All jobs / IT support / sysadmin
Networking interview questions
Networking questions a IT support / sysadmin can be asked, from first job to senior. Open one to see the strongest answer and why it works.
A laptop that cannot reach anything has the address 169.254.12.40. What does that tell you?
The strongest answer: It gave itself a link-local address because no DHCP server answered — so I check the cable or the wireless association, the switch port, and whether anyone else on that segment is failing too
Why it works: Right — that range is the machine saying nobody answered, which points you at the path between it and the DHCP server.
- That range means DHCP never answered.
- Check cable, wireless, switch port.
- Ask whether others are failing too.
- Do not paper over it with a static.
“The internet is down” on one laptop. Where do you start?
The strongest answer: Whether others are down, then cable/Wi-Fi toggle, IP, and a known site — not a full OS reinstall
Why it works: Exactly. Scope, then the path, then a known test. Reimage is last.
- Scope: one person or many.
- Then link, address, known site.
- Reimage last.
- Do not close on a guess.
A laptop works on a cable and fails on Wi-Fi. What have you learned?
The strongest answer: The machine can network; the wireless path (radio, profile, AP, or policy) is the suspect — I do not reimage first
Why it works: Exactly. A working path splits the problem. That is the job.
- A working cable splits the fault.
- Suspect the wireless path.
- Do not reimage first.
- Do not break the working path.
A PC can reach its neighbours but nothing outside its own network. What do the subnet mask and the default gateway each do here?
The strongest answer: The mask tells the machine which addresses count as local; anything else it hands to the default gateway. A missing or wrong gateway, or a mask that is too narrow or too wide, gives exactly this symptom
Why it works: Exactly. Local versus not-local is a mask decision, and everything not-local depends on the gateway being right.
- The mask decides local or not.
- Not-local goes to the gateway.
- Check both, not just the gateway.
- Naming is not a routing fix.
A “small” DHCP change in the afternoon. Why might you still wait?
The strongest answer: Because small is how big outages introduce themselves — I use the window unless there is a real emergency and a named owner
Why it works: Exactly. Windows exist because afternoon DHCP pages everyone. Emergencies have names.
- Use the change window.
- Emergencies have owners.
- Do not “small” DHCP at 15:00.
- Do not change while the owner is out.
Users say “the VPN is slow” while only one app crawls. What do you check?
The strongest answer: Whether that app’s traffic is hauled through the tunnel and whether a split or a closer egress would be honest — I do not add RAM to the laptop first
Why it works: Exactly. Path first. Laptops are not the WAN.
- Check what the tunnel hauls.
- Split or egress on purpose.
- Do not start with more RAM.
- Do not disable VPN as a speed hack.
“The portal is down” but a raw IP works. Your line?
The strongest answer: Name resolution — client DNS, cache, and the record — I do not rebuild the portal on a hunch
Why it works: Exactly. IP works, name fails: DNS. Farms and forever-IPs are how you make a second problem.
- IP works ⇒ think DNS.
- Check client, cache, record.
- Do not farm-reboot first.
- Do not flush the world as step one.
You want printers and guest wireless off the staff network. What does a VLAN actually give you, and what do you still have to arrange?
The strongest answer: A VLAN is a separate broadcast domain, so nothing on it reaches the staff network unless something routes between them — so I need a routed interface, a rule allowing only the print traffic, and addressing for the segment
Why it works: Exactly. Separation is the easy half; the interesting half is the deliberate hole you open back through it.
- A VLAN is a broadcast domain.
- Separation needs routing to cross.
- Allow only the traffic that is needed.
- Plan addressing for the new segment.
VPN concentrator CPU is ugly every Monday at 09:05. What do you do besides “ask people to come later”?
The strongest answer: Measure, add capacity or split traffic, and say what will still hurt — do not moralise the morning
Why it works: Exactly. Capacity is a design. Posters and calmer charts are not extra tunnels.
- Measure and add or split.
- Say the leftover pain.
- Do not moralise Mondays.
- Do not hide load in timeouts.
RDP and SSH to servers from the internet. 2026 default?
The strongest answer: No — jump through a controlled path, MFA, and recorded access; exposed admin ports are a hobby for scanners
Why it works: Exactly. Admin is a privileged path, not a public one. Ports and long passwords are not a posture.
- No public RDP/SSH.
- Jump host + MFA + record.
- Port tricks ≠ security.
- Vendors do not justify exposure.
One AP is sad; the floor is sad. What do you not do?
The strongest answer: I do not factory-reset the controller to “refresh” a single AP — I check that AP, its power, and its neighbours first
Why it works: Exactly. Scope the AP. Controller theatre is a building event.
- Scope the AP first.
- Do not reset the controller for one radio.
- Do not churn the SSID as a fix.
- Hiding the SSID is not a repair.
The perimeter firewall has grown to several hundred rules over a decade. A quarter are “any” on one side and nobody knows who asked for them.
What do you do, and what do you refuse to do?
The strongest answer: Give every rule an owner, a reason and a review date, use hit counts to find the dead ones, and retire those first — I refuse a big-bang rewrite, because a wrong removal is an outage nobody can trace
Why it works: Right — ownership and evidence first. Rules die safely when you can prove nothing uses them and someone has agreed.
- Retire by evidence, not by instinct.
- Every rule gets an owner and a reason.
- Hit counts find the dead ones first.
- No big-bang rewrite in one window.