Technical Questions
Grouped by what the interviewer is actually testing. Answer, don't recite.
Fundamental "what is" questions
What is the OSI model?
"Seven layers that separate networking into independent concerns, so problems can be isolated to a layer: physical, data link, network, transport, session, presentation, application. In support I use it as a diagnostic order — cables and link lights at one, switch port and VLAN at two, IP and routing at three, ports and services above that. Knowing which layer a failure sits on tells me where to start."
What is a switch vs a router?
"A switch is layer two — it learns MAC addresses and forwards frames, giving each port its own collision domain but one shared broadcast domain. A router is layer three — it moves traffic between different networks by IP address, and each interface is a separate broadcast domain."
What is DNS?
"A distributed, cached, hierarchical naming system that translates hostnames into IP addresses. Clients query a resolver, which recursively walks root, TLD and authoritative servers, caching answers with a TTL. The record types that matter in support are A for hostnames, PTR for reverse lookups, SRV for service location in Active Directory, and MX for mail."
What is DHCP?
"The protocol that hands out IP configuration automatically — address, mask, gateway, DNS and lease. The handshake is DORA: Discover, Offer, Request, Acknowledge. In support the tell is a 169.254 address, which means the DHCP request failed and Windows self-assigned."
The ones that catch people out
What is the difference between a hub, switch and router?
See Network Fundamentals. Say it in terms of collision domains and broadcast domains — that is the vocabulary interviewers listen for.
What is NTFS vs share permissions?
"NTFS permissions are on the file system; share permissions are on the share. When both are set, Windows applies the more restrictive of the two. So a user who has Full Control in NTFS still only gets Read if that's their share permission."
What is Kerberos and why disable NTLM?
"Kerberos is AD's ticket-based authentication. The client gets a TGT from the KDC, then a service ticket per target server, so the password never crosses the network after logon. NTLM is an older protocol that sends challenge-response traffic vulnerable to relay attacks and pass-the-hash. Disabling NTLM removes that path — but only once Kerberos is confirmed working, or you lock everyone out."
Full backup vs incremental vs differential?
"A full backs up everything. An incremental backs up what changed since the last backup of any type, so restores need the whole chain. A differential backs up what changed since the last full, so restores need only two sets but the backup grows over time. Most production setups do a weekly full with daily differentials, and pair it with 3-2-1 and a tested restore."
What is RPO and RTO?
"RPO is the maximum amount of data loss you can tolerate, measured in time — if RPO is 15 minutes, backups need to run at least that often. RTO is how long you can be down before it becomes a business failure. RPO drives backup frequency; RTO drives how much you invest in replication and failover."
Why does a ping work but the service doesn't?
"Because ICMP and TCP are different things. Ping proves the host is reachable and responding. It says nothing about whether a port is open, whether TLS is valid, or whether the application is healthy. That's why I'd follow it with Test-NetConnection on the specific port, then curl to check the application itself."
Scenario questions — the highest-value section
'The user can't log in.'
"First I'd establish scope — one user or everyone, because everyone points at
the domain controller or the network. Then I'd ask for the exact error text.
From there: check whether the account is locked, disabled, or expired with
net user; if it's locked, unlock it and reset the password. If the error
mentions trust or domain, I'd check whether the machine can reach a DC with
nltest /dsgetdc. I'd also force a time resync, because clock skew over five
minutes breaks Kerberos. And I'd ask them to test on the LAN — if they can log
in offline, their credentials are cached and the account is fine."
'Nobody on the second floor has internet.'
"Scope says infrastructure rather than user, so I wouldn't touch a workstation yet. I'd check the switch uplink and whether the link is up, look for errors and flapping on the interface, and check whether it's one VLAN or the whole floor — that separates a switch problem from a DHCP relay or SVI problem. If it worked before and came back after about thirty seconds, that's spanning tree reconvergence and I'd look at what changed. I would not reboot the uplink, because that affects everyone and destroys the state that tells me what happened."
'It's really slow.'
"I'd ask slow compared to when — an always-slow machine is a spec issue, a
recently-slow one is a change. Then disk first, because it's the most common
cause: check free space with Get-Volume and health with Get-PhysicalDisk,
and look for disk events 7, 51 and 55. Then CPU and memory via Task Manager,
then Reliability Monitor to see if something has been failing repeatedly."
'How would you know your backups work?'
"By restoring one. A successful backup job only proves the job ran. I'd want the date of the last tested restore, restore to an isolated environment rather than production, and confirm the data is complete and the services start. That matters especially because the common ransomware pattern is to delete backups first — so backups on the same network as the server aren't a control at all."
Rapid-fire list
Have a one-line answer ready for each:
| Question | One-liner |
|---|---|
| What is a VLAN? | One switch split into separate broadcast domains. |
| What is a trunk port? | Carries several VLANs, tagged 802.1Q. |
| What is the native VLAN? | The one untagged VLAN on a trunk. |
| What is ARP? | Maps IP to MAC on the local segment. |
| What is a subnet mask? | Splits an address into network and host. |
| What is the default gateway? | Where traffic leaves the local subnet. |
| What is a broadcast? | A frame sent to every host on the subnet. |
| What is STP? | Prevents layer-two loops causing broadcast storms. |
| What is a snapshot? | Point-in-time state — not a backup. |
| What is BitLocker? | Full-disk encryption at rest. |
| What is SMB? | File and printer sharing, ports 445/139. |
| What is RDP? | Remote Desktop Protocol, port 3389. |
| What is a OU? | A container for applying Group Policy and delegation. |
| What is GPO inheritance? | Settings flow down; child OUs override parents. |
| What is a trust? | Authentication sharing between domains. |
| What is MFA? | A second factor beyond the password. |
| What is least privilege? | Minimum rights needed for the task. |
The two you must not waffle on
- "How do you troubleshoot a slow network?" — scope, then layer by layer with the right tool at each step.
- "Walk me through your approach to a ticket." — the eight steps in Methodology.