Top 50 Computer Networks Interview Questions with Answers (2026): Fresher to Network Engineer

A Computer Network is a system of interconnected computing devices that can exchange data and share resources with each other. These devices use a system of rules called communications protocols to transmit information over physical or wireless technologies.

💡 Why Interviewers Ask This: The baseline test. A strong candidate defines it by mentioning both “data exchange” and “resource sharing” (like printers or internet access), not just “computers talking to each other.”

💡 Why Interviewers Ask This: Foundational vocabulary. You cannot discuss complex routing or network design without knowing what a node is.

💡 Why Interviewers Ask This: Foundational scale knowledge. Interviewers expect you to know that the Internet is a WAN.

A Network Topology is the physical or logical arrangement of nodes and links in a computer network. It defines how different devices are connected and how data flows between them. Physical topology describes the actual wire/cable layout; logical topology describes how data actually travels through the network.

💡 Why Interviewers Ask This: Sets up the follow-up. You must know that physical and logical topologies can differ — a physical star topology can run a logical bus protocol.

💡 Why Interviewers Ask This: Interviewers want you to identify the Star topology as the most practical modern choice.

A MAC (Media Access Control) Address is a unique, 48-bit hardware identifier assigned to a Network Interface Card (NIC) by the manufacturer. It operates at the Data Link Layer (Layer 2) and is used for local communication within the same network segment. MAC addresses are typically permanent and do not change.

💡 Why Interviewers Ask This: You must distinguish between physical identity (MAC — Layer 2) and logical identity (IP — Layer 3). MAC addresses generally do not change; IP addresses do.

An IP (Internet Protocol) Address is a unique logical address assigned to every device connected to a network that uses the Internet Protocol. It operates at the Network Layer (Layer 3) and is used for global routing. Think of a MAC address as your name; an IP address is your mailing address that routes data across the world.

💡 Why Interviewers Ask This: The core of networking. The mailing address analogy is the expected explanation — it conveys both uniqueness and routing purpose.

The OSI (Open Systems Interconnection) Model is a conceptual framework that standardizes the functions of a computing system into seven distinct abstraction layers. It helps engineers troubleshoot networks by isolating problems to a single layer (e.g., “this is a Layer 3 routing problem, not a Layer 1 cable problem”).

💡 Why Interviewers Ask This: The holy grail of network interviews. If you cannot name all seven layers, you will likely fail the interview.

💡 Why Interviewers Ask This: Pure memorization test — but also conceptual. Practice the mnemonic until it is automatic.

The TCP/IP Model is a concise, 4-layer framework that forms the actual basis of the modern Internet. Unlike the theoretical OSI model, TCP/IP is a practical implementation. Its four layers are: Network Access, Internet, Transport, and Application.

💡 Why Interviewers Ask This: The OSI model is for textbooks; the TCP/IP model is what actually runs the internet. You must know both and their difference.

💡 Why Interviewers Ask This: Shows you can translate between theoretical concepts and real-world architecture. The 7-layer OSI collapses to 4 layers in practice.

A Router operates at Layer 3 (The Network Layer). It reads the logical IP addresses in data packets to determine the best path to forward traffic across different networks. The key rule: Layer 3 = Routers = IP Addresses.

💡 Why Interviewers Ask This: Hardware-to-layer mapping is heavily tested. Know this instantly: Routers = Layer 3, Switches = Layer 2, Hubs = Layer 1.

A standard Switch operates at Layer 2 (The Data Link Layer). It reads the physical MAC addresses in data frames to forward traffic only to the specific port where the destination device is connected — unlike a hub which broadcasts to every port.

💡 Why Interviewers Ask This: You must distinguish between a switch (Layer 2) and a hub (Layer 1). Mentioning Layer 3 Switches (which also route via IP) shows advanced expertise.

A Protocol is a standard set of rules and procedures that dictate how data is formatted, transmitted, and received across a computer network. It ensures that devices from different manufacturers can understand each other. Without protocols, an Apple device could not communicate with a Microsoft server.

💡 Why Interviewers Ask This: The conceptual foundation. Every specific networking question builds on understanding what a protocol is.

💡 Why Interviewers Ask This: The most frequently asked networking question. You must know their use cases immediately and not confuse TCP's reliability with slowness being a bug — it is intended.

💡 Why Interviewers Ask This: Tests deep Transport Layer knowledge. Understanding this is critical for explaining SYN Flood DDoS attacks — where attackers send millions of SYN packets without completing the handshake.

DNS is the phonebook of the Internet. It operates at the Application Layer and translates human-readable domain names (like google.com) into machine-readable IP addresses (like 142.250.190.46). Without DNS, you would have to memorize every website's IP address.

💡 Why Interviewers Ask This: Essential for web architecture. A strong candidate knows that DNS primarily uses UDP port 53 for speed, switching to TCP only for large responses.

DHCP automatically assigns IP addresses, subnet masks, and default gateways to devices when they join a network, eliminating manual static IP configuration. The process follows the DORA sequence: Discover → Offer → Request → Acknowledge.

💡 Why Interviewers Ask This: Practical IT infrastructure knowledge. Mentioning the DORA process by name guarantees a strong impression.

💡 Why Interviewers Ask This: Core web knowledge. You must know port 80 vs 443 and that HTTPS uses asymmetric encryption for the initial TLS handshake.

FTP is a standard network protocol for transferring files between a client and server. It uses two TCP connections: Port 21 for control commands and Port 20 for actual data transfer.

💡 Why Interviewers Ask This: Legacy protocol knowledge. Modern engineers should mention that plain FTP is insecure (transmits credentials in plain text) and SFTP (SSH File Transfer Protocol) should be used instead.

ICMP is a network layer protocol used by network devices to generate error messages and operational information about IP communication. It is not used to carry application data — only control messages. Tools like ping and traceroute work entirely using ICMP echo requests and echo replies.

💡 Why Interviewers Ask This: Tests diagnostic knowledge. If a firewall blocks ICMP, ping will fail even if the host is perfectly reachable via HTTP.

💡 Why Interviewers Ask This: IPv6 is the future. Engineers must know how its hex notation differs from IPv4 decimal notation and why the transition happened.

A Subnet Mask is a 32-bit number that divides an IP address into two parts: the Network Address and the Host Address. It tells a device whether a destination IP is on the local network (send directly) or needs to be sent to the default gateway (router). Example: 255.255.255.0 means the first 24 bits are the network, last 8 bits are for hosts.

💡 Why Interviewers Ask This: Tests routing logic. Subnet masks like 255.255.255.0 and CIDR notation like /24 are everywhere in IT and cloud configuration.

Subnetting is the practice of dividing a single large network into multiple smaller, manageable logical sub-networks. It improves network performance by reducing broadcast traffic, enhances security by isolating segments, and allows efficient use of IP address space. AWS VPCs and Azure VNets rely entirely on subnetting and CIDR notation.

💡 Why Interviewers Ask This: Crucial for Network Engineers and Cloud Architects. If you are working with cloud infrastructure, subnetting is a daily activity.

A Default Gateway is the router node on a computer network that serves as the forwarding host to other networks. If a computer wants to send data to an IP address outside its local subnet, it sends it to the default gateway first. If your computer has an IP address but cannot reach the internet, the default gateway is usually missing or incorrect.

💡 Why Interviewers Ask This: Basic troubleshooting knowledge. The default gateway is the first thing to check when internet connectivity fails.

💡 Why Interviewers Ask This: You must be able to identify the three private IP ranges immediately — they appear in every network config and cloud security group.

NAT is a process used by routers to map multiple private IP addresses inside a local network to a single public IP address before communicating with the Internet. It was the primary reason we did not exhaust IPv4 addresses in the 1990s. Without NAT, every device in your home would need a paid, unique public IP address from your ISP.

💡 Why Interviewers Ask This: Connects private IPs to public IPs. Understanding NAT shows you know how real home and enterprise networks function.

CIDR is a method for allocating IP addresses that replaces the older “Class A/B/C” system. It uses a slash notation (e.g., /24) to indicate exactly how many bits are used for the network portion. Example: 192.168.1.0/24 means 24 bits for the network → 256 possible addresses (254 usable hosts).

💡 Why Interviewers Ask This: Modern networking no longer uses IP classes. Cloud engineers configure CIDR blocks for VPCs (AWS) and VNets (Azure) every day.

Routing is the process of selecting the most optimal path across one or more networks for data packets to reach their final destination. It is performed by routers operating at Layer 3 of the OSI model, which read destination IP addresses and consult their routing tables to forward packets hop-by-hop toward the destination.

💡 Why Interviewers Ask This: Foundation of internet architecture. Every packet you send traverses multiple routers through this routing process.

A Routing Table is a data file stored in a router that lists routes to particular network destinations, along with metrics (cost/hop count) associated with each route. It is the “brain” of the router. If a destination network is not in the routing table, the router drops the packet (unless a default route is configured).

💡 Why Interviewers Ask This: Understanding the routing table is essential for debugging network outages and understanding how BGP mis-advertisements cause global internet disruptions.

💡 Why Interviewers Ask This: Tests network design trade-offs. Small office networks can use static routing; any large-scale infrastructure must use dynamic routing.

ARP maps a known logical IP address (Layer 3) to an unknown physical MAC address (Layer 2) on a local network. When a device wants to send data, it broadcasts an ARP Request (“Who has IP 192.168.1.5? Tell 192.168.1.1”). The owner of that IP replies with its MAC address. The result is cached in the ARP table.

💡 Why Interviewers Ask This: Tests the bridge between Layer 3 and Layer 2. Understanding ARP is also critical for cybersecurity: ARP Spoofing is a common Man-in-the-Middle attack technique.

💡 Why Interviewers Ask This: You must explicitly state that hubs are obsolete. Any modern network uses switches.

A VLAN is a logical grouping of devices on the same physical network configured to behave as if they are on separate, isolated LANs. Configured on switches to improve security and reduce broadcast domain size without extra hardware. Example: the HR department and the IT department share a physical building switch but are isolated using VLANs.

💡 Why Interviewers Ask This: Enterprise network design fundamentals. The HR/IT isolation example is the classic real-world use case.

A Broadcast Domain is a logical division of a computer network in which all nodes can reach each other by broadcast at the Data Link layer. Routers break up broadcast domains — a broadcast cannot cross a router. Switches do not break up broadcast domains (unless VLANs are used). An excessively large broadcast domain will cripple network performance.

💡 Why Interviewers Ask This: Tests understanding of network congestion. The key insight is that routers, not switches, separate broadcast domains.

BGP is the dynamic routing protocol that makes the Internet work. It is an exterior gateway protocol (EGP) designed to exchange routing and reachability information among Autonomous Systems (ISPs and large networks) on the internet. It is considered the “glue of the Internet.”

💡 Why Interviewers Ask This: Senior-level question. When Facebook went globally offline for 6 hours in October 2021, it was caused by a BGP configuration error that withdrew Facebook's own routes from the internet.

OSPF is a dynamic interior gateway routing protocol used within a single autonomous system (like a large corporate network). It uses the Dijkstra algorithm to calculate the absolute shortest path to all destinations based on link cost (bandwidth). It propagates link-state advertisements (LSAs) to build a complete topology map.

💡 Why Interviewers Ask This: The most common enterprise routing protocol. OSPF = internal routing; BGP = external routing between ISPs.

An Autonomous System is a large network or group of networks under a unified routing policy, managed by a single organization. Every AS is assigned an ASN (Autonomous System Number). Large ISPs, universities, and tech giants (Google, Cloudflare) each operate as their own Autonomous Systems. BGP routes traffic between ASes.

💡 Why Interviewers Ask This: Required knowledge for understanding how the global Internet is divided and managed at the highest level.

💡 Why Interviewers Ask This: Foundational for RESTful API development. Backend engineers must know how HTTP methods map to CRUD operations. PATCH (partial update) vs PUT (full replace) is a common follow-up.

💡 Why Interviewers Ask This: You must be able to classify errors: 4xx = the client's fault; 5xx = the server's fault. This is essential for web debugging and API development.

A Firewall is a network security device (hardware or software) that monitors and filters incoming and outgoing network traffic based on established security rules. It acts as a barrier between a trusted internal network and the untrusted Internet.

💡 Why Interviewers Ask This: Baseline security question. Strong candidates mention the difference: stateless firewalls (packet filtering — check each packet independently) vs. stateful firewalls (track active connections for context-aware filtering).

A VPN creates a secure, encrypted tunnel over a public network (the Internet) connecting a remote user or site to an internal private network. It masks the user's real IP address and secures all data in transit against interception. Common VPN protocols: IPsec, OpenVPN, WireGuard.

💡 Why Interviewers Ask This: Massive relevance for remote-work and cloud environments. Mentioning protocols like WireGuard (modern, fast, low-latency) vs. IPsec (legacy, enterprise-standard) shows depth.

💡 Why Interviewers Ask This: System design interviews frequently feature Reverse Proxies as the standard mechanism for scaling web applications and hiding backend topology.

A DDoS (Distributed Denial of Service) attack is a malicious attempt to disrupt normal traffic to a targeted server or network by overwhelming it with a flood of internet traffic from multiple compromised computer systems (a botnet). It targets the Availability dimension of the CIA triad.

💡 Why Interviewers Ask This: Tests availability awareness. Mitigations include CDN-level traffic scrubbing (Cloudflare, AWS Shield), rate limiting, and SYN cookies to resist SYN Flood attacks.

The Loopback Address (127.0.0.1 in IPv4, ::1 in IPv6) is a special reserved IP address used to test network communications on the local machine. Pinging 127.0.0.1 (also known as localhost) confirms that the computer's TCP/IP stack is correctly installed and functioning. Traffic never leaves the machine.

💡 Why Interviewers Ask This: Troubleshooting 101. Web developers access http://localhost:3000 to test locally — knowing why this works demonstrates foundational knowledge.

The ping command uses ICMP Echo Request and Echo Reply messages to test reachability of a host and measure the round-trip time (RTT/latency) for messages sent to that host. Sending ping google.com confirms: DNS is working, routing is working, and the remote host is responding.

💡 Why Interviewers Ask This: The most basic troubleshooting tool. Key insight: if ping fails but web browsing works, ICMP is being blocked by a firewall — not a network outage.

Traceroute is a network diagnostic tool that tracks the exact pathway (hop by hop) that a packet takes from source to destination, reporting the latency at each intermediate router. It uses ICMP TTL (Time to Live) decrements — each router decrements TTL by 1; when TTL = 0 it sends back an ICMP Time Exceeded message. (tracert is the Windows equivalent.)

💡 Why Interviewers Ask This: Proves you can diagnose network latency beyond “the internet is slow.” Showing where exactly packets die or slow down is a senior engineer skill.

QoS is a set of technologies that manage network resources by prioritizing certain types of traffic over others. For example, QoS can prioritize VoIP and video conferencing traffic over standard file downloads to prevent jitter and lag, even when the network is congested. It uses techniques like traffic shaping, queuing, and marking (DSCP).

💡 Why Interviewers Ask This: Enterprise network management. Network admins use QoS to ensure executive video calls don't drop during large file transfer operations.

A MitM attack occurs when a malicious actor secretly intercepts and potentially alters the communication between two parties who believe they are communicating directly with each other. Examples: ARP spoofing on a LAN, evil twin Wi-Fi hotspots. The primary mitigation is enforcing HTTPS/TLS encryption end-to-end.

💡 Why Interviewers Ask This: Cybersecurity fundamental. The correct technical answer for mitigation is TLS — not just “use a VPN.”

💡 Why Interviewers Ask This: You cannot configure firewalls, deploy applications, or debug connection issues without knowing standard port assignments. Ports 22, 80, 443, and 53 are the minimum to know.