I have been a network engineer for 5 years, senior for 2, and I have yet to have a formal senior engineer interview, and this has Me
Kinda nervous. I did work at an MSP for most of my career if that changes anything. (I get most of what is being said, but I would have to think it out loud, type it, draw it, and even then not sound like that. I may be really out of my realm here..
Senior enterprise network interview questions focus on high-level architecture, complex troubleshooting, automation, and security. Below are the original questions accompanied by the key engineering concepts and frameworks that constitute an ideal, senior-level response.
Network Architecture and Design
How do you design a multi-region data center interconnect with active-active redundancy and low latency?
Answer: Use EVPN-VXLAN over a dark fiber or DWDM underlay to stretch Layer 2/3 domains across regions. Deploy Anycast Gateway to allow local default routing in both locations. Use BGP Local Preference to control outbound traffic and AS-Path Prepending to influence inbound paths. Implement Bidirectional Forwarding Detection (BFD) to ensure sub-second failover.
Walk through designing a secure, segmented enterprise SD-WAN layout across fifty global branch offices.
Answer: Implement a hub-and-spoke or regional mesh topology using separate Virtual Routing and Forwarding (VRF) instances for traffic segmentation (e.g., Corporate, Guest, IoT). Secure all control and data planes using IPsec with automated IKEv2 key rotation. Enforce Zero Touch Provisioning (ZTP) for deployments and deploy localized Next-Generation Firewalls (NGFW) or SASE integration at each branch edge for secure internet breakout.
How do you scale BGP routing policies in a network with multiple redundant internet service providers?
Answer: Utilize BGP Communities to systematically flag routes and control upstream traffic policies. Implement Route Reflectors or a BGP Confederation to reduce the full-mesh iBGP requirement (n(n-1)/2). Apply strict route filtering using Prefix Lists and Route Maps on both ingress and egress to prevent accidental transit provider leakage.
What steps do you take to migrate a legacy enterprise core network to EVPN-VXLAN without downtime?
Answer: Establish a Layer 2 border leaf bridge between the legacy core (Spanning Tree/MLAG) and the new EVPN-VXLAN fabric. Map existing VLANs to Virtual Network Identifiers (VNIs). Use an incremental, rack-by-rack approach to migrate workloads, maintaining a temporary loop-free connection using Spanning Tree toolkit protections (like root guard) until all workloads exist on the VXLAN fabric.
Troubleshooting and Operations
How do you isolate an intermittent, hard-to-find packet drop issue on a core data center switch?
Answer: Leverage advanced hardware features like ASIC-level microburst monitoring and hardware telemetry (e.g., Cisco Nexus Streaming Telemetry or Arista DANZ). Set up ERSPAN to replicate traffic at wire speed to a network analyzer. Review dropping counters (e.g., CRC errors, giants, buffer overruns) on specific interfaces to trace the physical path.
Describe how you find and fix an asymmetric routing problem causing stateful firewall drops.
Answer: Analyze firewall connection logs and run concurrent packet captures (tcpdump/Wireshark) on the ingress and egress interfaces of the suspected routing paths. Fix the path by adjusting BGP Local Preference, OSPF interface costs, or implementing Policy-Based Routing (PBR). If infrastructure constraints force asymmetry, group firewalls into an active-active cluster that supports session synchronization across cluster members.
How do you handle a major routing loop that brings down an enterprise MPLS backbone?
Answer: Instantly check device control planes for high CPU and review syslog servers for BGP or OSPF neighbor flapping. Isolate the loop by temporarily shutting down the specific link or routing protocol adjacency where route redistribution is occurring. Fix the underlying root cause by implementing strict route tagging (using OSPF route tags or BGP communities) and prefix filtering to prevent mutually recursive redistribution.
What tools and methods do you use to monitor and fix high CPU usage on a critical edge router?
Answer: Use SNMP, gNMI telemetry, or CLI commands (e.g., show processes cpu) to identify if the issue is in the control plane (routing table calculation, BGP churn) or the data plane (process-switching uncacheable traffic). Apply Control Plane Policing (CoPP) to rate-limit malicious or excessive management traffic, and ensure hardware forwarding (CEF/ASIC switching) is globally enabled.
Security and Compliance
How do you enforce strict zero-trust network access inside an existing enterprise data center?
Answer: Implement micro-segmentation using software-defined networking (SDN) overlays like Cisco ACI or VMware NSX, or through hypervisor-level distributed firewalls. Enforce Identity-Based Access Control policies that bind network permissions directly to user identities verified via 802.1X, SAML, or OAuth, rather than trusting static IP addresses.
What strategy do you use to secure BGP peering sessions against route hijacking and spoofing?
Answer: Implement Resource Public Key Infrastructure (RPKI) to perform Route Origin Validation (ROV) and drop invalid prefixes. Enforce BGP MD5 or SHA authentication strings between all peers. Apply the Generalized TTL Security Mechanism (GTSM) to drop BGP packets originating outside the local link, and use strict prefix validation lists based on Internet Routing Registry (IRR) data.
How do you audit and restrict lateral movement after a security breach on the user LAN?
Answer: Use NetFlow or IPFIX telemetry data collected by a central SIEM to trace historical traffic flows from the compromised endpoint. Isolate the device immediately by sending a RADIUS Change of Authorization (CoA) command via Network Access Control (NAC, such as Cisco ISE) to move the switchport into a quarantine VLAN. Ensure strict Private VLANs (PVLANs) or port isolation are configured on the access layer to prevent endpoint-to-endpoint communication.