How do you make automation safe in production? Keep code in Git with peer review, test in a lab or against virtual devices, use dry-run or diff modes, apply changes to a small group first, validate after each change, log everything, and have a rollback path. Limit the blast radius with scoped credentials and change windows.

Behavioural questions

Interviewers use these to judge judgment, ownership and communication. Prepare three or four real stories and adapt them. Use a simple structure: situation, task, action, result, and what you would change.

Common questions:

  • Tell me about the worst outage you worked on. What was your role, and what changed afterward?
  • Describe a time you disagreed with a colleague or manager about a technical decision.
  • Tell me about a change that went wrong. How did you recover?
  • How do you prioritize when several things break at once?
  • Describe how you explained a technical problem to a non-technical audience.
  • Tell me about something you automated or improved without being asked.
  • What did you learn recently, and how?

Tip

Choose stories where you did something concrete and name the specific action. "We fixed it" tells the interviewer nothing. "I rolled back the route-map change and then wrote a pre-change checklist" does.

Be honest about mistakes. Interviewers trust engineers who describe a failure, the cause and the fix, more than those who claim to have none.

Questions to ask them

  • What does a typical week look like for this role, and how much is project work vs. operations?
  • How are changes planned, reviewed and rolled back?
  • What does on-call look like, and how often?
  • What is the monitoring and automation maturity of the team?
  • What would success look like in the first six months?

Preparing

  • Re-read your own CV and be ready to explain every line.
  • Build a lab and practise the commands from the questions above. The CCNP lab setup page is a starting point.
  • Practise whiteboard explanations out loud. Explaining a concept to someone else shows gaps quickly.
  • Use the CCNP study plan to fill topic gaps systematically.
  • Prepare for the salary question before the first call; see Salary Negotiation for Network Engineers.

References