Interview prep · 8 questions
DHCP, DNS and ARP interview questions
What do interviewers test with DHCP, DNS and ARP questions?
They test the services every host depends on before it can send a single useful packet: getting an address, resolving names, and finding the next hop's MAC address. The famous "what happens when you open a website" question is really a tour of all three.
Updated
Mock interview
One question at a time. Answer it out loud as you would in the room, then reveal the model answer and rate yourself honestly. Your progress stays in this browser.
How does a host get its address from DHCP?
Entry level
It runs the four-step DORA exchange: the client broadcasts a Discover, a server answers with an Offer, the client broadcasts a Request for that offer, and the server confirms with an Acknowledge. The address is leased, not owned, so the client renews it, normally at half the lease time.
The Request is broadcast on purpose: it tells every server that answered which offer the client took, so the others can release the addresses they held.
Along with the address and mask, the server usually hands out the default gateway, the DNS servers and the lease time.
Common weak answer: Getting the order wrong, or saying the client sends a unicast Discover. It has no address yet, so its first messages are broadcasts.
Likely follow-ups
- What happens when the lease runs out and the server is down?
- Why is the Request broadcast?
- Which settings besides the address does DHCP hand out?
Why doesn't DHCP work across a router by default, and how do you fix it?
Mid level
The client's Discover is a broadcast, and routers do not forward broadcasts, so a server on another subnet never hears it. You configure a DHCP relay on the router interface facing the clients, which forwards the request to the server as unicast and tells it which subnet the request came from.
The relay writes its own interface address into the request, and the server uses that address to pick the right pool. A relay pointing at the wrong server, or a server with no pool for that subnet, gives the same symptom: no lease.
The relay goes on the clients' gateway interface, not on the server's.
Common weak answer: Putting a DHCP server on every subnet as the only fix. It works, but it is the expensive answer.
Likely follow-ups
- Which interface gets the helper address?
- How does the server pick the pool for a relayed request?
- What does the server need in order to reply to the client's subnet?
A client shows a 169.254.x.x address. What does that tell you, and what do you check?
Entry level
It means the client asked for an address by DHCP, heard no answer, and gave itself a link-local address that only works on its own segment. Check the cable and switch port, the client's VLAN, the relay on the gateway if the server is remote, and whether the server's pool for that subnet has addresses left.
The address proves the client's request went out; the failure is somewhere between the client and the server, or in the server's pool.
Many clients at once points at the server or the relay; one client alone points at that client's port or VLAN.
Common weak answer: Calling it an IP conflict. A 169.254 address is the client's own fallback, not a duplicate.
Likely follow-ups
- What would you check first if only one client is affected?
- How would you renew the lease from the client?
- What does a full pool look like on the server?
How does ARP work, and whose MAC address does a host look up for a remote destination?
Entry level
ARP finds the MAC address for an IP address on the local segment: the host broadcasts "who has this address", the owner replies directly, and the answer is cached. For a destination on another subnet the host never ARPs for the destination itself; it ARPs for its default gateway and sends the frame there.
So the destination MAC address in a frame changes at every router hop, while the destination IP address stays the same end to end unless NAT rewrites it.
A stale or forged ARP entry sends traffic to the wrong MAC address, which is why ARP spoofing is a classic attack inside a LAN.
Common weak answer: Saying the host ARPs for the remote server's MAC address. A MAC address only means something on the local segment.
Likely follow-ups
- What does a gratuitous ARP do?
- How would you clear a bad ARP entry?
- How is a switch's MAC address table different from a host's ARP table?
What is the difference between a MAC address and an IP address?
Entry level
A MAC address is the 48-bit hardware address of a network interface, used to deliver frames on the local segment. An IP address is a logical address set by configuration or DHCP, used to route packets between networks, and it tells you which subnet the host belongs to.
The first half of a MAC address identifies the interface's manufacturer, which is how a lookup tool can name the maker of an unknown device.
On the way across a network, routers rewrite the frame's MAC addresses at every hop and leave the IP addresses alone.
Common weak answer: Saying a MAC address is used to reach hosts across the internet. It never leaves the local segment.
Likely follow-ups
- Which layer does each address belong to?
- Can two devices share a MAC address?
- Which addresses change when a packet crosses a router?
What happens, step by step, when you type a website address into a browser and press Enter?
Mid level
The name is resolved to an IP address through DNS, the host sees that the server is remote and ARPs for its default gateway, then it opens a TCP connection to port 443 with the three-way handshake. TLS sets up encryption, the browser sends an HTTP request, and the server's response is rendered as the page.
DNS has steps of its own: local caches first, then the configured resolver, which may ask the root servers, the top-level domain's servers and finally the domain's authoritative server.
Every router on the way rewrites the frame's MAC addresses and decrements the TTL; if the host sits behind NAT, the edge router also rewrites the source address and port.
Common weak answer: Describing only what the browser does. Interviewers want DNS, ARP for the gateway, TCP and then the request, in the right order.
Likely follow-ups
- Where can the DNS answer come from without leaving the host?
- What changes if the site uses plain HTTP?
- Where would you look if the name resolves but the page never loads?
Which DNS record types should you know, and what does each do?
Entry level
A maps a name to an IPv4 address and AAAA to an IPv6 address, CNAME makes one name an alias of another, MX names a domain's mail servers, and PTR maps an address back to a name. NS lists a zone's name servers, SOA holds the zone's settings, TXT carries text such as mail policies, and SRV points to a service's host and port.
A CNAME cannot sit at the top of a domain alongside its other records, which is why some providers offer special alias records for the root.
A record's TTL decides how long resolvers cache it, so lowering the TTL a day before a migration lets the change take effect quickly.
Common weak answer: Saying an MX record holds an IP address. It holds a host name, which needs its own A or AAAA record.
Likely follow-ups
- What is a reverse lookup used for?
- Why would you lower a TTL before a change?
- What is the difference between a recursive resolver and an authoritative server?
Why does DNS use both UDP and TCP?
Mid level
Ordinary queries use UDP on port 53 because one small question and one small answer need no connection. TCP on port 53 is used for zone transfers between servers and whenever an answer is too large for a UDP response, which the server signals by marking the reply as truncated.
Blocking TCP 53 "because DNS is UDP" is a classic firewall mistake: everything works until a large answer or a zone transfer is needed.
Encrypted DNS runs over other ports and transports, which matters when a network wants to control which resolvers its hosts use.
Common weak answer: Saying DNS is UDP only. That rule breaks large answers and zone transfers.
Likely follow-ups
- What is a zone transfer?
- What would you allow through a firewall for a DNS server?
- What does the truncated flag tell the client?