Question 1

What is the TCP three-way handshake?

Accepted Answer

The TCP three-way handshake is the process used to establish a reliable connection between a client and a server. The client sends `SYN`, the server replies with `SYN-ACK`, and the client responds with `ACK`.

This matters because it sets up state on both sides before data is exchanged. In interviews, it is useful to mention that TCP provides ordered and reliable delivery, which is why this handshake exists in the first place.

Question 2

What is the difference between TCP and UDP?

Accepted Answer

TCP is connection-oriented and provides reliable, ordered delivery with retransmissions and flow control. UDP is connectionless and sends packets without guaranteeing delivery or order.

TCP is commonly used for web traffic, SSH, and databases where reliability matters. UDP is common in DNS, streaming, and latency-sensitive use cases where lower overhead is more important than guaranteed delivery.

Question 3

How do you troubleshoot DNS resolution issues?

Accepted Answer

I would use tools like `dig`, `nslookup`, or `host` to check the returned records, compare results from different resolvers, and inspect resolver configuration such as `/etc/resolv.conf`.

Good troubleshooting also checks whether the issue is with the record itself, caching, split-horizon DNS, network connectivity to the DNS server, or an application using stale or incorrect resolver behavior.

Question 4

What is the difference between HTTP and HTTPS?

Accepted Answer

HTTPS is HTTP layered over TLS, which adds encryption, integrity protection, and certificate-based identity validation.

The practical impact is that HTTPS helps prevent eavesdropping and tampering in transit. A good answer should mention that HTTPS is now the standard for almost all modern web traffic, not just login pages.

Question 5

What is NAT, and why is it used?

Accepted Answer

NAT, or Network Address Translation, maps one set of IP addresses to another, often translating many private internal addresses to one or more public addresses.

It is commonly used to conserve IPv4 address space and hide internal addressing. In cloud and enterprise environments, NAT is also part of how private subnets access the internet without exposing workloads directly.

Question 6

What is the difference between a public IP and a private IP?

Accepted Answer

A public IP is globally routable on the internet. A private IP is used within internal networks and is not directly routable on the public internet.

This distinction matters for network design, security, and access control. Private addressing is common for internal application tiers, while public exposure is usually limited to carefully controlled entry points.

Question 7

How do you verify whether a remote port is reachable?

Accepted Answer

You can use tools like `nc -vz host port`, `telnet`, `curl`, or `openssl s_client` depending on the protocol you are testing.

The important thing is to test the right layer. A reachable TCP port does not always mean the application protocol is healthy, so deeper checks are often needed after basic connectivity succeeds.

Question 8

What is the difference between stateful and stateless firewalls?

Accepted Answer

Stateful firewalls track the state of connections and can automatically allow return traffic for established sessions. Stateless firewalls evaluate each packet independently against rules.

Stateful filtering is generally easier for common application traffic, while stateless filtering can be useful in specific high-performance or tightly controlled environments. Good answers show you understand connection state, not just rule syntax.

Question 9

How does TLS certificate validation work at a high level?

Accepted Answer

The client validates that the certificate is signed by a trusted certificate authority, has not expired, matches the requested hostname, and forms a valid chain of trust.

This process helps confirm that the client is talking to the expected server and that traffic can be encrypted securely. Strong answers may also mention revocation considerations and certificate rotation.

Question 10

What is a subnet?

Accepted Answer

A subnet is a logical subdivision of an IP network. It defines a smaller address range and is used to organize routing, security controls, and network segmentation.

Subnets are important because they help separate workloads, reduce broadcast scope in traditional networks, and apply different routing or firewall policies based on environment or function.

Question 11

What are common causes of packet loss or latency in production?

Accepted Answer

Common causes include congestion, overloaded devices, bad cabling or interfaces, MTU mismatch, routing issues, firewall rate limits, or unstable upstream networks.

A strong answer should show that you would investigate systematically using interface statistics, path testing, application behavior, and recent network changes rather than assuming one root cause.

Question 12

How do you troubleshoot a service that users cannot reach?

Accepted Answer

I would first confirm whether the service is running and listening on the expected port, then check DNS resolution, client connectivity, routing, firewalls, security groups, reverse proxies, and TLS behavior.

The key idea is to troubleshoot layer by layer. Many networking incidents are resolved faster when you verify the path in order instead of jumping to conclusions about the application.

Question 13

What is the difference between IPv4 and IPv6?

Accepted Answer

IPv4 uses 32-bit addresses and is the older widely deployed internet addressing scheme. IPv6 uses 128-bit addresses and was designed to provide a much larger address space and other improvements.

In interviews, it helps to mention that IPv6 adoption is growing, especially in cloud and modern networking environments, even though many systems still operate heavily with IPv4.

Question 14

What is a default gateway?

Accepted Answer

A default gateway is the router a host uses to send traffic to destinations outside its local subnet.

If it is misconfigured, a machine may communicate locally but fail to reach remote systems. This is one of the basic but common causes of connectivity issues.

Question 15

What is the difference between a switch and a router?

Accepted Answer

A switch primarily forwards traffic within the same local network based on MAC addresses, while a router forwards traffic between different networks based on IP routing.

This is a foundational networking concept. Good answers show that you understand the roles of both devices in moving traffic through layered networks.

Question 16

What is DNS TTL?

Accepted Answer

TTL, or Time To Live, defines how long a DNS response may be cached before it should be refreshed.

TTL matters because it affects how quickly DNS changes propagate. A low TTL increases flexibility but can increase query load, while a high TTL improves caching but slows change propagation.

Question 17

What is the difference between forward and reverse DNS?

Accepted Answer

Forward DNS resolves a hostname to an IP address. Reverse DNS resolves an IP address back to a hostname.

Reverse DNS is often used in troubleshooting, mail systems, and some security checks. It is helpful to know both directions when debugging name resolution issues.

Question 18

What is the purpose of a subnet mask or CIDR range?

Accepted Answer

A subnet mask or CIDR range defines which part of an IP address represents the network and which part represents the host.

This is essential for understanding routing, address planning, and whether two systems are on the same network segment. Many networking questions become easier once CIDR is clear.

Question 19

What is ARP?

Accepted Answer

ARP, or Address Resolution Protocol, maps an IPv4 address to a MAC address on the local network.

It matters because local communication on Ethernet networks depends on that mapping. ARP issues can cause connectivity problems even when IP settings look correct.

Question 20

What is MTU mismatch?

Accepted Answer

MTU mismatch happens when devices on a network path expect different maximum packet sizes, which can lead to fragmentation or dropped packets.

It is a classic cause of confusing intermittent connectivity issues, especially with VPNs, tunnels, and cloud networking overlays. Good answers mention it in harder troubleshooting scenarios.

Question 21

What is the difference between SSL and TLS?

Accepted Answer

TLS is the modern protocol used for secure transport, while SSL is the older predecessor that is now deprecated in practice.

People often still say “SSL certificate,” but technically most modern secure web traffic uses TLS. Mentioning that distinction shows accuracy.

Question 22

What does a firewall actually do?

Accepted Answer

A firewall filters traffic based on rules such as source, destination, port, protocol, or connection state.

It is an access control layer, not a guarantee that the application behind it is secure. Strong answers explain both its role and its limits.

Question 23

What is a proxy server?

Accepted Answer

A proxy server acts as an intermediary between a client and another service. It can forward requests, enforce policy, cache content, or provide anonymity and control.

In DevOps and operations, reverse proxies are especially common for TLS termination, routing, and load distribution for web applications.

Question 24

What is the difference between latency and bandwidth?

Accepted Answer

Latency is the time it takes for data to travel from source to destination. Bandwidth is the amount of data that can be transferred over time.

This distinction matters because a slow network problem might come from high delay, low throughput, packet loss, or all three. They are related but not the same.

Question 25

What tools are commonly used for network troubleshooting?

Accepted Answer

Common tools include `ping`, `traceroute`, `mtr`, `dig`, `nslookup`, `curl`, `ss`, `tcpdump`, and `nc`.

The best answer is not just listing them, but knowing what each helps confirm. Strong troubleshooting often uses several tools together to isolate the failing layer.

Question 26

What is packet capture used for?

Accepted Answer

Packet capture records traffic on a network interface so you can inspect packets in detail, often with tools like `tcpdump` or Wireshark.

It is especially useful when higher-level checks are not enough and you need to see whether traffic is arriving, what protocol errors exist, or where handshakes fail.

Question 27

How do you secure network access to production systems?

Accepted Answer

I would limit exposure with firewalls, private networking, bastion or access proxy patterns, least-privilege rules, TLS, and strong identity-based access controls.

Good answers balance connectivity and security. Production networking should make the safe path the default while still supporting operational access when needed.

Question 28

What is the difference between ingress and egress traffic?

Accepted Answer

Ingress traffic is traffic entering a system or network, while egress traffic is traffic leaving it.

This distinction is common in firewall rules, cloud billing, and security policy design. It is a core networking term worth using precisely.

Question 29

Why is DNS often a hidden dependency?

Accepted Answer

Many systems depend on DNS for service discovery and connectivity, but teams sometimes focus only on the application and forget that name resolution problems can break everything above it.

Strong troubleshooting answers include DNS early because its failures often look like generic application outages.

Question 30

What is certificate expiration, and why does it matter operationally?

Accepted Answer

Certificate expiration means a TLS certificate is no longer valid after a certain date, which can cause clients to reject secure connections.

Operationally, this matters because expired certs can cause sudden outages. Mature teams monitor certificate validity and renew proactively.

Networking & Security Basics

1. What is the TCP three-way handshake?

2. What is the difference between TCP and UDP?

3. How do you troubleshoot DNS resolution issues?

4. What is the difference between HTTP and HTTPS?

5. What is NAT, and why is it used?

6. What is the difference between a public IP and a private IP?

7. How do you verify whether a remote port is reachable?

8. What is the difference between stateful and stateless firewalls?

9. How does TLS certificate validation work at a high level?

10. What is a subnet?

11. What are common causes of packet loss or latency in production?

12. How do you troubleshoot a service that users cannot reach?

13. What is the difference between IPv4 and IPv6?

14. What is a default gateway?

15. What is the difference between a switch and a router?

16. What is DNS TTL?

17. What is the difference between forward and reverse DNS?

18. What is the purpose of a subnet mask or CIDR range?

19. What is ARP?

20. What is MTU mismatch?

21. What is the difference between SSL and TLS?

22. What does a firewall actually do?

23. What is a proxy server?

24. What is the difference between latency and bandwidth?

25. What tools are commonly used for network troubleshooting?

26. What is packet capture used for?

27. How do you secure network access to production systems?

28. What is the difference between ingress and egress traffic?

29. Why is DNS often a hidden dependency?

30. What is certificate expiration, and why does it matter operationally?