HireHire › Interview Quizzes › Network Engineer

Network Engineer Interview Questions

Think you're ready? These are the questions that actually decide Network Engineer interviews. Warm up on Easy — then face the Hard round, where 95% of candidates crumble. 30 questions across 3 levels, instant score, completely free.

30Questions
3Difficulty levels
95%Fail the hard round
FreeInstant score
Easy
Warm-up · 10 Qs
Medium
Practical · 10 Qs
Hard
Brutal · 10 Qs
⚡ Take the Network Engineer quiz — get your score →

The Network Engineer interview questions

Below are the real questions, grouped by difficulty. Expand any one to reveal the correct answer and why — or take the timed quiz for a score you can share. Can you clear the Hard round?

Easy round 10 questions

Which layer of the OSI model is responsible for logical addressing and routing of packets between networks?
  • A. Data Link layer (Layer 2)
  • B. Network layer (Layer 3) ✓
  • C. Transport layer (Layer 4)
  • D. Session layer (Layer 5)
Correct answer: B. The Network layer (Layer 3) handles logical addressing (IP) and routing packets across different networks.
What is the default subnet mask for a Class C IPv4 address?
  • A. 255.0.0.0
  • B. 255.255.0.0
  • C. 255.255.255.0 ✓
  • D. 255.255.255.255
Correct answer: C. Class C networks use a default /24 mask, which is 255.255.255.0.
How many usable host addresses are available in a subnet with the mask 255.255.255.192 (/26)?
  • A. 30
  • B. 62 ✓
  • C. 64
  • D. 126
Correct answer: B. A /26 has 64 addresses total minus the network and broadcast addresses, leaving 62 usable hosts.
Which protocol operates at the transport layer and provides reliable, connection-oriented delivery?
  • A. UDP
  • B. ICMP
  • C. TCP ✓
  • D. ARP
Correct answer: C. TCP is connection-oriented and guarantees reliable, ordered delivery using acknowledgments and retransmission.
In a switched network, what is the primary purpose of the Spanning Tree Protocol (STP)?
  • A. To load-balance traffic across all links equally
  • B. To prevent Layer 2 loops by blocking redundant paths ✓
  • C. To assign IP addresses dynamically to hosts
  • D. To encrypt frames between switches
Correct answer: B. STP prevents broadcast storms and loops by blocking redundant links while keeping a loop-free active topology.
Which command displays the routing table on a Cisco IOS router?
  • A. show ip route ✓
  • B. show running-config
  • C. show interfaces
  • D. show cdp neighbors
Correct answer: A. The 'show ip route' command displays the router's IP routing table with learned and connected routes.
What does a VLAN primarily provide in a switched LAN?
  • A. Automatic IP address assignment
  • B. Segmentation of a physical network into separate broadcast domains ✓
  • C. Encryption of all traffic on the switch
  • D. Faster physical link speeds
Correct answer: B. A VLAN logically segments a switch into multiple isolated broadcast domains, improving security and traffic management.
Which port number does HTTPS use by default?
  • A. 21
  • B. 80
  • C. 443 ✓
  • D. 8080
Correct answer: C. HTTPS (HTTP over TLS/SSL) uses TCP port 443 by default.
A user reports they can ping a server by IP address but not by its hostname. What is the most likely cause?
  • A. The default gateway is misconfigured
  • B. DNS resolution is failing ✓
  • C. The switch port is administratively shut down
  • D. The subnet mask is incorrect
Correct answer: B. Successful ping by IP but failure by name indicates the name-to-IP lookup (DNS) is not resolving correctly.
Which routing protocol is a link-state Interior Gateway Protocol that uses cost based on bandwidth?
  • A. RIP
  • B. OSPF ✓
  • C. BGP
  • D. EIGRP
Correct answer: B. OSPF is a link-state IGP that calculates the shortest path using a cost metric derived from interface bandwidth.

Medium round 10 questions

A host is configured with IP address 192.168.10.130/26. What is the network address of the subnet this host belongs to?
  • A. 192.168.10.0
  • B. 192.168.10.64
  • C. 192.168.10.128 ✓
  • D. 192.168.10.192
Correct answer: C. A /26 mask (255.255.255.192) creates subnets in blocks of 64, so 192.168.10.130 falls in the 192.168.10.128–191 range with a network address of 192.168.10.128.
A user reports they can reach websites by IP address but not by domain name. Which service is the most likely cause?
  • A. DHCP
  • B. DNS ✓
  • C. NAT
  • D. ARP
Correct answer: B. Being able to reach sites by IP but not by name indicates name resolution is failing, which is the job of DNS.
On a Cisco switch, you want an access port to immediately transition to forwarding for end devices while still protecting against accidental loops from another switch. Which combination is best practice?
  • A. PortFast with BPDU Guard ✓
  • B. Root Guard with UDLD
  • C. PortFast with Root Guard
  • D. BPDU Filter with Loop Guard
Correct answer: A. PortFast skips STP listening/learning for fast access-port convergence, and BPDU Guard err-disables the port if a switch (BPDU) is connected, preventing loops.
Which statement correctly describes the difference between TCP and UDP?
  • A. TCP is connectionless and UDP is connection-oriented
  • B. TCP provides guaranteed, ordered delivery with acknowledgments while UDP does not ✓
  • C. UDP guarantees delivery but TCP does not
  • D. TCP has lower overhead and latency than UDP
Correct answer: B. TCP is connection-oriented and provides reliable, ordered delivery via acknowledgments and retransmission, whereas UDP is connectionless with no delivery guarantees.
A VLAN 20 exists on two switches connected by a single link. Users in VLAN 20 on switch A cannot reach VLAN 20 users on switch B, though same-switch traffic works. What is the most likely issue?
  • A. The inter-switch link is an access port instead of a trunk carrying VLAN 20 ✓
  • B. VLAN 20 needs a separate default gateway on each switch
  • C. Spanning tree is disabled on VLAN 20
  • D. The hosts are using different subnet masks
Correct answer: A. Carrying multiple VLANs between switches requires a trunk link; if the interconnect is an access port, VLAN 20 tagged traffic won't pass between switches.
You run 'traceroute' to a remote host and see the first several hops respond, then all remaining hops show only asterisks (* * *) but the destination is actually reachable via other tests. What is the most common benign explanation?
  • A. The destination host is powered off
  • B. A device along the path is filtering/rate-limiting ICMP or the returning TTL-exceeded messages ✓
  • C. The local DNS server is down
  • D. The route has a loop causing infinite hops
Correct answer: B. Asterisks commonly appear when intermediate devices are configured to not respond to or rate-limit the ICMP/UDP probes or TTL-exceeded replies, even though traffic still forwards normally.
Which of the following is a private IPv4 address range as defined by RFC 1918?
  • A. 169.254.0.0/16
  • B. 172.16.0.0/12 ✓
  • C. 192.0.2.0/24
  • D. 198.51.100.0/24
Correct answer: B. 172.16.0.0/12 (172.16.0.0–172.31.255.255) is one of the three RFC 1918 private ranges; 169.254.0.0/16 is link-local and the others are documentation ranges.
Two devices on the same subnet cannot ping each other, but each can ping its own IP. Pinging the peer's IP populates the ARP table with an 'incomplete' entry. What does this most likely indicate?
  • A. A DNS misconfiguration
  • B. A Layer 2 connectivity problem (e.g., wrong VLAN, bad cable, or filtering) preventing ARP replies ✓
  • C. The default gateway is unreachable
  • D. A duplicate IP address on the subnet
Correct answer: B. An incomplete ARP entry means the ARP request went out but no reply returned, pointing to a Layer 2 reachability problem such as a VLAN mismatch, cabling, or port filtering.
In OSPF, what is the primary purpose of an area (such as area 0)?
  • A. To encrypt routing updates between neighbors
  • B. To limit the scope of link-state flooding and SPF recalculation for scalability ✓
  • C. To assign administrative distance to routes
  • D. To perform NAT between routing domains
Correct answer: B. OSPF areas segment the topology so link-state advertisements are flooded and SPF is recalculated within an area, improving scalability and reducing overhead.
A client boots up and receives an IP in the 169.254.x.x range with a 255.255.0.0 mask. What has most likely happened?
  • A. It was assigned a valid public IP by the ISP
  • B. It failed to reach a DHCP server and self-assigned an APIPA/link-local address ✓
  • C. It received a static IP from the administrator
  • D. Its subnet mask was misconfigured manually
Correct answer: B. A 169.254.x.x address is APIPA (link-local), automatically self-assigned when a DHCP client cannot obtain a lease from a DHCP server.

Hard round 10 questions

Two routers receive the same prefix 203.0.113.0/24 via eBGP. Router A learns it with LOCAL_PREF 100, AS_PATH length 2, MED 50; Router B learns it with LOCAL_PREF 100, AS_PATH length 3, MED 10. Both paths have identical weight (0) and no route-map sets weight. Which path is installed and why?
  • A. Router B's path, because its MED of 10 is lower and MED is compared before AS_PATH
  • B. Router A's path, because AS_PATH length 2 is shorter and AS_PATH is compared before MED ✓
  • C. Router B's path, because a shorter MED always overrides a longer AS_PATH in eBGP
  • D. Neither; BGP load-balances because LOCAL_PREF is tied
Correct answer: B. In the best-path algorithm AS_PATH length is evaluated well before MED, so the shorter AS_PATH (Router A) wins regardless of the lower MED.
A GRE-over-IPsec tunnel carries traffic fine for SSH and ping, but large HTTPS file downloads stall intermittently and TCP sessions hang. The physical path MTU is 1500 and ICMP 'fragmentation needed' messages are being dropped by an intermediate firewall. What is the most surgical fix on the tunnel routers?
  • A. Set 'ip tcp adjust-mss 1360' on the tunnel interfaces so the TCP handshake negotiates a smaller MSS ✓
  • B. Increase the tunnel interface MTU to 1500 to match the physical path
  • C. Enable 'ip route-cache' fast switching on the tunnel to speed up fragmentation
  • D. Disable PMTUD globally with 'no ip pmtu' so hosts stop sending DF-bit packets
Correct answer: A. Clamping MSS forces endpoints to negotiate a segment size that fits the reduced tunnel MTU, sidestepping the PMTUD black hole caused by the firewall dropping ICMP.
In an OSPF network you configure an area as totally stubby (area 10 stub no-summary on the ABR). A device inside area 10 needs to reach an external route redistributed from BGP elsewhere in the domain. How does routing to that external destination work from inside area 10?
  • A. It fails because totally stubby areas drop all traffic to external destinations
  • B. The ABR floods the Type 5 LSA into the area so the internal router has a specific route
  • C. The internal router follows the single default route (Type 3) injected by the ABR toward the ABR ✓
  • D. The internal router uses a Type 7 LSA translated into a Type 5 by the ABR
Correct answer: C. Totally stubby areas block Type 3, 4, and 5 LSAs and instead inject a single default route, so internal routers reach any external destination via that default toward the ABR.
During mutual redistribution between OSPF and EIGRP at two boundary routers, a route native to OSPF is redistributed into EIGRP at Router X, then re-redistributed back into OSPF at Router Y with a better metric than the original. What is the classic consequence and the standard prevention?
  • A. A routing loop or suboptimal path forms; prevent it by tagging routes on redistribution and filtering tagged routes from being redistributed back ✓
  • B. BGP synchronization kicks in; prevent it by disabling synchronization
  • C. OSPF SPF fails to converge; prevent it by raising the OSPF reference bandwidth
  • D. EIGRP goes stuck-in-active; prevent it by enabling stub routing on Router Y
Correct answer: A. Re-injecting a route back into its origin protocol with an artificially attractive metric creates loops/suboptimal paths, and route tags plus filtering are the canonical guard.
A BGP prefix is present in 'show ip bgp' marked valid but is NOT installed in the RIB and not advertised to peers. LOCAL_PREF and AS_PATH look fine. The most likely single cause is:
  • A. The prefix has a lower weight than a competing static route
  • B. The BGP next-hop is not reachable in the IGP/RIB, so the path is not marked best ✓
  • C. The neighbor is configured as a route reflector client
  • D. MED is set higher than the neighbor's advertised MED
Correct answer: B. BGP requires a resolvable next-hop; if next-hop reachability fails the path stays valid-but-not-best and is neither installed nor advertised.
Two data centers run an EVPN-VXLAN fabric with iBGP EVPN peering to route reflectors. A VM moves from leaf-1 to leaf-3. Which EVPN route type and mechanism ensures remote VTEPs update their forwarding for the moved MAC quickly?
  • A. Type 5 (IP prefix) route withdrawal triggers underlay reconvergence
  • B. Type 2 (MAC/IP advertisement) route with a higher MAC Mobility sequence number supersedes the old advertisement ✓
  • C. Type 3 (inclusive multicast) route re-election of the designated forwarder
  • D. Type 4 (Ethernet segment) route re-runs the DF election for the ESI
Correct answer: B. MAC mobility is signaled by a new Type 2 route carrying an incremented MAC Mobility Extended Community sequence number, which remote VTEPs prefer over the stale entry.
A stateful firewall sits between two routed segments. Users report that some flows work and others reset randomly. You discover the forward path traverses the firewall but the return path takes a different link that bypasses it, due to redistribution creating an equal-cost alternate. This is asymmetric routing. The cleanest structural fix is:
  • A. Enable the firewall's asymmetric-routing/loose-state mode and call it done
  • B. Lower the TCP keepalive timers on end hosts to survive the resets
  • C. Adjust routing (via metrics, filtering, or summarization) so forward and return traffic are symmetric through the firewall ✓
  • D. Disable connection tracking on the firewall so it forwards statelessly
Correct answer: C. Stateful inspection requires both directions to pass the same firewall, so the structural fix is to engineer symmetric routing rather than weaken the firewall's state enforcement.
You run 'show spanning-tree' and see a port in a designated-blocking state flapping under load, with intermittent unicast flooding of established flows. CAM/MAC aging is 300s but the STP topology-change-driven fast-aging (15s) keeps firing. What root cause best explains the flooding?
  • A. IGMP snooping is disabled, flooding multicast to all ports
  • B. Frequent STP topology changes shorten MAC aging so entries expire before refresh, causing unknown-unicast flooding ✓
  • C. The port is misconfigured as an access port in the wrong VLAN
  • D. LACP hashing is sending both directions of a flow down different member links
Correct answer: B. TCN-driven fast aging (15s) purges MAC entries faster than bidirectional traffic refreshes them, so the switch floods unknown unicast until it relearns.
In EIGRP DUAL, a router loses its successor for a route. It has a feasible successor whose reported distance is LESS than the router's current feasible distance. What happens?
  • A. The router sends a query to all neighbors and goes active on the route
  • B. The router installs the feasible successor immediately without going active, achieving fast local convergence ✓
  • C. The route goes stuck-in-active because the feasibility condition failed
  • D. DUAL recomputes the entire topology table via a full diffusing computation
Correct answer: B. A feasible successor satisfies the feasibility condition (RD < FD), so DUAL promotes it locally without a diffusing computation, avoiding the active state.
An MPLS L3VPN customer at two sites should reach each other but NOT a third site in the same VPN. All PEs import/export route-target 100:1. What is the correct way to enforce the hub-and-spoke-style isolation without new VRFs on the CE side?
  • A. Change the route distinguishers so the prefixes look unique
  • B. Assign distinct import/export route-target policies per VRF so only intended sites import each other's routes ✓
  • C. Filter with an outbound prefix-list on the PE-CE eBGP session only
  • D. Disable penultimate-hop popping on the P routers between the sites
Correct answer: B. Route targets (not RDs) govern which VRFs import which VPN routes, so tailoring import/export RT policy is how you build selective connectivity like hub-and-spoke.

Prep for another role

Finance / Accountant interviewSoftware Engineer interviewCloud Engineer interviewSolutions Architect interviewSAP Consultant interviewOperations / Ops Manager interviewEngineering Manager / Tech Lead interviewSales / Business Development interviewSecurity / Cybersecurity Engineer interviewDigital Marketing interviewExplore all jobs on the map →
Questions are original, written and independently verified for HireHire's role interview quizzes. They reflect the kind of knowledge Network Engineer interviews test, not any specific company's questions. HireHire maps live tech & IT jobs across India, updated regularly. Last updated: July 2026.