Infrastructure Engineer Interview Questions 2026: Networking, Linux, Cloud, Storage and Reliability

How to use this guide

This guide covers infrastructure engineering: networks, Linux servers, virtualisation, cloud networking, storage, and reliability. It is written for freshers who are moving into system administration, network operations, cloud infrastructure, and data centre roles, and for experienced engineers preparing for senior questions.

The answers are standard and follow common industry practice. Command options differ across distributions and vendors, so confirm exact flags on your system.

What the interview pattern usually looks like

Service and managed-operations companies test commands and troubleshooting steps in depth. Product companies ask about design choices, such as how you would make a service survive a zone failure.

Level 1: Networking fundamentals

Q1. Explain the OSI model.

Seven layers: physical, data link, network, transport, session, presentation and application. Routers work at layer 3 using IP addresses. Switches work at layer 2 using MAC addresses. Load balancers can work at layer 4 (TCP and UDP) or layer 7 (HTTP). The TCP/IP model groups these into four layers and is the one used in practice.

Q2. What is the TCP three-way handshake?

The client sends SYN. The server replies SYN-ACK. The client sends ACK. Then data flows. Closing uses four steps with FIN and ACK in each direction.

Client                      Server
  |  -------- SYN -------->   |
  |  <----- SYN-ACK -------   |
  |  -------- ACK -------->   |
  |  ====== data flows ====== |

Q3. What is the difference between TCP and UDP?

TCP is connection-oriented, reliable, ordered and has flow and congestion control. UDP is connectionless and has no delivery guarantee. Use TCP for web pages and databases, and UDP for DNS queries, video streams and some games.

Q4. What happens when you type a URL in a browser?

1. The browser checks its cache, then asks DNS for the IP address.
2. A TCP connection is opened to the server, after a TLS handshake for HTTPS.
3. The browser sends an HTTP request.
4. The server responds, and the browser renders the page and loads other resources.

Interviewers use this question to check that you can connect layers together. Name the protocol at each step.

Q5. What is the difference between a hub, a switch and a router?

A hub repeats traffic to all ports. A switch forwards frames only to the port where the destination MAC address is. A router forwards packets between networks using IP routing tables.

Q6. What is ARP?

Address Resolution Protocol maps an IPv4 address to a MAC address on the local network. It broadcasts a request, and the owner of the IP replies with its MAC.

Q7. How do you check whether a server is reachable and where a packet is lost?

ping checks reachability with ICMP. traceroute (or tracert on Windows) shows each hop. mtr combines both and reports packet loss per hop. If ping works but the application does not, check the port with nc -vz host 443 or telnet, and check the firewall.

Q8. What is the difference between a public and a private IP address?

Private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. They are not routed on the internet and are reused inside networks. Network address translation maps private addresses to a public address when they reach the internet.

Level 2: Subnetting and routing

Q9. What is CIDR notation, and what does /24 mean?

CIDR writes an address with the number of bits used for the network. /24 means the first 24 bits are the network part, leaving 8 bits for hosts. That gives 256 addresses, of which 254 are usable.

Q10. Calculate the network, broadcast and usable hosts for 192.168.10.70/26.

A /26 has 64 addresses per block (256 divided by 4 gives blocks at .0, .64, .128 and .192). The address .70 falls in the block starting at .64. Network address is 192.168.10.64. Broadcast is 192.168.10.127. Usable hosts run from .65 to .126, which is 62 hosts.

Q11. How many hosts does a /28 give?

16 addresses, minus the network and broadcast addresses, leaves 14 usable hosts.

Q12. What is a default route?

It is the route used when no more specific route matches. Written as 0.0.0.0/0, it usually points to the internet gateway or the upstream router.

Q13. What is the difference between static and dynamic routing?

Static routes are configured by hand and do not change unless an engineer changes them. Dynamic routing protocols such as OSPF and BGP exchange routes and adapt to failures. OSPF works inside an organisation, and BGP connects autonomous systems on the internet.

Q14. How do VLANs help?

VLANs split one physical switch into logical networks. Hosts in different VLANs cannot talk without a router or a layer 3 switch. They reduce broadcast traffic and separate departments or security zones.

Level 3: DNS, load balancing and firewalls

Q15. What happens during DNS resolution?

The client checks its cache and the hosts file. It asks the configured resolver, which asks a root server, then a top-level domain server, then the authoritative server for the domain. The answer is cached for its time to live (TTL).

Q16. What are the common DNS record types?

• A: maps a name to an IPv4 address.
• AAAA: maps a name to an IPv6 address.
• CNAME: maps a name to another name.
• MX: mail servers for the domain.
• TXT: free text, used for verification and email policies such as SPF and DKIM.
• NS: the authoritative name servers.

Q17. A website is not loading after a DNS change. What do you check?

The TTL on the old record, which tells how long resolvers keep the old answer. Query the authoritative server directly with dig @ns1.example.com example.com A, then compare with the public resolver. Clear the local DNS cache if needed.

Q18. What is a load balancer, and what does a health check do?

A load balancer spreads requests across several servers. A health check removes a server from the pool when it fails the check, so users are not sent to a dead server.

Q19. What is the difference between a layer 4 and a layer 7 load balancer?

A layer 4 balancer routes by IP and port and does not read the request. It is fast. A layer 7 balancer reads HTTP headers, paths and cookies, and can route /api to one group and /static to another. It uses more resources.

Q20. How does a firewall decide what to allow?

It checks each packet against an ordered list of rules, using source, destination, port and protocol. The first matching rule applies. Stateful firewalls remember connections, so return traffic for an allowed connection is permitted automatically. Default deny is the safe policy.

Q21. What is NAT, and why is it used?

Network Address Translation rewrites IP addresses in packets. Source NAT lets many private hosts share one public address. Destination NAT, or port forwarding, sends incoming traffic on a public port to a private server.

Level 4: Linux administration

Q22. How do you check whether a service is running and why it failed?

systemctl status nginx
journalctl -u nginx --since "30 min ago"

Read the last error lines, then check the configuration with the service's test command, such as nginx -t, before restarting.

Q23. How do you find which process is using the most memory?

ps aux --sort=-%mem | head or top and htop. Check whether memory use is growing over time, which points to a leak, or whether it is a steady high level.

Q24. A server is slow. What do you check first?

Use uptime for load average, top for CPU, free -h for memory, iostat for disk wait, and ss -s for connection counts. The slow resource is the one with saturation. A high load average with low CPU often means the processes are waiting on disk or network.

Q25. How do you manage users and groups safely?

Create users with useradd, add them to groups with usermod -aG, and give sudo through a group rule in /etc/sudoers.d/. Use key-based SSH login and disable root login over SSH. Review accounts regularly and remove those that no longer need access.

Q26. What is cron, and what is a common mistake with it?

Cron runs commands on a schedule. A common mistake is a missing environment: cron has a minimal PATH, so use full paths in scripts. Log the output, or the failure is silent.

Q27. What is the difference between a process and a service?

A process is one running program. A service is a process managed by the init system, such as systemd, which starts it at boot, restarts it on failure and keeps its logs.

Level 5: Virtualisation and cloud networking

Q28. What is the difference between a virtual machine and a container?

A virtual machine runs its own guest kernel on a hypervisor, with virtual hardware. A container shares the host kernel and isolates processes with namespaces and cgroups. VMs are heavier and stronger isolated. Containers start faster and use less memory.

Q29. What is a hypervisor?

Software that runs virtual machines. Type 1 runs directly on hardware, such as VMware ESXi, KVM or Hyper-V. Type 2 runs on a host operating system, such as VirtualBox.

Q30. How do you design a VPC for a three-tier web app in AWS?

• A VPC with a CIDR block, such as 10.0.0.0/16.
• Public subnets in two or more availability zones for the load balancer and NAT gateway.
• Private subnets for the application servers.
• Private subnets for the database, with no route to the internet.
• Security groups: the load balancer accepts 443 from anywhere, the app accepts only from the load balancer, the database accepts only from the app.

Q31. What is a security group, and how is it different from a network ACL?

A security group is stateful and attaches to a resource such as an instance. A network ACL is stateless, applies to a subnet, and needs rules for both directions. Most designs use security groups first.

Q32. What is an internet gateway and a NAT gateway?

An internet gateway lets resources with public IPs in a public subnet reach and be reached from the internet. A NAT gateway lets private subnet resources start outbound connections, such as package updates, without allowing inbound connections.

Q33. How does IAM work in AWS?

Users, groups and roles get permissions through policies written in JSON. Policies list actions, resources and conditions. Use roles for services and applications, and follow least privilege. Explicit deny overrides any allow.

Q34. What is a bastion host, and what is the modern alternative?

A bastion is a hardened server in a public subnet used to reach private servers over SSH. The modern alternative is a managed session tool that gives access without open inbound SSH ports, with logging and access approval.

Level 6: Storage and backup

Q35. What is the difference between block, file and object storage?

• Block storage: raw disks attached to a server, such as EBS volumes. Used for databases and boot disks.
• File storage: shared file systems with directories, such as NFS or EFS. Used for shared content.
• Object storage: buckets of objects with keys and metadata, such as S3. Used for backups, media and static files.

Q36. What is RAID, and which level would you choose?

RAID combines disks for performance or redundancy. RAID 0 stripes with no redundancy. RAID 1 mirrors. RAID 5 gives one disk of parity, and RAID 6 gives two. RAID 10 mirrors and stripes, which is common for databases. RAID is not a backup. It protects against a disk failure, not against deletion or corruption.

Q37. What is the 3-2-1 backup rule?

Keep three copies of data, on two different media types, with one copy off-site. Test restores regularly, because a backup that has never been restored is an assumption, not a backup.

Q38. What is RPO and RTO?

Recovery Point Objective is the maximum data loss you accept, measured in time. Recovery Time Objective is the maximum time to restore service. A backup every 24 hours means an RPO of up to 24 hours. Restoring within four hours means an RTO of four hours.

Q39. How do you handle a full disk on a database server?

Stop the growth first, such as a runaway log or a large temporary table. Free space carefully. Never delete database files directly. Add capacity and monitor the trend so the problem is not repeated.

Level 7: Reliability and disaster recovery

Q40. What makes a system highly available?

No single point of failure. Redundant servers behind a load balancer, data replicated across zones, automatic failover, and health checks. Test the failover, because an untested failover often fails when needed.

Q41. What is the difference between high availability and disaster recovery?

High availability handles small failures, such as one server, with no or little downtime. Disaster recovery handles large events, such as losing a whole region, and usually accepts some downtime and data loss up to the RPO and RTO.

Q42. How would you plan a disaster recovery drill?

Pick a realistic scenario. Document the steps. Restore data to a clean environment. Measure the actual time against the RTO. Record gaps and fix them. Repeat on a schedule.

Q43. What does change management look like in an operations team?

A written change request with the impact, the rollback plan, the test evidence and the window. Approval from the owner. Changes done in a maintenance window, with someone watching the metrics afterwards.

Troubleshooting scenarios

S1. A user says they cannot reach an application, but the server is up. What do you do?

1. Confirm the exact URL, the error and whether others are affected.
2. Check DNS: does the name resolve to the expected IP?
3. Check reachability to the port from a different network.
4. Check the load balancer target health and the security group or firewall rules.
5. Check the application process and its logs.
6. Fix, verify with the user, and document the cause.

S2. An application server cannot connect to the database.

Check whether the database port is open from the app's subnet, using nc -vz. Check the database security group or firewall, the connection string, the database user's grants, and the connection limit. Look at the database log for rejected connections.

S3. Users report slow pages only from one region.

Compare latency from that region with a test tool. Check the DNS record, the load balancer location, the CDN configuration and any peering or transit issue. A traceroute from that region shows where the path changes.

S4. A server rebooted, and the application did not start.

Check whether the service is enabled at boot with systemctl is-enabled. Read the boot logs. Check that mounted disks came up, because a missing mount often stops the application.

How to answer 'explain a project'

Describe the network or infrastructure in one diagram in words: the zones, the tiers, the links and the failure points. Then give your part, the decisions you made, one incident and the fix, and the result you can state truthfully.

Common mistakes

• Guessing at subnet answers. Work out the block size first, then the boundaries.
• Forgetting the return path. A firewall rule needs both directions unless it is stateful.
• Restoring from a backup you have never tested. Test restores.
• Opening wide security groups to fix a quick problem. Narrow it back down after the test.
• Changing many things at once during an incident. Change one thing, observe, then continue.

A four-week preparation plan

Frequently asked questions

Is a certification needed? Certifications help with screening. Practical labs and clear troubleshooting answers help more in the interview.

Can I start without a data centre? Yes. Use a virtual machine lab, a free cloud tier and containers. The skills transfer.

What about hardware? Ask what the role covers. Some positions include racking, cabling and vendor support. Mention that you are willing to learn these if the role needs them.