Interview prep · 8 questions
Network troubleshooting interview questions
What do interviewers test with troubleshooting questions?
They test your method more than any single fact: whether you narrow a fault down layer by layer and prove each step with a command instead of guessing. Expect a scenario first, then follow-ups that change one detail to see whether your reasoning adapts.
Updated
Mock interview
One question at a time. Answer it out loud as you would in the room, then reveal the model answer and rate yourself honestly. Your progress stays in this browser.
A user can't reach a server. How do you troubleshoot it?
Entry level
First find the scope: one user or many, one server or all of them. Then work up from the bottom, checking the link, the host's address, mask and gateway, a ping to the gateway, a ping to the server, a traceroute to see where traffic stops, and finally name resolution and the service itself.
Make every step a test with a clear result, so you can say exactly where the fault is before you change anything.
Ask what changed recently. Many outages follow a configuration change, and knowing that can save the whole walk.
Common weak answer: Jumping to reboots or configuration changes before proving where the fault is.
Likely follow-ups
- What would you check if the user can reach the server by address but not by name?
- How does your answer change if every user is affected?
- When would you work from the top down instead?
What is the difference between ping and traceroute?
Entry level
Ping tells you whether a destination answers and how long the round trip takes, using ICMP echo requests and replies. Traceroute shows the path hop by hop, by sending packets with an increasing TTL and listing each router that reports the TTL running out.
Where a traceroute stops is a strong clue, not proof: the last router that answered may be fine, and the fault may be at the next hop or on the return path.
Some routers do not answer traceroute probes at all, which shows as asterisks even though traffic passes through them.
Common weak answer: Assuming the last router that answered is the broken one. The problem is usually just after it, or on the way back.
Likely follow-ups
- Why might a traceroute show asterisks in the middle and still reach the end?
- What does the TTL protect against?
- Why can ping fail while the service works?
You can ping a server, but its web page won't load. What do you check?
Mid level
A ping only proves that ICMP gets there and back, so look at what is different about the web traffic: TCP port 443 or 80, the service itself, and name resolution. Check that the service is running and listening, that no ACL or firewall blocks the port, and that the name resolves to the address you pinged.
Testing the port directly from the client, for example with a command-line web request, separates "the service is down" from "something on the path blocks it".
A refused connection means the server answered and nothing was listening; a timeout means something on the path dropped the request.
Common weak answer: Stopping at "the network is fine because ping works". Ping and web traffic can be treated very differently.
Likely follow-ups
- How do you test a TCP port without a browser?
- What if the page loads by address but not by name?
- What does a timeout tell you that a refusal doesn't?
What is the difference between "Destination host unreachable" and "Request timed out"?
Mid level
"Destination host unreachable" means something answered to say the packet could not be delivered: your own host got no reply to its ARP, or a router had no route to the destination. "Request timed out" means no answer came back at all, because the request or the reply was dropped somewhere, by an ACL, a missing return route or a host that is down.
The address after "Reply from" tells you who reported the problem: your own address points at a local fault such as an unanswered ARP, and a router's address means that router could not forward the packet. A host with no default gateway at all usually reports a transmit failure instead.
A timeout with a working outbound path often means the reply has no way back, so check the route in the other direction.
Common weak answer: Treating the two messages as the same failure. One means someone answered with bad news; the other means nobody answered.
Likely follow-ups
- Which device sends an unreachable message?
- Why does a missing return route cause a timeout rather than an error?
- What would you check next for each message?
Host A can ping host B, but B can't ping A. What could cause that?
Senior
Because A's pings get replies, packets already flow in both directions, so the difference is in what may start a conversation. Typical causes are an ACL or firewall that permits replies toward A but not new requests, a host firewall on A that ignores incoming pings, or A sitting behind PAT, where nothing outside can reach it without a mapping.
This is exactly how a stateful firewall is meant to behave: sessions started on the inside get their replies, and sessions started from outside are dropped unless a rule allows them.
If the behaviour is a fault rather than a design, compare the ACL lines for echo requests and echo replies on each interface along the path.
Common weak answer: Blaming routing straight away. If A's pings come back, routing already works both ways.
Likely follow-ups
- How would you let one outside host start sessions to A through PAT?
- Which ACL line would allow pings out but not in?
- How would you confirm a host firewall is the cause?
What do "administratively down", "down/down" and "up/down" tell you about an interface?
Entry level
"Administratively down" means someone shut the interface in its configuration. "Down/down" means there is no working physical link, such as an unplugged cable or a dead far end, and "up/down" means the physical link is fine but the line protocol is not, for example after a keepalive or encapsulation mismatch.
The first word is the physical status and the second the protocol status, so read them as a pair.
Router ports often ship administratively down, which is why a freshly cabled router port needs "no shutdown" before anything works.
Common weak answer: Replacing the cable on an administratively down port. That state is a configuration choice, not a physical fault.
Likely follow-ups
- Which command shows every interface's status in one view?
- What does err-disabled mean?
- Why would a serial link show up/down?
Two PCs on the same switch and the same subnet can't ping each other. What do you check?
Entry level
Check that both switch ports are up and in the same VLAN, because ports in different VLANs are as separate as two switches. Then check each PC's address and mask for typos or a duplicate address, and whether port security or a host firewall is dropping the traffic.
The switch's VLAN table and interface status answer the first question in seconds, so start there rather than at the PCs.
If one PC reaches the gateway and the other does not, compare their switch ports side by side; the difference is usually the VLAN.
Common weak answer: Looking at routing. Two hosts on one subnet never use a router to reach each other.
Likely follow-ups
- How do you see which VLAN a port is in?
- What happens if two PCs have the same address?
- What changes if the PCs are on different switches?
A switch port shows err-disabled. What does that mean, and how do you bring it back?
Mid level
The switch shut the port itself because a protection feature tripped, such as a port security violation. Find and fix the cause first, then bounce the port with shutdown and no shutdown, or let automatic recovery bring it back after a timer if that is configured.
Bouncing the port without fixing the cause puts it straight back into err-disabled the next time the same thing happens.
The switch's log normally names the feature that tripped, which tells you where to look.
Common weak answer: Treating err-disabled like a cable fault. The switch shut the port on purpose.
Likely follow-ups
- Which features can err-disable a port?
- How would you see which MAC address triggered a port security violation?
- What are the risks of automatic recovery?