Company questionsGroundworkComputer networks

Fundamentals · Computer networks

Computer networks: the questions candidates report

  • 20 questions
  • 5 themes
  • 15 companies
  • 17 with candidate reports

Networking questions reported in interviews: layers, DNS, HTTP, load balancing and TLS, with model answers. Open a theme, try the answer aloud first, then check it against the model.

Layers and addressing

  1. Explain the OSI model and the TCP/IP model, and say which layer common protocols belong to.CoreSeveral reports

    The OSI model splits networking into seven layers: physical, data link, network, transport, session, presentation and application. The TCP/IP model collapses this into four layers (some texts count five): link, internet, transport and application. Each layer talks to the same layer on the peer and offers a service to the layer above, so data is wrapped in a new header at every step down (encapsulation).

    • Ethernet and Wi-Fi frames, MAC addresses, switches: data link
    • IP, ICMP, routers: network (internet)
    • TCP and UDP: transport
    • HTTP, DNS, SMTP: application

    TLS has no clean home; it sits between transport and application. A typical follow-up asks where a switch, a router and a firewall operate (layers 2, 3 and 3 to 7).

    Computer networks guide →

  2. How do TCP and UDP differ, and when would you pick each?CoreSeveral reports

    TCP is connection-oriented. It opens with a three-way handshake and gives a reliable, ordered byte stream using sequence numbers, acknowledgements, retransmission, flow control and congestion control. UDP is connectionless: it sends independent datagrams with an 8 byte header and offers no delivery, ordering or retransmission guarantee.

    • Choose TCP when every byte must arrive in order: web pages, file transfer, email, database connections.
    • Choose UDP when freshness beats completeness or the application handles loss itself: DNS lookups, voice and video calls, games, and QUIC, which builds reliability on top of UDP.

    The usual follow-up is head-of-line blocking: one lost TCP segment stalls every stream multiplexed behind it, which is one reason HTTP/3 moved to QUIC.

    Computer networks guide →

  3. How does IP addressing work, and what does subnetting with CIDR do?CoreSeveral reports

    An IPv4 address is 32 bits (IPv6 uses 128). CIDR notation such as 192.168.10.0/24 says the first 24 bits identify the network and the remaining 8 identify the host. A /24 holds 256 addresses, of which 254 are usable because the all-zeros host is the network address and the all-ones host is the broadcast address.

    Subnetting borrows host bits to cut a block into smaller networks: a /26 gives 64 addresses (62 hosts), so one /24 splits into four /26 subnets. It limits broadcast traffic and lets you apply separate policies per subnet.

    Private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. A follow-up: routers pick the matching route with the longest prefix.

    Computer networks guide →

  4. What is the difference between an IP address and a MAC address?CorePrep guides

    A MAC address is a 48 bit layer 2 identifier assigned to a network interface, usually by the manufacturer, and written as six hex pairs. It only matters on the local link. An IP address is a layer 3 logical address tied to where the host sits in the network, and it can change when the host moves or a DHCP lease renews.

    On a path through routers the source and destination IP stay the same end to end (ignoring NAT), while the MAC addresses are rewritten at every hop: each router strips the old frame and builds a new one for the next link.

    You need both because IP gives routable, hierarchical addressing and MAC gives delivery on a shared medium. The follow-up is how a host learns the MAC for a given IP, which is ARP.

    Computer networks guide →

  5. What does ARP do and how does a host use it to send a packet?CoreOne report

    ARP (Address Resolution Protocol) maps an IPv4 address to a MAC address on the same local network. A host that wants to reach 192.168.1.20 broadcasts "who has this IP?" to ff:ff:ff:ff:ff:ff. The owner replies with a unicast message carrying its MAC, and the asker stores the pair in its ARP cache for a short time.

    If the destination is on another subnet, the host does not ARP for it; it ARPs for the default gateway and sends the frame there, leaving the IP destination untouched.

    ARP has no authentication, so a host can lie in its replies (ARP spoofing) and redirect traffic. IPv6 replaces ARP with Neighbor Discovery. Interviewers often follow up with how a switch learns which port holds which MAC.

    Computer networks guide →

DNS and the page load

  1. How does DNS resolve a domain name, and what are the common record types?CoreSeveral reports

    DNS is a distributed, hierarchical database that maps names to records. For www.example.com the app asks the OS stub resolver, which asks a recursive resolver (your ISP or a public one). On a cache miss it walks down: a root server points to the .com TLD servers, which point to the domain's authoritative server, which returns the answer. Every answer is cached for its TTL.

    • A and AAAA: IPv4 and IPv6 address
    • CNAME: alias to another name
    • MX: mail servers
    • NS: delegation; TXT: free text such as SPF

    Queries normally use UDP port 53, falling back to TCP for large replies. A follow-up is how you would design DNS: hierarchy, replication, anycast and caching.

    Computer networks guide →

  2. What happens between typing a URL in the browser and seeing the page?CoreSeveral reports
    1. The browser parses the URL and checks its caches and the HSTS list.
    2. DNS resolves the host name to an IP address.
    3. A TCP connection opens with the three-way handshake (QUIC over UDP for HTTP/3).
    4. For HTTPS, the TLS handshake agrees on keys and verifies the server certificate.
    5. The browser sends the HTTP request. It may pass a CDN and a load balancer before reaching an application server, which can query a database and build the response.
    6. The browser parses the HTML into the DOM, discovers CSS, JavaScript and images, fetches them (often over the same connection), builds the render tree, then lays out and paints.

    Strong answers add where caching shortcuts each step. The usual follow-up is to dig into one stage, often DNS or TLS.

    Computer networks guide →

  3. What is a CDN and why would a system put one in front of its origin?CoreOne report

    A content delivery network is a set of edge servers spread across regions that cache content close to users. Requests reach a nearby edge through DNS-based or anycast routing. On a hit the edge answers directly; on a miss it fetches from the origin and stores the copy according to Cache-Control headers and TTLs.

    • Lower latency, because the round trip is shorter.
    • Less load and bandwidth at the origin.
    • Better absorption of traffic spikes and some denial-of-service attacks.

    It suits static assets such as images, scripts and video segments. Personalised responses should not be cached publicly. A common follow-up is invalidation: how to purge or version (content-hashed file names) assets after a deploy.

    System design track →

Traffic and gateways

  1. What is a load balancer and how does it spread traffic across servers?CoreSeveral reports

    A load balancer sits in front of a pool of servers, accepts client traffic and forwards each request or connection to a healthy backend. This adds capacity, removes a single server as a point of failure and enables rolling deploys.

    • Layer 4 balancers route on IP and port; layer 7 balancers read HTTP and can route by path, header or cookie and terminate TLS.
    • Algorithms: round robin, weighted round robin, least connections, IP hash, consistent hashing.
    • Health checks take failing nodes out of rotation.

    Sticky sessions pin a user to one backend, but keeping servers stateless is better. The balancer itself must not be a single point of failure, so it runs as a redundant pair or behind anycast. Expect a follow-up on how you scale it.

    System design track →

  2. What is the difference between a forward proxy, a reverse proxy and a VPN?CoreSeveral reports

    A forward proxy sits in front of clients and makes requests on their behalf, so servers see the proxy's address. It is used for filtering, caching and anonymity. A reverse proxy sits in front of servers: clients talk to it as if it were the site, and it handles TLS termination, caching, compression and load balancing while hiding the backends.

    A VPN builds an encrypted tunnel (IPsec, WireGuard, OpenVPN) between a device and a gateway and sends all selected traffic through it, usually at the network layer. It protects data on untrusted networks and gives access to a private network. A proxy usually works at the application level for particular protocols (HTTP, or SOCKS for general TCP) and need not encrypt anything.

    A common follow-up is split tunnelling, which sends only some traffic through the VPN.

    Computer networks guide →

  3. What do a firewall and NAT do, and how does NAT let many devices share one public IP?CorePrep guides

    A firewall allows or drops traffic by rule, ideally with a default deny. A stateless filter judges each packet on addresses, ports and protocol. A stateful one tracks connections, so replies to an allowed outbound request pass automatically. Application-layer firewalls and WAFs inspect HTTP content.

    NAT rewrites addresses at a router. The common form, port address translation, maps each private IP:port to the single public IP with a unique source port and records the mapping in a table, so replies return to the right device. This eases IPv4 shortage and hides internal addressing.

    The cost is that unsolicited inbound connections have nowhere to go, so servers behind NAT need port forwarding. NAT is not a security control by itself. A follow-up is how peer-to-peer apps traverse NAT.

    Computer networks guide →

  4. Compare a hub, a switch and a router, and name the common network topologies.CorePrep guides

    A hub works at layer 1 and repeats every signal to all ports, so all ports share one collision domain; it is obsolete. A switch works at layer 2: it learns which MAC address is behind which port and forwards frames only there, giving each port its own collision domain. A router works at layer 3: it joins different networks, forwards by routing table and splits broadcast domains.

    • Bus: one shared cable, cheap but fragile.
    • Star: every node to a central switch; the standard today, with the centre as single point of failure.
    • Ring: each node linked to two neighbours.
    • Mesh: many links, resilient; a full mesh of n nodes needs n(n-1)/2 links.

    A follow-up is the difference between collision and broadcast domains.

    Computer networks guide →

HTTP and APIs

  1. What is the difference between HTTP and HTTPS, and what does the S add?CoreOne report

    HTTP sends requests and responses as plain text, by default on port 80. HTTPS is the same protocol carried inside a TLS session, by default on port 443. TLS adds three guarantees:

    • Confidentiality: traffic is encrypted, so people on the path cannot read it.
    • Integrity: tampering is detected.
    • Authentication: the server proves its identity with a certificate signed by a trusted CA.

    The cost is an extra handshake, mostly hidden by TLS 1.3, session resumption and keep-alive connections. HTTPS does not hide the destination IP or, without extras such as ECH, the host name, and it does not mean the site is trustworthy. HSTS tells browsers to always use HTTPS. The follow-up is usually how the handshake works.

    Computer networks guide →

  2. Describe the format of an HTTP request and response, the main methods and the common status codes.CoreSeveral reports

    In HTTP/1.1 a request is a request line (method, path, version), headers, a blank line and an optional body. A response is a status line, headers, a blank line and a body.

    • GET reads and is safe and idempotent; POST creates or triggers an action and is not idempotent; PUT replaces a resource and is idempotent; PATCH applies a partial change; DELETE removes and is idempotent.
    • 2xx success: 200, 201 Created, 204 No Content.
    • 3xx redirect: 301, 302, 304 Not Modified.
    • 4xx client error: 400, 401 (not authenticated), 403 (not allowed), 404, 429.
    • 5xx server error: 500, 502, 503, 504.

    Expect the follow-up PUT versus POST: PUT targets a known URL and is safe to retry, POST is not.

    Computer networks guide →

  3. Are REST APIs stateful or stateless, and what does that mean in practice?CoreOne report

    REST is stateless: each request must carry everything the server needs to handle it, such as the auth token, identifiers and parameters. The server keeps no client session context between requests. Resource state still lives in the database; "stateless" only refers to the conversation.

    Benefits: any server can answer any request, so you scale horizontally behind a load balancer and recover from failures without losing session data; stateless requests are also easier to cache and retry. The costs are repeated metadata on every call and the need for tokens instead of server-held sessions.

    REST models resources as nouns addressed by URL and manipulated through HTTP methods. A follow-up is how to log users in without server sessions, which leads to tokens such as JWT.

    Computer networks guide →

  4. How does GraphQL compare with REST, particularly over-fetching and under-fetching?DeepOne report

    REST exposes a fixed response per endpoint. That causes over-fetching (the payload has fields the screen never uses) and under-fetching (one screen needs several calls, for example a user, then their orders, then each order's items). GraphQL exposes a typed schema through one endpoint, and the client sends a query naming exactly the fields and nested relations it wants, getting them in one round trip.

    Trade-offs: HTTP caching by URL is harder because queries usually go as POST to one path; a naive resolver causes N+1 database queries (batching tools such as DataLoader fix it); and deep or expensive queries need depth and cost limits. Errors often come back with status 200 plus an errors array.

    It pays off for varied clients such as mobile and web.

    Computer networks guide →

  5. How do WebSockets differ from plain HTTP request-response, and what are the alternatives for real-time updates?DeepOne report

    HTTP is request-response: the client asks, the server answers, and the server cannot speak first. A WebSocket starts as an HTTP request with Upgrade: websocket; the server replies 101 Switching Protocols, and the TCP connection stays open as a full-duplex channel with small frames in both directions. That suits chat, live scores and collaborative editing.

    Alternatives: short polling (simple, wasteful), long polling (the server holds the request until data exists) and server-sent events (one-way push over HTTP).

    The cost is stateful, long-lived connections. They tie up memory and file descriptors, need heartbeats and reconnection logic, and require a load balancer that handles upgrades. Fanning messages across servers needs a pub/sub layer. That scaling story is the usual follow-up.

    Computer networks guide →System design track →

Security in transit

  1. How do encryption and hashing differ, and how do symmetric and asymmetric encryption compare?CoreSeveral reports

    Encryption is reversible: with the right key, ciphertext turns back into the plaintext, giving confidentiality. A hash is a one-way function that maps input to a fixed-size digest, used for integrity checks and password storage. Passwords need a slow, salted hash such as bcrypt, scrypt or Argon2, not plain SHA-256.

    • Symmetric (AES, ChaCha20): one shared key, fast, good for bulk data, but the key must be shared safely.
    • Asymmetric (RSA, elliptic curves): a public and private key pair. The public key encrypts or verifies, the private key decrypts or signs. It is slower, so it mostly exchanges keys and signs.

    Real protocols are hybrid. The follow-up is how TLS combines them.

    Computer networks guide →

  2. Walk through the TLS handshake and explain how the client trusts the server.DeepOne report

    After the TCP handshake, in TLS 1.3 the client sends a ClientHello with supported cipher suites, the server name and a key share. The server answers with its own key share, its certificate chain and a signature over the handshake. Both sides now compute the same session keys with an ephemeral Diffie-Hellman exchange, then switch to symmetric encryption such as AES-GCM. That takes one round trip; TLS 1.2 needs two.

    The client trusts the server by validating the chain up to a CA in its trust store, checking the host name, the validity dates and the signature, which proves the server holds the private key.

    Ephemeral keys give forward secrecy: stealing the server key later cannot decrypt old traffic. A follow-up is session resumption and 0-RTT replay risk.

    Computer networks guide →

  3. Compare cookie-based sessions with JWT authentication, including their security trade-offs.DeepOne report

    With sessions, the server stores the login state and gives the browser an opaque session ID in a cookie. Each request is looked up in a store such as Redis. Revoking a session is easy, but all servers need that shared store. A JWT is a signed token (header.payload.signature) holding claims such as the user id and expiry. Servers verify the signature without a lookup, which fits stateless APIs.

    JWT trade-offs: the payload is only base64url-encoded, not encrypted, so keep secrets out; revocation is hard, so use short expiry plus refresh tokens; and the verifier must pin the algorithm.

    Store tokens in HttpOnly, Secure, SameSite cookies to reduce XSS token theft and CSRF. A follow-up is how to log out a JWT user.

    Computer networks guide →

Keep going

Companies do not publish their questions and rotate them. These come from public candidate write-ups and prep guides, so treat the labels as one person's account or one list's tag. The answers are written for this site.

Now make it stick

Run a mock interviewBack to all questions