Computer Networks Interview Questions — Set 1
25 networking interview questions — OSI layers, TCP/UDP, IP addressing, subnetting, DNS/DHCP and the protocols behind every packet.
One question at a time — answer, learn from the explanation, and keep your combo alive. Stuck? You have two 50:50s and one hint (each halves that question's XP).
Practice sheet: all 25 questions
Prefer reading first? Every question from this practice set, with the answer and a worked explanation. (Solving them in the practice set above earns XP — up to ≈150.)
-
Q1. How many layers does the OSI reference model have?
- a. 4
- b. 5
- c. 6
- d. 7
Show answer & explanation
Answer: D. 7
OSI has 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, Application (mnemonic: "Please Do Not Throw Sausage Pizza Away"). The practical TCP/IP model compresses these into 4 — interviews often ask you to map one onto the other.
-
Q2. Routing between networks is the responsibility of which OSI layer?
- a. Data link layer
- b. Network layer
- c. Transport layer
- d. Session layer
Show answer & explanation
Answer: B. Network layer
The network layer (layer 3) owns logical addressing (IP) and routing — choosing the path across networks. The data link layer only delivers frames within one network segment; transport handles end-to-end delivery between processes.
-
Q3. Which statement about TCP and UDP is correct?
- a. TCP is connectionless; UDP is connection-oriented
- b. TCP is connection-oriented and reliable; UDP is connectionless and unreliable
- c. Both guarantee in-order delivery
- d. UDP retransmits lost packets automatically
Show answer & explanation
Answer: B. TCP is connection-oriented and reliable; UDP is connectionless and unreliable
TCP sets up a connection, acknowledges data, retransmits losses and preserves order; UDP just sends datagrams — no handshake, no recovery, minimal overhead. That trade-off (reliability vs latency) decides which protocol an application uses.
-
Q4. Which application is the BEST fit for UDP rather than TCP?
- a. File download
- b. Email delivery
- c. Live video streaming
- d. Bank transactions
Show answer & explanation
Answer: C. Live video streaming
Live streaming prefers UDP: a lost frame is better skipped than retransmitted late, and the handshake/ACK overhead of TCP adds latency. Files, email and payments need every byte intact and ordered — that's TCP territory.
-
Q5. What is the correct sequence of TCP's three-way handshake?
- a. SYN → SYN-ACK → ACK
- b. ACK → SYN → SYN-ACK
- c. SYN → ACK → SYN-ACK
- d. SYN-ACK → SYN → ACK
Show answer & explanation
Answer: A. SYN → SYN-ACK → ACK
The client sends SYN with its initial sequence number, the server replies SYN-ACK (its own SYN plus an ACK of the client's), and the client's final ACK completes the connection. Both sides have now exchanged and confirmed sequence numbers.
-
Q6. What is the default port number for HTTPS?
- a. 21
- b. 80
- c. 443
- d. 8080
Show answer & explanation
Answer: C. 443
HTTPS uses port 443; plain HTTP uses 80. The other classics worth memorising: FTP 21, SSH 22, Telnet 23, SMTP 25, DNS 53, POP3 110, IMAP 143 — port questions are free marks in written rounds.
-
Q7. What is the primary job of DNS?
- a. Assigning IP addresses to new devices
- b. Translating domain names into IP addresses
- c. Encrypting web traffic
- d. Routing packets between networks
Show answer & explanation
Answer: B. Translating domain names into IP addresses
DNS resolves human-friendly names (placementclass.com) to IP addresses via a distributed hierarchy of name servers. Assigning addresses is DHCP's job — the two get swapped in exams because both "give" you an IP in casual speech.
-
Q8. How many bits long is an IPv4 address?
Show answer & explanation
Answer: 32
IPv4 addresses are 32 bits — four 8-bit octets written in dotted decimal (e.g. 192.168.1.1), giving about 4.3 billion addresses. Address exhaustion is why IPv6 moved to 128 bits.
-
Q9. How many usable host addresses does a /26 subnet provide?
- a. 64
- b. 62
- c. 32
- d. 126
Show answer & explanation
Answer: B. 62
/26 leaves 32 − 26 = 6 host bits → 2⁶ = 64 addresses, minus the network and broadcast addresses = 62 usable. The −2 is the whole question; 64 is the planted answer for anyone who forgets it.
-
Q10. Which of these IPv4 addresses is a private address?
- a. 8.8.8.8
- b. 192.168.10.5
- c. 172.32.0.1
- d. 11.0.0.1
Show answer & explanation
Answer: B. 192.168.10.5
The private (RFC 1918) ranges are 10.0.0.0/8, 172.16.0.0/12 (172.16–172.31 only) and 192.168.0.0/16. 192.168.10.5 fits; 172.32.x.x is just OUTSIDE the 172 block — that boundary is exactly what this question tests.
-
Q11. A MAC address is how many bits long, and at which layer does it operate?
- a. 32 bits, network layer
- b. 48 bits, data link layer
- c. 64 bits, physical layer
- d. 128 bits, transport layer
Show answer & explanation
Answer: B. 48 bits, data link layer
MAC addresses are 48 bits (six hex pairs like 3C:5A:B4:xx:xx:xx), burned into the NIC and used by the data link layer to deliver frames on a local segment. IPs route between networks; MACs deliver within one.
-
Q12. The ARP protocol is used to:
- a. Map an IP address to a MAC address
- b. Map a MAC address to a hostname
- c. Assign IP addresses dynamically
- d. Encrypt frames on the LAN
Show answer & explanation
Answer: A. Map an IP address to a MAC address
ARP broadcasts "who has this IP?" on the LAN and the owner replies with its MAC — the mapping is cached for future frames. Reverse lookups (MAC → IP) were RARP's job historically; DHCP is what assigns addresses.
-
Q13. What is the key difference between a hub and a switch?
- a. A hub forwards frames only to the destination port; a switch broadcasts to all ports
- b. A switch learns MAC addresses and forwards frames only to the right port; a hub repeats to every port
- c. They are identical in function
- d. A hub operates at the network layer
Show answer & explanation
Answer: B. A switch learns MAC addresses and forwards frames only to the right port; a hub repeats to every port
A hub is a layer-1 repeater — every frame goes to every port, one big collision domain. A switch (layer 2) learns which MAC lives on which port and forwards frames only there, giving each port its own collision domain.
-
Q14. At which OSI layer does a router primarily operate?
- a. Layer 1 (Physical)
- b. Layer 2 (Data Link)
- c. Layer 3 (Network)
- d. Layer 4 (Transport)
Show answer & explanation
Answer: C. Layer 3 (Network)
Routers make forwarding decisions on IP addresses — layer 3. The device ladder to remember: hub = layer 1, switch = layer 2, router = layer 3; each device reads one layer deeper into the packet.
-
Q15. Which protocol automatically assigns IP addresses, subnet masks and gateways to hosts joining a network?
- a. DNS
- b. DHCP
- c. ARP
- d. ICMP
Show answer & explanation
Answer: B. DHCP
DHCP leases network configuration via the DORA exchange — Discover, Offer, Request, Acknowledge. Without it every device would need manual IP configuration; with it, joining Wi-Fi "just works".
-
Q16. HTTP is called a stateless protocol because:
- a. It never uses TCP connections
- b. The server retains no memory of previous requests from the same client
- c. It cannot transfer dynamic pages
- d. It works without IP addresses
Show answer & explanation
Answer: B. The server retains no memory of previous requests from the same client
Each HTTP request stands alone — the server doesn't remember who you are between requests. Sessions, logins and carts are built on top with cookies/tokens that the client re-sends every time. That layering is the interview follow-up.
-
Q17. TCP's sliding window mechanism provides:
- a. Encryption
- b. Flow control
- c. Name resolution
- d. Physical addressing
Show answer & explanation
Answer: B. Flow control
The window tells the sender how much unacknowledged data it may have in flight, sized to what the receiver can buffer — that's flow control (protecting the receiver). Congestion control is the related-but-different mechanism protecting the network itself.
-
Q18. In TCP congestion control, the slow-start phase:
- a. Increases the congestion window exponentially until a threshold
- b. Keeps the window constant forever
- c. Decreases the window linearly
- d. Disables acknowledgements
Show answer & explanation
Answer: A. Increases the congestion window exponentially until a threshold
Despite the name, slow start doubles the congestion window every RTT (exponential growth) from a small initial value, until it hits the ssthresh threshold — then congestion avoidance takes over with linear growth. "Slow" refers only to the small starting point.
-
Q19. CRC (Cyclic Redundancy Check) is primarily used for:
- a. Error detection in transmitted frames
- b. Encrypting frames
- c. Compressing data
- d. Assigning addresses
Show answer & explanation
Answer: A. Error detection in transmitted frames
CRC treats the frame as a polynomial, divides by a generator polynomial, and appends the remainder; the receiver repeats the division and a non-zero remainder means corruption. It detects errors (especially bursts) — it does not correct them; correction needs codes like Hamming.
-
Q20. In stop-and-wait ARQ, how many frames can be outstanding (sent but unacknowledged) at a time?
- a. 1
- b. 2
- c. Window size
- d. Unlimited
Show answer & explanation
Answer: A. 1
Stop-and-wait sends one frame and idles until its ACK returns — exactly one outstanding frame. On long links this wastes almost all the bandwidth, which is precisely the problem sliding-window protocols (Go-Back-N, Selective Repeat) solve.
-
Q21. The ping utility uses which protocol?
- a. ICMP
- b. SMTP
- c. FTP
- d. SNMP
Show answer & explanation
Answer: A. ICMP
ping sends ICMP Echo Request packets and measures the Echo Replies — testing reachability and round-trip time. ICMP is IP's control/diagnostics companion protocol; it carries no application data.
-
Q22. traceroute discovers the path to a destination by manipulating which IP header field?
- a. Checksum
- b. TTL (Time To Live)
- c. Fragment offset
- d. Source address
Show answer & explanation
Answer: B. TTL (Time To Live)
traceroute sends probes with TTL = 1, 2, 3, …; each router that decrements TTL to zero drops the probe and replies with an ICMP "Time Exceeded", revealing itself. Hop by hop, the whole path emerges — an elegant abuse of a loop-prevention field.
-
Q23. Which protocol is used to SEND email between mail servers?
- a. POP3
- b. IMAP
- c. SMTP
- d. HTTP
Show answer & explanation
Answer: C. SMTP
SMTP pushes mail — client to server and server to server. POP3 and IMAP are retrieval protocols for reading your inbox (POP3 downloads-and-deletes, IMAP syncs across devices). Send vs receive is the whole distinction.
-
Q24. Which of the following protocols operate at the application layer? (Select all that apply.)
- a. HTTP
- b. DNS
- c. SMTP
- d. TCP
Show answer & explanation
Answer: A. HTTP · B. DNS · C. SMTP
HTTP, DNS and SMTP are application-layer protocols — they define message formats for user-facing services. TCP sits a layer below at transport, carrying all three. DNS is the tempting wrong-exclusion because it mostly rides on UDP, but it's still application layer.
-
Q25. NAT (Network Address Translation) allows:
- a. Multiple devices with private IPs to share one public IP
- b. Encryption of all outgoing traffic
- c. Direct MAC-to-MAC communication across the internet
- d. Automatic domain name assignment
Show answer & explanation
Answer: A. Multiple devices with private IPs to share one public IP
NAT rewrites private source addresses to the router's public IP (tracking each flow by port), letting a whole LAN share one public address — the main workaround for IPv4 scarcity. Your home Wi-Fi does this for every device on it.