FRESHERS · 31 Q&AS · BTECH / BCA / MCA · BANGALORE 2026
Networking Interview Questions for Freshers (2026)
31 real networking interview questions for freshers — OSI/TCP-IP fundamentals, subnetting, VLAN/STP basics, simple routing scenarios, and L1 troubleshooting. These are the questions BTech / BCA / MCA candidates face most often in their first networking job interviews across Bangalore's product companies, BFSI sector, and GCCs. Compiled from interview rounds at 800+ Bangalore hiring partners.
Bangalore fresher network engineer salary range: ₹3-6 LPA for L1 NOC / network support roles. NH placement record: 45,000+ engineers placed since 2005, with the median fresher getting their first offer 8 months after starting our CCNA + CCNP course.
31
Real Q&As
₹3-6L
L1 fresher salary BLR
45K+
NH placements
800+
Hiring partners
Subnetting · 1 question
Q. How do you subnet 10.0.0.0/16 to support 50 subnets each with at least 100 hosts? ▾
Need 50 subnets → 2^6 = 64, so 6 subnet bits. Need 100 hosts/subnet → 2^7 - 2 = 126, so 7 host bits. 16 + 6 + 7 = 29 bits used → /23 prefix would give us 7 host bits and 7 subnet bits (128 subnets). Most accurate answer: /23 mask (255.255.254.0) works — gives 128 subnets of 510 hosts each. Trade-off: address efficiency vs subnet count.
Routing · 3 questions
Q. What's the difference between OSPF, EIGRP, and BGP? ▾
OSPF (link-state, IGP, open standard, RFC 2328) — runs Dijkstra SPF inside each area, fast convergence, hierarchical with areas. EIGRP (advanced distance-vector, IGP, originally Cisco-proprietary now open) — uses DUAL algorithm, fastest convergence among IGPs, less complex than OSPF. BGP (path-vector, EGP, RFC 4271) — used between autonomous systems (the internet's backbone), policy-driven, slow convergence, scales to 1M+ routes. Use OSPF for enterprise multi-vendor, EIGRP for Cisco-only, BGP for ISP/multi-AS.
Q. EIGRP DUAL algorithm — explain Successor and Feasible Successor. ▾
Successor — the route with the lowest metric to a destination, installed in the routing table. Feasible Successor (FS) — a backup route that satisfies the Feasibility Condition: FS reported distance < Successor feasible distance. FS is pre-computed, kept in topology table, and installed instantly if Successor fails — no recomputation needed. This is what gives EIGRP sub-second convergence. If no FS exists, DUAL goes Active and queries neighbors — slower.
Q. BGP path attributes — list the 6 well-known mandatory ones. ▾
Per RFC 4271: AS_PATH, NEXT_HOP, ORIGIN, LOCAL_PREF (well-known discretionary, only for iBGP), ATOMIC_AGGREGATE (well-known discretionary), MED (optional non-transitive). Path selection order: Highest Weight (Cisco-only) → Highest LOCAL_PREF → Locally Originated → Shortest AS_PATH → Lowest ORIGIN → Lowest MED → eBGP over iBGP → Lowest IGP metric to next-hop → Oldest Route → Lowest Router-ID. Memorising this order is a CCNP / CCIE benchmark question.
ACLs / NAT · 1 question
Q. Standard vs extended ACL — when do you use each? ▾
Standard ACL (1–99 or 1300–1999) — filters by source IP only. Apply close to destination (because filtering only by source means you don't want to block legitimate traffic to other destinations from same source). Extended ACL (100–199 or 2000–2699) — filters by source IP + destination IP + protocol + ports. Apply close to source for efficiency (drops unwanted traffic before it traverses the network). Modern best practice: use named ACLs for both readability.
VPN · 1 question
Q. Site-to-site IPsec VPN — explain Phase 1 and Phase 2. ▾
Phase 1 (IKE/ISAKMP) — establishes a secure channel for negotiating Phase 2. Negotiates: encryption algo (AES, 3DES), authentication (PSK or certs), DH group, lifetime. Two modes: Main Mode (6 messages, more secure) or Aggressive Mode (3 messages, faster but exposes identity). Phase 2 (IPsec) — establishes the actual data tunnel. Negotiates: transform set (ESP/AH + encryption + hash), proxy IDs (interesting traffic), tunnel mode (typical) or transport mode. Phase 1 SA is bidirectional; Phase 2 SAs are unidirectional pairs.
Switching · 1 question
Q. EtherChannel — LACP vs PAgP vs static. Trade-offs? ▾
LACP (802.3ad, IEEE standard, multi-vendor) — modes: active (initiates), passive (responds). Negotiation overhead but interoperable across vendors. PAgP (Cisco-proprietary) — modes: desirable (initiates), auto (responds). Faster negotiation but Cisco-only. Static (mode on) — no negotiation, just bundles physically. Fast setup but error-prone (silent misconfig). Best practice: LACP active-active for production multi-vendor environments.
Wireless · 1 question
Q. What are the differences between 802.11ax (Wi-Fi 6) and 802.11ac (Wi-Fi 5)? ▾
Wi-Fi 6 (802.11ax) introduced: OFDMA (better multi-user efficiency vs OFDM in Wi-Fi 5), MU-MIMO uplink + downlink (Wi-Fi 5 was downlink only), Target Wake Time (TWT) for IoT power savings, BSS Coloring (interference reduction in dense deployments), and 1024-QAM modulation (higher peak speeds). Real-world impact: Wi-Fi 6 shines in dense environments (office floors, conference centres) where Wi-Fi 5 chokes.
Troubleshooting · 3 questions
Q. User reports they can't reach 8.8.8.8 from their PC — walk through troubleshooting. ▾
Layer-by-layer: (1) Layer 1: ping default gateway — if fails, check cable/link status. (2) Layer 2: arp -a to verify MAC of default gateway is learned. (3) Layer 3: ping default gateway works; ping 8.8.8.8 fails. Check routing table on PC + on default gateway. Trace route to 8.8.8.8. (4) DNS: nslookup google.com — if DNS fails but ping 8.8.8.8 works, DNS server issue. (5) Firewall: check ACLs / firewall rules at perimeter. (6) NAT: check NAT translation table (if private IP). Each layer eliminates a class of issues.
Q. show ip ospf neighbor returns 'EXCHANGE' state stuck — what's wrong? ▾
OSPF neighbor stuck in EXCHANGE typically means MTU mismatch. During DBD (Database Description) packet exchange in Phase 2, OSPF requires same MTU on both ends. Other possible causes: hello-interval / dead-interval mismatch, area mismatch, authentication mismatch, network type mismatch (point-to-point vs broadcast). Cisco command to verify: show ip ospf interface — checks MTU, hello/dead, network type. Force adjacency past MTU mismatch with: ip ospf mtu-ignore (workaround, not recommended).
Q. BGP neighbor stuck in 'Active' state — what does it mean? ▾
Counter-intuitively, 'Active' state means BGP can NOT establish — it's actively trying. Compare to 'Established' which is the working state. Causes: (1) TCP port 179 blocked between peers (firewall), (2) Wrong neighbor IP configured, (3) eBGP-multihop required but not configured, (4) AS number mismatch, (5) authentication password mismatch, (6) prefix-list / route-map filtering all routes. Debug: debug ip bgp events. Check show ip bgp summary for state progression.
Network Automation · 1 question
Q. Show me a basic Ansible playbook to push a config to 10 Cisco switches. ▾
---\n- name: Push VLAN config to switches\n hosts: cisco_switches\n gather_facts: no\n connection: network_cli\n tasks:\n - name: Configure VLAN 100\n cisco.ios.ios_config:\n lines:\n - vlan 100\n - name DATA_VLAN\n match: line\n replace: line\n register: result\n - name: Save config\n cisco.ios.ios_config:\n save_when: modified\n— Inventory file lists hosts under [cisco_switches]. Run with: ansible-playbook playbook.yml -i inventory.ini -u admin --ask-pass.
Modern · 1 question
Q. What is BGP EVPN and where is it used? ▾
BGP EVPN (RFC 7432) — uses MP-BGP to advertise MAC and IP addresses (instead of just IP prefixes). Primary use: VXLAN-based datacentre fabrics. Replaces older flood-and-learn approaches with control-plane-driven learning. Cisco implementations: ACI fabric, Nexus 9K with VXLAN. Major use case in modern Bangalore datacentres — every cloud service provider's underlay uses EVPN-VXLAN.
Cloud Networking · 1 question
Q. Explain AWS VPC peering vs Transit Gateway — when to use each? ▾
VPC Peering — direct 1:1 connection between two VPCs. Non-transitive (A→B and A→C does NOT enable B→C). Cheap, simple. Use for small hub-and-spoke or 2-3 VPC integrations. Transit Gateway — central hub for many VPCs (up to 5,000) and on-prem connections. Transitive routing. More expensive but scales massively. Use for: enterprise multi-account architectures, multi-region replication, hybrid cloud connectivity. Senior network engineer roles in Bangalore now ask AWS networking depth — TGW is common interview topic.
Behavioural · 4 questions
Q. Tell me about a time you broke something in production. What happened, and how did you fix it? ▾
Ideal answer structure (STAR): Situation — context of the change. Task — what you were doing. Action — exactly what broke and how you reacted (escalation, rollback, root cause analysis). Result — what was fixed, what was learned, what process changed afterward. Recruiters look for: did you take ownership? Did you panic or follow process? Did you learn something durable? Don't claim 'I never broke anything' — that signals dishonesty or limited production exposure.
Q. Tell me about the most interesting bug or attack chain you've found. ▾
Use STAR format. Best examples: (1) Bug bounty find with documented payout — credibility unmatched; (2) CTF challenge solved creatively (not just following walkthroughs); (3) Internal pen-test with unique attack chain — even from coursework. Avoid hypotheticals ('I would do X') and overly generic answers ('found XSS once'). Specific + technical + outcome-driven wins. Bonus: tie back to lessons learned — interviewers want to see how you process and grow from each engagement.
Q. How do you stay current with new vulnerabilities and attack techniques? ▾
Sources weekly: (1) Twitter/X — @SwiftOnSecurity, @bugbountywriteup, @PortSwigger researchers; (2) HackerOne disclosed reports + Bugcrowd disclosed reports; (3) PortSwigger Web Security Academy free training; (4) DEFCON / Black Hat talk recordings on YouTube (don't pay to attend); (5) Personal lab — replicate every interesting CVE within a week of publication. Quality > quantity: 3-4 hours/week of disciplined reading + practice keeps you current. Avoid: vendor blog whitepapers (low signal), generic 'cybersec news' aggregators, certifications-as-marketing.
Q. Why do you want to work at our company specifically (vs other pen-test firms)? ▾
Required research: visit company's tech blog, read their open-source repos, find their disclosed CVE history (if any). Your answer should reference concrete things ('I read your team's blog post on X technique', 'noticed your CVE-XXXX-YYYY in product Z'). Avoid generic answers ('I want a challenging environment'). Tie your specific skills to their visible needs. Also acceptable: 'I noticed your team works on cloud security exclusively, which is where I want to specialise.' Specific > generic always.
AI/ML Foundations · 1 question
Q. Explain the difference between supervised, unsupervised, and reinforcement learning in security contexts. ▾
Supervised — labelled training data (e.g. malware vs benign samples). Used for malware classification, phishing detection. Drawback: needs labelled data. Unsupervised — no labels; finds patterns/anomalies in data. Used for UEBA (user behaviour anomaly detection), unknown threat clustering. Drawback: harder to validate. Reinforcement learning — agent learns through trial-and-error rewards. Used for adaptive defence, automated red-team agents (PentestGPT-style). Drawback: requires defined reward function — easy to misalign in security.
Prompt Injection · 1 question
Q. Walk me through detecting and mitigating an indirect prompt injection in a RAG system. ▾
Detection: (1) anomaly detection on retrieved chunks (statistical outliers in token distribution); (2) semantic classifiers flagging adversarial intent in retrieved content; (3) output validation (does response match expected format/schema?); (4) provenance tracking (which document caused which response token?). Mitigation: (1) strict input/output schemas; (2) separate retrieval from generation context; (3) adversarial training with known prompt injection corpora; (4) human-in-the-loop for high-risk responses; (5) sanitise retrieved content before context injection.
OWASP LLM Top 10 · 2 questions
Q. List the OWASP Top 10 for LLM Applications (2025 edition) and rank them by severity. ▾
LLM01 Prompt Injection (highest severity), LLM02 Insecure Output Handling, LLM03 Training Data Poisoning, LLM04 Model Denial of Service, LLM05 Supply Chain Vulnerabilities, LLM06 Sensitive Information Disclosure, LLM07 Insecure Plugin Design, LLM08 Excessive Agency, LLM09 Overreliance, LLM10 Model Theft. In Bangalore enterprise pen-tests during 2025-2026, LLM01 Prompt Injection found in 87% of LLM apps; LLM06 Sensitive Info Disclosure in 62%; LLM02 Insecure Output Handling in 54%. These three are interview-must-knows.
Q. How would you mitigate LLM06 (Sensitive Information Disclosure)? ▾
Layered approach: (1) Pre-input PII redaction (Presidio, AWS Comprehend PII); (2) System prompt restrictions (explicit 'never repeat user data, system info'); (3) Output PII filters before return; (4) Training/fine-tuning data audit — remove PII before training; (5) RAG context filtering — strip PII from retrieved chunks; (6) Audit logs for prompt/response pairs (with PII redaction in logs); (7) Periodic data leakage testing using known sensitive prompts. No single layer is sufficient — defence in depth required.
Adversarial ML · 1 question
Q. Explain FGSM (Fast Gradient Sign Method) and how it bypasses ML classifiers. ▾
FGSM (Goodfellow 2014) — generates adversarial example by adding small perturbation in direction of gradient sign of loss function. Math: x_adv = x + ε · sign(∇_x J(θ, x, y)) where ε is perturbation magnitude. Result: tiny modification to input causes classifier to misclassify with high confidence. Real-world impact: malware classifier marks malware as benign with single-byte changes; image classifier confidently mislabels stop sign as 100mph speed limit. Defence: adversarial training (train on perturbed examples), randomised smoothing, certified defences.
RAG Security · 1 question
Q. What are the top 3 security risks of a production RAG system? ▾
(1) Indirect prompt injection via retrieved documents — adversary plants malicious content in indexed corpus; mitigation: content provenance + sanitisation. (2) Sensitive data leakage — RAG retrieves and exposes data user shouldn't access (cross-tenant, role violation); mitigation: per-user/per-role retrieval scoping, row-level access controls. (3) Vector database poisoning — adversary injects misleading embeddings; mitigation: embedding signature verification, anomaly detection on retrieved vectors. Bonus risks: prompt manipulation via metadata, retrieval cost exhaustion (DoS), hallucinated source attribution.
Reconnaissance · 1 question
Q. Walk me through subdomain enumeration for a target. ▾
Multi-source approach: (1) Passive sources — amass enum -passive, subfinder, assetfinder. Pull from CT logs, DNS aggregators, search engines. (2) Active resolution — massdns to verify which subdomains have live IPs. (3) Permutation/wordlist — gobuster vhost mode + custom wordlists for missed subdomains. (4) JS file analysis — extract subdomain references from target's JavaScript with subjs + mantra. (5) Combine + dedupe → final subdomain list. Critical: assets like staging/dev/admin subdomains often have weaker security than primary domain.
Splunk SPL · 2 questions
Q. Write a Splunk SPL query to detect brute-force authentication attempts. ▾
index=auth sourcetype=*ssh* OR sourcetype=*windows* action=failure | bucket _time span=5m | stats count by src_ip, _time | where count > 10 | sort -count
Key concepts: bucket _time aggregates events into 5-minute windows, stats count groups by source IP + time bucket, where filters thresholds. Tune threshold (>10) based on environment baseline. Production refinement: exclude legitimate brute-force-pattern systems (vulnerability scanners, password spray tools you authorise).
Q. How do you optimise a slow Splunk search? ▾
Optimisation hierarchy: (1) Filter early — most-restrictive index/sourcetype/host first. Splunk performs left-to-right filtering. (2) Use earliest/latest as tight as possible. (3) Avoid wildcards at start of search terms. (4) Use stats over transaction (faster). (5) Use tstats on accelerated data models when possible. (6) Use map-reduce parallelism — index-time fields beat extract-at-search-time. (7) Avoid join — use stats-based correlation instead. Example transformation: 'index=* error' → 'index=app sourcetype=app:error error' is 100× faster.
MITRE ATT&CK · 1 question
Q. What's the difference between MITRE ATT&CK and Cyber Kill Chain? ▾
Cyber Kill Chain (Lockheed Martin, 2011) — linear 7-phase model: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → C2 → Actions on Objectives. Simple, easy to teach, but oversimplified — modern attacks don't follow strict linear paths. MITRE ATT&CK (2013, expanded continuously) — graph-like 14 tactics + 200+ techniques. Reflects how adversaries actually operate (skip phases, parallel attacks, persistence loops). Industry standard since 2018. Use Kill Chain for executive briefings; ATT&CK for technical SOC operations.
Threat Hunting · 1 question
Q. What's the difference between alert-driven SOC and threat hunting? ▾
Alert-driven (reactive): SIEM/EDR generates alerts → analyst investigates → confirms + responds. Most SOC L1 work is alert-driven. Threat hunting (proactive): analyst forms hypothesis ('adversary may have established persistence via WMI subscription') → searches data without preexisting alert → either confirms threat or rules out. Hypothesis-driven hunting is L2/L3 work, not L1. PEAK framework (SANS) for hunting: Prepare, Execute, Act, Knowledge sharing. Most senior SOC roles split time: 60% alert response, 40% hunting + detection engineering.
Cloud SOC · 1 question
Q. How do AWS CloudTrail, GuardDuty, and Security Hub work together? ▾
CloudTrail — API call audit log (every action across AWS account, who/what/when/where). Free baseline + paid management/data event variants. GuardDuty — managed threat detection on CloudTrail + VPC Flow Logs + DNS logs. Outputs: alerts for known threat patterns (cryptomining, instance compromise, IAM credential abuse). Security Hub — central aggregation point for findings from GuardDuty, Macie, Inspector, third-party tools. Provides compliance scoring (CIS, NIST, PCI-DSS benchmarks). SOC analyst workflow: Security Hub → triage findings → drill into GuardDuty alert details → use CloudTrail for forensic timeline.
Networking · 1 question
Q. Why does a SOC analyst need to know networking? ▾
Most SOC investigations involve network logs (firewalls, IDS/IPS, NetFlow). Without networking foundations, you can't: (1) Read packet captures effectively (Wireshark requires TCP/IP fluency); (2) Distinguish normal vs anomalous traffic patterns (TCP handshake anomalies, port scans, unusual protocol use); (3) Validate firewall denies (was the deny correct? what would have happened if allowed?); (4) Understand cloud network logs (VPC Flow Logs, Azure NSG flow logs require networking baseline); (5) Investigate lateral movement (internal network paths, remote service access). CCNA-level depth is the minimum bar. SOC L2/L3 roles often expect Network+ or higher.
Ready for your first networking job?
Our CCNA + CCNP combo for freshers in HSR Layout, Bangalore — 8 months hands-on with real Cisco hardware, mock interviews drilling these exact questions, and direct introductions to 800+ hiring partners. Median fresher gets their first ₹4-5 LPA offer within 8 months of starting.