Computer Networks – Technical Interview Preparation

Computer Networks
Technical Interview Preparation Guide
54 Most Asked Questions with Detailed Answers

Based on TakeUForward CN Interview Sheet

Covers: OSI Model · TCP/IP · Physical · Data Link · Network · Transport · Application · Security · Troubleshooting

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

1. Introduction to Computer Networks

Q1. What is a Computer Network?

A computer network is a collection of interconnected computing devices (computers, servers, smartphones,
printers, etc.) that can communicate with each other and share resources such as data, files, and hardware.
Networks allow devices to exchange information using wired or wireless connections and follow standardized
communication protocols.
Key components: Nodes (end devices), Links (physical/wireless connections), Protocols (rules for communication),
and Network devices (routers, switches, hubs).

Q2. What are the different types of networks?

• PAN (Personal Area Network): Smallest network, range ~10 meters. Example: Bluetooth between phone and
headset.
• LAN (Local Area Network): Connects devices within a limited area (home, office, school). High speed,
privately owned. Example: Office Wi-Fi.
• MAN (Metropolitan Area Network): Spans a city or large campus. Larger than LAN but smaller than WAN.
Example: Cable TV networks.
• WAN (Wide Area Network): Covers large geographical areas (countries/continents). Example: The Internet.
• CAN (Campus Area Network): Connects multiple LANs within a campus/university.
• VPN (Virtual Private Network): A secure private network over a public network like the Internet.

Q3. What is the difference between the Internet, Intranet, and Extranet?
• Internet: A global public network accessible to everyone. Connects millions of private, public, academic, and
government networks.
• Intranet: A private network accessible only within an organization. Used for internal communication and
resource sharing.
• Extranet: An extended intranet that allows controlled access to outsiders (partners, suppliers, customers)
using internet technology but with authentication.

Q4. What is a Network Topology?

Network topology defines the physical or logical arrangement of devices in a network and how they are
interconnected.

• Bus: All devices share a single communication line. Simple but a failure in the main cable brings down the
whole network.
• Star: All devices connect to a central hub/switch. Most common; failure of one device does not affect others,
but hub failure brings down all.
• Ring: Devices are connected in a circular chain. Data travels in one or both directions. Failure of one node can
disrupt the network.
• Mesh: Every device connects to every other device. Highly reliable and fault-tolerant but expensive.
• Tree: Hierarchical topology combining star and bus. Easy to expand.
• Hybrid: Combination of two or more topologies.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

Q5. What is the difference between Bandwidth and Throughput?

• Bandwidth: The maximum amount of data that can be transmitted over a network connection in a given
period (theoretical maximum). Measured in bps, Mbps, Gbps.
• Throughput: The actual amount of data successfully delivered over a network in a given time period (real-
world measurement). Always less than or equal to bandwidth due to network congestion, latency, protocol
overhead.
Example: A road (bandwidth) may support 100 cars/hour, but traffic jams reduce actual cars passing (throughput)
to 60 cars/hour.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

2. OSI Model

Q6. What is the OSI Model? Explain all 7 layers.

The OSI (Open Systems Interconnection) model is a conceptual framework developed by ISO that standardizes
network communication into 7 distinct layers. Each layer has specific responsibilities and communicates with
layers directly above and below it.

• Layer 7 – Application: Closest to the user. Provides network services directly to applications. Protocols: HTTP,
HTTPS, FTP, SMTP, DNS, Telnet. Example: Web browser sending an HTTP request.
• Layer 6 – Presentation: Handles data translation, encryption/decryption, and compression. Converts data
formats (e.g., JPEG, MPEG, ASCII, SSL/TLS encryption). Ensures data is in a readable format for the application
layer.
• Layer 5 – Session: Manages sessions (connections) between applications. Responsible for establishing,
maintaining, and terminating communication sessions. Protocols: NetBIOS, PPTP, RPC.
• Layer 4 – Transport: Provides end-to-end communication, error recovery, and flow control. Segments data
and reassembles at the destination. Protocols: TCP (reliable), UDP (unreliable/fast). Introduces port numbers.
• Layer 3 – Network: Handles logical addressing (IP addresses) and routing of packets across networks.
Determines the best path for data delivery. Protocols: IP, ICMP, ARP, OSPF, BGP. Devices: Routers.
• Layer 2 – Data Link: Provides node-to-node data transfer. Handles MAC addressing, error detection (CRC),
and framing. Divided into LLC and MAC sublayers. Protocols: Ethernet, Wi-Fi (802.11), PPP. Devices: Switches,
Bridges.
• Layer 1 – Physical: Deals with the physical transmission of raw bits over a medium (cables, fiber, radio
waves). Defines electrical signals, cable types, pin layouts, and transmission rates. Devices: Hubs, Repeaters,
Cables.
Memory tip: 'All People Seem To Need Data Processing' (Application → Physical) or 'Please Do Not Throw Sausage
Pizza Away' (Physical → Application).

Q7. What is the difference between the OSI model and the TCP/IP model?
• Layers: OSI has 7 layers; TCP/IP has 4 layers (Application, Transport, Internet, Network Access).
• Development: OSI is a theoretical/conceptual model by ISO; TCP/IP is a practical model developed by DARPA,
actually used in the Internet.
• Protocols: OSI is protocol-independent; TCP/IP is built around specific protocols (TCP, IP, UDP, etc.).
• Usage: OSI is used as a reference/teaching model; TCP/IP is the actual working model of the Internet.
• Mapping: TCP/IP Application layer combines OSI's Application + Presentation + Session layers. TCP/IP
Network Access layer combines OSI's Data Link + Physical layers.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

3. TCP/IP Model

Q8. Explain the TCP/IP model and its layers.

The TCP/IP model (Transmission Control Protocol/Internet Protocol) is the practical networking model that
powers the Internet. It has 4 layers:

• Application Layer: Combines OSI Application, Presentation, and Session layers. Handles high-level protocols
for user interaction. Protocols: HTTP, HTTPS, FTP, SMTP, DNS, SSH, DHCP.
• Transport Layer: Provides end-to-end communication using TCP or UDP. TCP provides reliable, ordered,
connection-oriented delivery. UDP provides fast, connectionless, best-effort delivery.
• Internet Layer: Corresponds to OSI Network layer. Handles IP addressing and routing. Protocols: IP
(IPv4/IPv6), ICMP, ARP, IGMP.
• Network Access Layer: Combines OSI Data Link and Physical layers. Handles hardware addressing (MAC),
framing, and physical transmission. Protocols: Ethernet, Wi-Fi, PPP.

Q9. What is TCP? How does the TCP 3-way handshake work?
TCP (Transmission Control Protocol) is a connection-oriented, reliable transport layer protocol that guarantees
ordered and error-free delivery of data between applications.
The 3-Way Handshake establishes a connection before data transfer:

• Step 1 – SYN: Client sends a SYN (synchronize) packet to the server with a random Initial Sequence Number
(ISN). Client enters SYN_SENT state.
• Step 2 – SYN-ACK: Server responds with SYN-ACK packet: acknowledges client's SYN (ACK = Client_ISN + 1)
and sends its own SYN with server's ISN. Server enters SYN_RECEIVED state.
• Step 3 – ACK: Client sends ACK packet acknowledging server's SYN (ACK = Server_ISN + 1). Connection is now
ESTABLISHED. Data transfer begins.
Connection Termination (4-Way): FIN → ACK → FIN → ACK. The extra step is because server may still have data to
send after receiving client's FIN.

Q10. What is the difference between TCP and UDP?

• Connection: TCP is connection-oriented (3-way handshake); UDP is connectionless (no handshake).
• Reliability: TCP guarantees delivery with acknowledgments and retransmission; UDP offers no guarantee
(best-effort).
• Ordering: TCP ensures packets arrive in order; UDP does not.
• Speed: UDP is faster (no overhead); TCP is slower due to acknowledgment and error-checking mechanisms.
• Flow/Congestion Control: TCP has both; UDP has neither.
• Header Size: TCP header is 20-60 bytes; UDP header is just 8 bytes.
• Use Cases: TCP: HTTP, HTTPS, FTP, SMTP, SSH (where accuracy matters). UDP: Video streaming, VoIP, DNS,
online gaming (where speed matters more).

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

4. Physical Layer

Q11. What is the Physical Layer responsible for?

The Physical Layer (Layer 1) is the lowest layer of the OSI model. It deals with the actual physical transmission of
raw bits (0s and 1s) over a communication medium. Responsibilities include:

• Bit transmission: Converting data into electrical signals, light pulses, or radio waves.
• Physical medium specification: Defines cable types (coaxial, twisted pair, fiber optic), connectors, and pin
layouts.
• Signal encoding: How bits are represented as signals (e.g., NRZ, Manchester encoding).
• Data rate control: Defines transmission speed (bits per second).
• Synchronization: Ensuring sender and receiver are synchronized at the bit level.
• Transmission mode: Simplex, Half-duplex, Full-duplex.
Devices: Hubs, Repeaters, Cables, Modems, Network Interface Cards (NIC).

Q12. What are the different types of transmission media?

Guided (Wired) Media:

• Twisted Pair Cable: Pairs of copper wires twisted together to reduce electromagnetic interference. Types:
UTP (Unshielded – common in LANs) and STP (Shielded – better noise immunity). Categories: Cat5e, Cat6,
Cat6a.
• Coaxial Cable: Central copper conductor surrounded by insulation and a metal shield. Used in cable TV and
broadband internet. Higher bandwidth than twisted pair.
• Fiber Optic Cable: Transmits data as pulses of light through glass/plastic fibers. Very high bandwidth, immune
to electromagnetic interference, long distances. Types: Single-mode (long distance) and Multi-mode (short
distance).
Unguided (Wireless) Media:

• Radio Waves: Long range, can penetrate walls. Used in Wi-Fi, Bluetooth, cellular networks.
• Microwaves: High frequency, line-of-sight transmission. Used in satellite communication and point-to-point
links.
• Infrared: Short range, line-of-sight. Used in TV remotes and IrDA devices.

Q13. What is the difference between Simplex, Half-Duplex, and Full-Duplex transmission?
• Simplex: Data flows in ONE direction only. Sender cannot receive; receiver cannot send. Example: TV
broadcast, keyboard to computer.
• Half-Duplex: Data flows in BOTH directions but NOT simultaneously. One side transmits while the other
receives. Example: Walkie-talkie, old Ethernet hubs.
• Full-Duplex: Data flows in BOTH directions SIMULTANEOUSLY. Both sides can send and receive at the same
time. Example: Phone call, modern Ethernet switches, HTTP/2.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

5. Data Link Layer

Q14. What is the Data Link Layer responsible for?

The Data Link Layer (Layer 2) provides node-to-node data transfer between two directly connected devices. It is
divided into two sublayers:

• LLC (Logical Link Control): Manages flow control and error control between the network layer and MAC
sublayer.
• MAC (Media Access Control): Controls how devices access the shared communication medium. Provides
hardware addressing using MAC addresses.
Key functions: Framing, Physical Addressing (MAC), Error Detection (CRC/checksum), Flow Control, Access
Control.
Devices: Switches, Bridges. Protocols: Ethernet, Wi-Fi (IEEE 802.11), PPP, HDLC.

Q15. What is a MAC Address?

A MAC (Media Access Control) address is a unique hardware identifier assigned to a Network Interface Card (NIC)
by the manufacturer. It is used for communication within the same network (Layer 2).

• Format: 48-bit address written as 6 groups of 2 hexadecimal digits. Example: AA:BB:CC:DD:EE:FF.

• First 3 bytes (OUI): Identifies the manufacturer (e.g., AA:BB:CC is the Organizationally Unique Identifier).
• Last 3 bytes: Unique identifier assigned by the manufacturer for that specific device.
• MAC addresses are burned into hardware (though they can be spoofed in software).
• Used by Ethernet switches to forward frames to the correct port.
Difference from IP: MAC is a physical/hardware address that doesn't change; IP is a logical address that can
change and is used for routing across networks.

Q16. What is ARP (Address Resolution Protocol)?

ARP is a protocol used to map a known IP address to an unknown MAC address within the same local network. It
operates between the Network and Data Link layers.
How ARP works:

• Device A wants to send data to [Link] but doesn't know its MAC address.
• A broadcasts an ARP Request: 'Who has IP [Link]? Tell [Link] (my IP).'
• All devices on the network receive this broadcast.
• The device with IP [Link] replies with an ARP Reply: 'I am [Link], my MAC is AA:BB:CC:DD:EE:FF.'
• Device A stores this mapping in its ARP cache for future use.
ARP Cache: A temporary table of IP-to-MAC mappings stored locally to avoid repeated ARP broadcasts.
RARP (Reverse ARP): Maps MAC address to IP address. Largely replaced by DHCP.
Gratuitous ARP: A device sends an ARP reply without being asked, used to detect IP conflicts or update network
caches.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

Q17. What is the difference between a Hub, Switch, and Router?

• Hub (Layer 1 – Physical): Broadcasts incoming data to ALL connected ports. No intelligence; doesn't know
about MAC or IP. Creates a single collision domain. Largely obsolete.
• Switch (Layer 2 – Data Link): Forwards frames based on MAC address table. Sends data only to the specific
destination port. Each port is its own collision domain. More efficient than hub.
• Router (Layer 3 – Network): Routes packets between different networks using IP addresses. Maintains a
routing table. Connects LANs to WANs (e.g., home router connecting LAN to ISP). Each interface is a separate
broadcast domain.

Q18. What are the error detection methods used in the Data Link Layer?
• Parity Check: Adds a parity bit (even or odd) to each data block. Simple but can only detect odd numbers of
bit errors. Cannot detect even number of errors or correct errors.
• Checksum: Sender divides data into segments, adds them, and sends the sum's complement. Receiver adds
all segments including checksum; result should be all 1s. Used in TCP/UDP/IP headers.
• CRC (Cyclic Redundancy Check): Most powerful and widely used. Treats data as a binary polynomial and
divides by a generator polynomial. Remainder is the CRC (FCS – Frame Check Sequence). Can detect burst
errors. Used in Ethernet, Wi-Fi.
• Hamming Code: Can detect AND correct single-bit errors. Uses redundant bits placed at power-of-2
positions.

Q19. What is CSMA/CD and CSMA/CA?

• CSMA/CD (Carrier Sense Multiple Access / Collision Detection): Used in wired Ethernet networks. Before
transmitting, a device listens (Carrier Sense) to see if the medium is free. If two devices transmit
simultaneously, a collision is detected. Both stop, wait a random backoff time (Binary Exponential Backoff),
then retransmit.
• CSMA/CA (Collision Avoidance): Used in wireless networks (Wi-Fi / 802.11) where collision detection is not
possible. Instead of detecting collisions, it tries to avoid them. Device waits for a random backoff before
transmitting. Can also use RTS/CTS (Request to Send / Clear to Send) to reserve the channel. More overhead
than CSMA/CD but necessary for wireless.

Q20. What is the Sliding Window Protocol?

The Sliding Window Protocol is a flow control mechanism used in the Data Link and Transport layers to allow the
sender to transmit multiple frames before requiring an acknowledgment, improving efficiency over stop-and-
wait.

• Go-Back-N (GBN): Sender can have up to N unacknowledged frames (window size N). If frame i is
lost/corrupted, sender retransmits frame i and ALL subsequent frames (i+1, i+2,...). Receiver discards all
frames after the error. Simpler receiver; wasteful if window is large.
• Selective Repeat (SR): Sender retransmits ONLY the specific lost/corrupted frame. Receiver buffers out-of-
order frames. More efficient than GBN but requires more receiver memory/complexity.

Q21. What is the difference between a Bridge and a Switch?

• Bridge: Early Layer 2 device. Segments a network into two parts. Has fewer ports (typically 2-4). Software-
based forwarding. Used to divide collision domains.
TakeUForward CN Sheet • All 54 Questions Page N
Computer Networks – Technical Interview Preparation

• Switch: Modern evolution of the bridge. Has many ports (8, 16, 24, 48+). Hardware-based forwarding (ASICs)
– much faster. Maintains a MAC address table for each port. Effectively replaced bridges in modern networks.
Both operate at Layer 2 and use MAC addresses for forwarding decisions. A switch is essentially a multi-port
bridge with hardware acceleration.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

6. Network Layer

Q22. What is the Network Layer responsible for?

The Network Layer (Layer 3) is responsible for logical addressing, routing, and forwarding of packets across
multiple networks (inter-network communication). Key responsibilities:

• Logical Addressing: IP addresses uniquely identify devices across networks.

• Routing: Determining the best path for data to travel from source to destination across multiple networks.
• Packet Forwarding: Moving packets from incoming to outgoing interfaces based on routing tables.
• Fragmentation & Reassembly: Breaking large packets into smaller pieces to fit the MTU of a network and
reassembling at destination.
• Error Reporting: ICMP reports errors and control information (e.g., ping uses ICMP Echo Request/Reply).
Devices: Routers, Layer 3 Switches. Protocols: IPv4, IPv6, ICMP, OSPF, BGP, RIP, ARP.

Q23. What is an IP Address? Explain IPv4 and IPv6.

An IP (Internet Protocol) address is a unique logical identifier assigned to each device on a network, used for
routing packets across networks.
IPv4:

• 32-bit address, written as 4 decimal octets separated by dots. Example: [Link]

• Supports ~4.3 billion unique addresses (2^32).
• Classes: A ([Link] – [Link]), B ([Link] – [Link]), C ([Link] – [Link]), D
(Multicast), E (Reserved).
• NAT (Network Address Translation) was invented to deal with IPv4 exhaustion.
IPv6:

• 128-bit address written as 8 groups of 4 hexadecimal digits. Example:

2001:0db8:85a3:0000:0000:8a2e:0370:7334
• Supports ~3.4 × 10^38 unique addresses – effectively unlimited.
• Built-in IPSec support, no need for NAT, better autoconfiguration.
• Uses :: notation to compress consecutive groups of zeros.

Q24. What is Subnetting?

Subnetting is the practice of dividing a larger IP network into smaller sub-networks (subnets). It allows more
efficient use of IP address space and improves network organization and security.
Subnet Mask: A 32-bit number that divides the IP address into Network and Host portions. Example:
[Link] (/24) means first 24 bits are the network.
CIDR Notation: Written as IP/prefix-length. Example: [Link]/24 (256 addresses, 254 usable hosts).
Subnetting example: [Link]/24 can be split into [Link]/25 (hosts .1–.126) and [Link]/25 (hosts
.129–.254).

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

Formula: Usable hosts = 2^(32 - prefix) - 2 (subtract network and broadcast addresses).
Benefits: Reduces broadcast domain size, improves security, enables better IP management, allows VLSM
(Variable Length Subnet Masking).

Q25. What is NAT (Network Address Translation)?

NAT is a technique where a router modifies network address information in packet headers as they pass through,
mapping private IP addresses to one (or more) public IP addresses.
Why NAT is needed: IPv4 has only ~4.3 billion addresses. Private addresses (192.168.x.x, 10.x.x.x, 172.16.x.x –
172.31.x.x) are not routable on the Internet. NAT allows many private devices to share a single public IP.

• Static NAT: One private IP is mapped to one specific public IP. Used for servers.
• Dynamic NAT: Private IPs are mapped to a pool of public IPs on demand.
• PAT (Port Address Translation) / NAT Overload: Multiple private IPs share a SINGLE public IP, differentiated
by unique port numbers. Most common form (used in home routers).
Limitations: NAT breaks end-to-end connectivity, complicates peer-to-peer applications, and introduces latency.

Q26. What is the difference between Static Routing and Dynamic Routing?
• Static Routing: Routes are manually configured by the administrator. No overhead from routing protocols.
Best for small, stable networks. Does not adapt to topology changes automatically.
• Dynamic Routing: Routes are automatically discovered and updated by routing protocols. Adapts to network
changes (link failures, new paths). Examples: RIP, OSPF, EIGRP, BGP.
Dynamic Routing Protocols:

• RIP (Routing Information Protocol): Distance-vector. Uses hop count as metric (max 15 hops). Slow
convergence. Simple but not scalable.
• OSPF (Open Shortest Path First): Link-state protocol. Uses Dijkstra's algorithm. Fast convergence, scalable.
Suitable for large enterprise networks.
• BGP (Border Gateway Protocol): Path-vector protocol. Used between autonomous systems on the Internet
(inter-domain routing). The routing protocol of the Internet.
• EIGRP: Cisco proprietary. Hybrid (distance-vector + link-state features). Fast convergence.

Q27. What is ICMP and what is it used for?

ICMP (Internet Control Message Protocol) is a Network layer protocol used for error reporting and network
diagnostics. It does not carry user data but provides feedback about network conditions.
Common uses:

• Ping: Uses ICMP Echo Request and Echo Reply to test reachability and measure round-trip time (RTT).
• Traceroute: Uses ICMP Time Exceeded messages to map the path packets take to a destination by
incrementing the TTL field.
• Error reporting: Destination Unreachable, Time Exceeded, Redirect, Source Quench messages.
ICMP is connectionless and unreliable. It cannot be used to transfer data. Firewalls sometimes block ICMP for
security reasons.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

Q28. What is TTL (Time To Live)?

TTL is a field in the IP packet header (8 bits) that limits the lifetime of a packet in the network. It starts at an initial
value (typically 64, 128, or 255 depending on the OS) and is decremented by 1 at each router (hop).
When TTL reaches 0, the router discards the packet and sends an ICMP 'Time Exceeded' message back to the
sender. This prevents packets from circulating indefinitely in routing loops.
Uses:

• Traceroute exploits TTL by sending packets with TTL=1, TTL=2, TTL=3... Each router that discards the packet
reveals its IP address, mapping the path.
• DNS TTL specifies how long a DNS record should be cached.

Q29. What is a Default Gateway?

A default gateway is the IP address of the router that a device uses to send packets destined for IP addresses
outside its local subnet. It is the 'exit point' from a local network to the rest of the Internet or other networks.
How it works: When a device wants to communicate with an IP address not in its local subnet, it forwards the
packet to the default gateway (router). The router then routes the packet toward the destination.
Example: Home network [Link]/24. Your computer has IP [Link]. Default gateway (router) is
[Link]. To reach [Link] (external), your computer sends the packet to [Link] (the gateway).

Q30. What is DHCP? How does it work?

DHCP (Dynamic Host Configuration Protocol) is an application layer protocol that automatically assigns IP
addresses and other network configuration parameters (subnet mask, gateway, DNS server) to devices when they
connect to a network.
DORA Process (4-step handshake):

• D – Discover: Client broadcasts a DHCP Discover message on the network (because it has no IP yet).
Destination: [Link] (broadcast).
• O – Offer: DHCP server responds with a DHCP Offer, proposing an IP address, lease time, and network config.
• R – Request: Client broadcasts a DHCP Request to accept the offered IP (also informs other DHCP servers it
didn't choose them).
• A – Acknowledge: DHCP server sends a DHCP ACK confirming the IP assignment. Client configures its network
interface.
DHCP Lease: IP addresses are assigned for a limited time (lease duration). Before expiry, client can request a
renewal.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

7. Transport Layer

Q31. What is the Transport Layer responsible for?

The Transport Layer (Layer 4) provides end-to-end communication between processes on different hosts. It
manages data segmentation, reassembly, flow control, error control, and multiplexing.
Key responsibilities:

• Segmentation & Reassembly: Breaks application data into segments (TCP) or datagrams (UDP) and
reassembles at the receiver.
• Port Numbers: Identifies specific applications/processes. Source and destination ports multiplexed to allow
multiple simultaneous connections. Well-known ports: 0–1023 (HTTP:80, HTTPS:443, FTP:21, SSH:22,
DNS:53).
• Flow Control: Prevents the sender from overwhelming the receiver. TCP uses a sliding window and receiver
advertises its receive window size.
• Congestion Control: Prevents the sender from overwhelming the network. TCP uses algorithms like Slow
Start, Congestion Avoidance, Fast Retransmit, Fast Recovery.
• Error Control: Detects and retransmits lost or corrupted segments (TCP only).
• Connection Management: TCP establishes and tears down connections (3-way handshake and 4-way FIN).

Q32. What are well-known port numbers?

• FTP: Port 20 (data), 21 (control)
• SSH: Port 22
• Telnet: Port 23 (unencrypted – avoid)
• SMTP: Port 25 (email sending)
• DNS: Port 53 (UDP for queries, TCP for zone transfers)
• HTTP: Port 80
• HTTPS: Port 443
• POP3: Port 110 (email retrieval)
• IMAP: Port 143 (email retrieval, keeps mail on server)
• RDP: Port 3389 (Remote Desktop Protocol)
• MySQL: Port 3306
• PostgreSQL: Port 5432
• MongoDB: Port 27017

Q33. What is Flow Control and how does TCP implement it?
Flow control ensures the sender does not transmit data faster than the receiver can process it, preventing buffer
overflow at the receiver.
TCP implements flow control using the Receive Window (rwnd):

• The receiver advertises its available buffer space in the TCP header (Window Size field).
• The sender can only have unacknowledged data up to the amount of the advertised window.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

• If the receiver's buffer fills up, it sets window size to 0 (Zero Window), stopping the sender.
• When the receiver frees buffer space, it sends a Window Update to resume transmission.
Silly Window Syndrome: Inefficiency where small window sizes lead to tiny segments. Solved by Clark's Algorithm
(receiver-side) and Nagle's Algorithm (sender-side – buffers small writes).

Q34. What is Congestion Control in TCP?

Congestion control prevents the network from being overwhelmed by too much data, which causes routers to
drop packets and degrade performance for all users.
TCP congestion control uses Congestion Window (cwnd) and employs these algorithms:

• Slow Start: cwnd starts at 1 MSS and doubles every RTT (exponential growth) until it reaches the Slow Start
Threshold (ssthresh). Despite its name, growth is fast.
• Congestion Avoidance: After cwnd reaches ssthresh, growth slows to linear (adds 1 MSS per RTT). When
congestion is detected (timeout or 3 duplicate ACKs): cwnd is reduced.
• Fast Retransmit: On receiving 3 duplicate ACKs, retransmit the lost segment immediately without waiting for
a timeout.
• Fast Recovery: After fast retransmit, set cwnd = ssthresh + 3 MSS and continue with congestion avoidance
(instead of slow start). Used in TCP Reno/CUBIC.
• TCP CUBIC: Modern default in Linux. Uses a cubic function for cwnd growth, better for high-bandwidth, high-
latency networks.

Q35. What is a Socket?

A socket is an endpoint for network communication, defined by the combination of an IP address and a port
number. It is the programming interface (API) through which applications access the transport layer.
Socket is identified by: IP Address + Port Number (e.g., [Link]:80)
Types of sockets:

• Stream Socket (SOCK_STREAM): Uses TCP. Provides reliable, ordered, connection-oriented communication.
• Datagram Socket (SOCK_DGRAM): Uses UDP. Connectionless, unreliable, faster.
• Raw Socket: Allows direct access to lower-level protocols. Used for custom protocol implementations and
network tools (ping, traceroute).
Socket Pair: A connection is uniquely identified by (Source IP, Source Port, Destination IP, Destination Port,
Protocol). This is why a server on port 80 can handle thousands of simultaneous connections.

Q36. What is the difference between connection-oriented and connectionless communication?

• Connection-Oriented (TCP): Requires establishment of a connection before data transfer (3-way handshake).
Provides reliability, ordering, and flow/congestion control. More overhead. Suitable for applications requiring
accuracy: HTTP, FTP, SSH, email.
• Connectionless (UDP): No connection setup. Sender just transmits datagrams directly. No reliability
guarantees. Very low overhead and latency. Suitable for real-time applications: video streaming, VoIP, DNS,
online gaming.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

8. Session Layer

Q37. What is the Session Layer and what does it do?

The Session Layer (Layer 5 of OSI) manages the establishment, maintenance, and termination of communication
sessions between applications. A 'session' is a logical connection between two application processes.
Key functions:

• Session Establishment, Maintenance & Termination: Sets up communication sessions, keeps them alive
during data exchange, and closes them gracefully.
• Synchronization: Adds checkpoints (synchronization points) to data streams so that if a connection breaks,
transmission can resume from the last checkpoint rather than from the beginning.
• Dialog Control: Manages half-duplex or full-duplex communication between nodes.
• Session Restoration: Allows resumption of interrupted sessions.
Note: In practice, the TCP/IP model does not have a separate Session layer. Session management is handled by
the Application and Transport layers (e.g., HTTP sessions via cookies, TLS sessions).
Protocols: NetBIOS (Network Basic Input/Output System), RPC (Remote Procedure Call), PPTP, SQL session
management.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

9. Presentation Layer

Q38. What is the Presentation Layer responsible for?

The Presentation Layer (Layer 6 of OSI) acts as a translator between the application layer and the network. It
ensures data is in a usable format when it arrives at the application.
Key responsibilities:

• Data Translation: Converts data between formats used by the application and the network. Example:
Converting EBCDIC to ASCII, translating character encoding.
• Encryption & Decryption: Encrypts data at the sender for security and decrypts at the receiver. SSL/TLS
operates conceptually at this layer.
• Data Compression: Reduces the size of data to improve transmission efficiency. Formats: JPEG, MPEG, GIF,
ZIP.
• Serialization: Converts complex data structures into a format suitable for network transmission (e.g., JSON,
XML, Protocol Buffers).
Note: Like the Session layer, in practice the Presentation layer's functions are handled by the Application layer in
TCP/IP (e.g., TLS in HTTPS, JSON encoding in REST APIs).
Formats: ASCII, Unicode, JPEG, MPEG, MP3, SSL/TLS, XML, JSON.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

10. Application Layer

Q39. What is the Application Layer responsible for?

The Application Layer (Layer 7 of OSI, topmost layer) is the closest to the end user and provides network services
directly to user applications. It does not refer to the applications themselves but to the protocols that
applications use to communicate over a network.
Key protocols and their purposes:

• HTTP/HTTPS: Web browsing (port 80/443)

• FTP: File transfer (ports 20/21)
• SMTP: Sending email (port 25)
• POP3/IMAP: Receiving email (ports 110/143)
• DNS: Domain name resolution (port 53)
• DHCP: IP address assignment (ports 67/68)
• SSH: Secure remote access (port 22)
• Telnet: Unsecure remote access (port 23)
• SNMP: Network device management (port 161)

Q40. What is DNS and how does it work?

DNS (Domain Name System) translates human-readable domain names (e.g., [Link]) into machine-
readable IP addresses (e.g., [Link]). It is often called the 'phonebook of the Internet.'
DNS Resolution Process (Recursive):

• 1. Browser Cache Check: Browser first checks its own DNS cache.
• 2. OS Cache: Checks the operating system's DNS cache and /etc/hosts file.
• 3. Recursive Resolver: If not cached, the query goes to the ISP's Recursive Resolver (also called DNS Resolver
or Recursor).
• 4. Root Name Server: Resolver queries a Root Name Server. It doesn't know the answer but directs to the
TLD Name Server (e.g., .com, .org server).
• 5. TLD Name Server: Returns the address of the Authoritative Name Server for the specific domain.
• 6. Authoritative Name Server: Returns the actual IP address for the requested domain.
• 7. Response: Resolver returns the IP to the browser and caches the result per the TTL value.
DNS Record Types: A (IPv4 address), AAAA (IPv6), CNAME (alias), MX (mail server), NS (name server), TXT (text,
used for SPF/DKIM), PTR (reverse lookup).

Q41. What is HTTP? What is the difference between HTTP/1.1, HTTP/2, and HTTP/3?
HTTP (HyperText Transfer Protocol) is the foundation of data communication on the World Wide Web. It is a
stateless, application-layer protocol for transmitting hypermedia documents.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

• HTTP/1.1: Introduced persistent connections (keep-alive), chunked transfer encoding, and host headers.
However, it processes requests sequentially (Head-of-Line blocking). Multiple requests require multiple TCP
connections (browsers open 6 parallel connections to same domain).
• HTTP/2: Major performance upgrade. Binary framing instead of text. Multiplexing: multiple
requests/responses over a single TCP connection simultaneously. Header compression (HPACK). Server Push
capability. Still suffers from TCP-level Head-of-Line blocking.
• HTTP/3: Based on QUIC protocol (runs over UDP instead of TCP). Eliminates TCP Head-of-Line blocking. Built-
in TLS 1.3 encryption. Faster connection establishment (0-RTT or 1-RTT). Better performance on lossy
networks (mobile). Used by major platforms (Google, Meta, Cloudflare).

Q42. What is the difference between GET and POST methods in HTTP?
• GET: Retrieves data from the server. Parameters included in the URL (query string). Idempotent (same
request = same result). Can be cached and bookmarked. Not suitable for sensitive data. Limited URL length
(~2048 chars). Example: Searching Google.
• POST: Submits data to the server (to create/update a resource). Data in the request body. Not idempotent
(repeated requests may create multiple records). Not cached or bookmarked. Suitable for sensitive data
(password in form). No size limit. Example: Login form, file upload.

Q43. What is HTTPS? How does SSL/TLS work?

HTTPS (HTTP Secure) is HTTP with an added layer of security via SSL/TLS (Secure Sockets Layer / Transport Layer
Security). It encrypts all communication between the browser and server, ensuring confidentiality, integrity, and
authentication.
TLS Handshake (TLS 1.2 simplified):

• 1. Client Hello: Client sends supported TLS versions, cipher suites, and a random number.
• 2. Server Hello: Server selects the TLS version and cipher suite, sends its SSL certificate (containing its public
key) and a random number.
• 3. Certificate Verification: Client verifies the server's certificate against trusted Certificate Authorities (CAs).
• 4. Key Exchange: Client generates a pre-master secret, encrypts it with the server's public key, and sends it.
Both sides generate the same session keys from the pre-master secret and random numbers.
• 5. Finished: Both sides send encrypted 'Finished' messages. All subsequent communication is encrypted with
the symmetric session key.
TLS 1.3 improvement: Reduces the handshake to 1-RTT (and supports 0-RTT for resumption). Removed weak
cipher suites. More secure and faster.
Certificates: Issued by Certificate Authorities (CA). Types: DV (Domain Validated), OV (Organization Validated), EV
(Extended Validation). Let's Encrypt provides free DV certificates.

Q44. What is FTP? What is the difference between Active and Passive FTP?
FTP (File Transfer Protocol) is an application-layer protocol for transferring files between client and server. It uses
TWO separate connections: a Control connection (port 21) and a Data connection (port 20 or a dynamic port).

• Active FTP: Client connects to server port 21 (control). Client tells server 'connect to MY IP:PORT for data.'
Server initiates the data connection back to the client. Problem: Client-side firewalls/NAT block incoming
connections from the server.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

• Passive FTP: Client connects to server port 21 (control). Client asks server for a data port. Server opens a
random high-numbered port and tells the client. Client initiates both connections. Firewall-friendly since all
connections are initiated by the client.
SFTP (SSH FTP): Completely different protocol that tunnels file transfer over SSH (port 22). Fully encrypted.
Recommended over FTP.
FTPS: FTP with SSL/TLS encryption added. Different from SFTP.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

11. Network Security

Q45. What is a Firewall?

A firewall is a network security device (hardware or software) that monitors and controls incoming and outgoing
network traffic based on predefined security rules. It acts as a barrier between trusted internal networks and
untrusted external networks (like the Internet).
Types of Firewalls:

• Packet Filtering Firewall: Inspects packets at the Network/Transport layer. Makes decisions based on
source/destination IP, port, and protocol. Stateless – doesn't track connection state. Fast but limited.
• Stateful Inspection Firewall: Tracks the state of active connections. Allows only packets that are part of an
established, legitimate connection. More secure than packet filtering.
• Application Layer Firewall (WAF): Inspects traffic at Layer 7 (application content). Can detect SQL injection,
XSS, malicious HTTP requests. More resource-intensive.
• Next-Generation Firewall (NGFW): Combines stateful inspection with application awareness, deep packet
inspection (DPI), intrusion prevention (IPS), and SSL inspection.

Q46. What is a VPN (Virtual Private Network)?

A VPN creates a secure, encrypted tunnel over a public network (Internet), allowing remote users or offices to
communicate as if they were on a private network.
How it works: VPN client encrypts all traffic → Sends it through an encrypted tunnel to the VPN server → VPN
server decrypts and forwards it to the destination → Response follows the same path back.

• Site-to-Site VPN: Connects two entire networks (e.g., branch office LAN to headquarters LAN). Users don't
need VPN client software.
• Remote Access VPN: Individual users connect to a corporate network from anywhere. Used by remote
workers.
VPN Protocols:

• IPSec: Gold standard for VPNs. Provides strong encryption at the Network layer. Can work in Tunnel mode
(entire packet encrypted) or Transport mode.
• OpenVPN: Open-source, highly secure, runs over TCP or UDP.
• WireGuard: Modern, fast, simple VPN protocol with excellent performance.
• L2TP/IPSec: Layer 2 Tunneling Protocol combined with IPSec for encryption.
• PPTP: Old, fast but weak security. Not recommended.

Q47. What is an IDS vs IPS?

• IDS (Intrusion Detection System): Monitors network traffic and system activity for malicious behavior or
policy violations. DETECTS and ALERTS only – does not block traffic. Placed out-of-band (passive monitoring).
Like a security camera that records but doesn't act.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

• IPS (Intrusion Prevention System): Actively MONITORS, DETECTS, and BLOCKS malicious traffic in real-time.
Placed in-line in the network path. Can drop packets, reset connections, or block IP addresses automatically.
Like a security guard that can physically stop intruders.
Detection Methods (both):

• Signature-based: Compares traffic against known attack patterns/signatures. Cannot detect zero-day attacks.
• Anomaly-based: Establishes a baseline of normal behavior and alerts on deviations. Can detect novel attacks
but may have false positives.
• Hybrid: Combines both methods.

Q48. What is a DoS attack vs a DDoS attack?

• DoS (Denial of Service): A single attacker/system floods a target (server, network, service) with excessive
traffic or requests, overwhelming its resources and making it unavailable to legitimate users.
• DDoS (Distributed Denial of Service): Same goal but uses MULTIPLE compromised systems (botnet – often
thousands or millions of computers) to launch the attack simultaneously. Much harder to block because
traffic comes from many different IP addresses.
Common DDoS types:

• Volumetric attacks: Flood the bandwidth (UDP flood, ICMP flood). Measured in Gbps.
• Protocol attacks: Exploit weaknesses in network protocols (SYN flood – exhausts TCP connection table, Ping
of Death).
• Application layer attacks: Target specific application functions (HTTP flood, Slowloris – holds connections
open).
Mitigation: Rate limiting, CAPTCHAs, anycast network diffusion, scrubbing centers, CDN providers (Cloudflare,
AWS Shield).

Q49. What is a Man-in-the-Middle (MITM) attack?

A MITM attack occurs when an attacker secretly intercepts and possibly alters communication between two
parties who believe they are communicating directly with each other.
How it works: Alice → [Attacker intercepts] → Bob. The attacker can eavesdrop, modify data, inject malicious
content, or steal credentials without either party knowing.
Common MITM techniques:

• ARP Spoofing/Poisoning: Attacker sends fake ARP replies to associate their MAC address with the gateway
IP, causing traffic to pass through the attacker.
• DNS Spoofing: Attacker poisons the DNS cache to redirect users to malicious websites.
• SSL Stripping: Attacker downgrades HTTPS connection to HTTP.
• Evil Twin Wi-Fi: Attacker creates a fake Wi-Fi hotspot with the same SSID as a legitimate network.
Prevention: Use HTTPS/TLS, enable HSTS (HTTP Strict Transport Security), use strong encryption, verify
certificates, use VPNs on public Wi-Fi, use DNSSEC.

Q50. What is a Cookie? What is the difference between a Session Cookie and a Persistent Cookie?
A cookie is a small piece of data stored by the browser on behalf of a website, used to maintain state, track users,
and store preferences since HTTP is stateless.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

• Session Cookie: Temporary cookie. Stored only in browser memory (RAM). Deleted when the browser is
closed. Used for session management (login state, shopping cart). No expiry date set.
• Persistent Cookie: Stored on disk with a specified expiry date. Survives browser restarts. Used for 'Remember
Me' functionality, analytics, tracking preferences.
Security attributes:

• HttpOnly: Cookie cannot be accessed via JavaScript ([Link]). Prevents XSS cookie theft.
• Secure: Cookie is only sent over HTTPS connections.
• SameSite: Controls cross-site cookie sending. Values: Strict (only same-site), Lax (allows navigational GET),
None (cross-site, requires Secure). Prevents CSRF attacks.

Q51. What is SQL Injection from a network/security perspective?

SQL Injection is an attack where malicious SQL code is inserted into input fields that are then executed by the
database, allowing attackers to manipulate, steal, or destroy database contents.
Example: Login form with username field. Attacker enters: admin' OR '1'='1
The resulting SQL becomes: SELECT * FROM users WHERE username = 'admin' OR '1'='1' AND password = ''
Since '1'='1' is always true, the attacker bypasses authentication.
Prevention:

• Parameterized Queries / Prepared Statements: Most effective. SQL structure is defined separately from user
input, so input cannot change query logic.
• Input Validation: Validate and sanitize all user inputs. Whitelist allowed characters.
• Stored Procedures: Can prevent injection when implemented correctly.
• Principle of Least Privilege: Database accounts should only have the minimum permissions needed.
• WAF: Web Application Firewall can detect and block common injection patterns.

Q52. What is the difference between Symmetric and Asymmetric Encryption?

• Symmetric Encryption: Same key is used for both encryption and decryption. Fast and efficient for large data.
Key distribution problem: how to securely share the key? Examples: AES (128/256-bit), DES, 3DES. Use cases:
Encrypting files, data at rest, VPN bulk data encryption.
• Asymmetric Encryption: Uses a key pair: Public Key (encrypts, can be shared openly) and Private Key
(decrypts, kept secret). Much slower than symmetric. Solves the key distribution problem. Examples: RSA,
ECC, Diffie-Hellman. Use cases: TLS handshake, digital signatures, certificate-based authentication.
Hybrid approach (used in TLS/HTTPS): Asymmetric encryption is used to securely exchange a symmetric session
key. Then, fast symmetric encryption handles the bulk data transfer. This gives both security and performance.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

12. Network Troubleshooting

Q53. What happens when you type a URL in your browser and press Enter?
This is one of the most famous interview questions. Here is the complete end-to-end flow:

• 1. URL Parsing: Browser parses the URL into: protocol (HTTPS), domain ([Link]), path (/search?
q=hello).
• 2. HSTS Check: Browser checks if the domain is in the HSTS preload list (forces HTTPS).
• 3. DNS Resolution: Browser checks DNS cache → OS cache → /etc/hosts → Recursive DNS Resolver → Root
NS → TLD NS → Authoritative NS → Returns IP address (e.g., [Link]).
• 4. TCP Connection: Browser initiates TCP 3-way handshake with the server's IP on port 443.
• 5. TLS Handshake: TLS handshake occurs: certificate verification, cipher suite negotiation, session key
establishment. Secure encrypted tunnel is ready.
• 6. HTTP Request: Browser sends HTTP GET request over the TLS tunnel. Includes headers: Host, User-Agent,
Accept-Encoding, Cookies, etc.
• 7. Server Processing: Web server (Nginx/Apache) receives the request → Routes to application server →
Application processes (queries DB if needed) → Returns HTML response.
• 8. HTTP Response: Server sends HTTP 200 OK with HTML content, headers (Content-Type, Cache-Control,
Set-Cookie, etc.).
• 9. Browser Rendering: Browser parses HTML → Builds DOM tree → Parses CSS → Builds CSSOM → Combines
into Render Tree → Layouts → Paints pixels to screen. Additional resources (JS, CSS, images) trigger parallel
requests.
• 10. JavaScript Execution: JS engine executes scripts, enabling interactive behavior, AJAX calls, etc.

Q54. What are common network troubleshooting commands and what do they do?
• ping <host>: Tests basic reachability and measures round-trip time (RTT) using ICMP Echo Request/Reply.
'ping [Link]' tells you if the host is reachable and latency.
• traceroute / tracert <host>: Shows the path packets take to reach a destination, revealing each hop (router)
along the way and its latency. Useful for identifying where packets are being dropped or delayed.
• nslookup / dig <domain>: Queries DNS to resolve domain names to IP addresses. 'dig [Link]' shows the
full DNS resolution chain. Useful for diagnosing DNS issues.
• netstat -an: Displays all active network connections, listening ports, and their states (ESTABLISHED, LISTEN,
CLOSE_WAIT). Useful for identifying what ports are open and active connections.
• ipconfig (Windows) / ifconfig or ip addr (Linux): Displays network interface configuration: IP address, subnet
mask, default gateway, MAC address.
• nmap <host>: Network scanner for discovering hosts, open ports, services, and OS fingerprinting. Essential
for security audits.
• arp -a: Displays the ARP cache (IP to MAC address mappings) for the local network.
• route print / ip route: Displays the routing table, showing how the system routes packets to different
destinations.
• tcpdump / Wireshark: Packet capture tools. Capture and analyze raw network traffic. Invaluable for deep
troubleshooting and understanding protocol behavior.

TakeUForward CN Sheet • All 54 Questions Page N

Computer Networks – Technical Interview Preparation

• curl -I <url>: Sends an HTTP HEAD request, showing response headers without downloading body. Useful for
checking server responses, headers, and redirect chains.
• ss -tuln: Modern replacement for netstat on Linux. Shows TCP/UDP listening sockets quickly.
• mtr <host>: Combines ping and traceroute in real-time. Shows continuous latency and packet loss statistics
for each hop.

Computer Networks Interview Guide • 54 Questions • Good Luck!

TakeUForward CN Sheet • All 54 Questions Page N