Network Administrator Interview Questions and Answers

A network administrator, sometimes called a systems administrator, is responsible for keeping an organization’s computer network up to date and running smoothly. Any company or organization that uses multiple computers or software platforms needs a network admin to coordinate the different systems.

A network administrator’s job can be wide or narrow depending on the organization and how complex its networks are. But in general, a network admin is responsible for the following tasks, according to ONET:

• Installing network and computer systems
• Maintaining, repairing and upgrading network and computer systems
• Diagnosing and fixing problems or potential problems with the network and its hardware, software and systems
• Monitoring network and systems to improve performance

At first glance it may be difficult to judge the difference between a hub and a switch since both look roughly the same. They both have a large number of potential connections and are used for the same basic purpose- to create a network. However, the biggest difference is not on the outside, but on the inside in the way that they handle connections. In the case of a hub, it broadcasts all data to every port. This can make for serious security and reliability concerns, as well as cause a number of collisions to occur on the network.

Old style hubs and present-day wireless access points use this technique. Switches on the other hand create connections dynamically, so that usually only the requesting port can receive the information destined for it. An exception to this rule is that if the switch has its maintenance port turned on for an NIDS implementation, it may copy all data going across the switch to a particular port in order to scan it for problems. The easiest way to make sense of it all is by thinking about it in the case of old style phone connections.

A hub would be a ‘party line’ where everybody is talking all at the same time. It is possible to transmit on such a system, but it can be very hectic and potentially release information to people that you don’t want to have access to it. A switch on the other hand is like a phone operator- creating connections between ports on an as-needed basis.

While TCP is a network protocol that is based on connection, UDP is not connection based. Connection means that the transfer of data between two points on a network is made with the acknowledgement of the success of the process.TCP is used if we want to transfer data and receive confirmation that the data was really sent, no matter in what time period it was made.

The maintenance of a network is made by running tests for the purpose of detecting viruses, breakdowns, hackers or bugs. A network administrator should always stay updated with the latest technology and this can be made only through constant market research. Staying up-to-date helps the administrator to improve the network and to maintain it in a good state all the time.

Network administrators deal with systems. These systems have what is called “architecture.” Some administrators, but not all, specialize in the structure of computer systems.

Network administrators run checks to detect and prevent bugs, breakdowns, viruses, hackers, etc. They are always up-to-date with the latest enhancements in the market and install upgrades whenever necessary.

Network administrators are typically enthusiastic about everything computer related and have a perfect understanding of what might go wrong. They are friendly people, though not necessarily charismatic leaders or great speakers. They give quick, cordial, and, most importantly, extremely efficient service.

Network architecture can change dramatically depending on the type of network. Expertise in handling a LAN does not necessarily translate to VPN. The answer to this question can tell you whether or not the candidate has experience with your network type and will be a good network administrator for your systems. What to look for in an answer:

• Knowledge of different types of networks
• Interest and experience setting up and maintaining the network structure you use
• Their opinions about the different types of networks available

A firewall is a security-conscious router that sits between the Internet and your network with a single-minded task: preventing them from getting to us. The firewall acts as a security guard between the Internet and your local area network (LAN). All network traffic into and out of the LAN must pass through the firewall, which prevents unauthorized access to the network.

Firewalls are one of the most basic tools in a network administrator’s box. They deny traffic from one device to another based on a set criteria. A firewall might disallow contact with a website based on its security certifications or isolate a device that only needs access to a limited list of web addresses. What to look for in an answer:

Security is essential in a business setting and firewalls are one element to passive security Applicant should demonstrate an understanding of how firewalls work and when to deploy them.

When a database server exists, it receives the SQL requests in form of messages and each SQL reaches the entire network. The data is processed by the server itself and doesn’t have to be returned to the client for processing. This makes things more efficient. This is the simplest network administrator interview questions among all.

RIP is interior gateway protocol that was often used in interior networks and in some degree in internet networks. It helps the router adapt to the modifications that are made in a network regarding connections. Now it become less used since more efficient protocols were implemented like OSPF or IS-IS. It is limited to a lower number of routers, a maximum of fifteen router.

The Routing Information Protocol (RIP) defines a way for routers, which connect networks using the Internet Protocol (IP), to share information about how to route traffic among networks. RIP is classified by the Internet Engineering Task Force (IETF) as an Interior Gateway Protocol (IGP), one of several protocols for routers moving traffic around within a larger autonomous system network — e.g., a single enterprise’s network that may be comprised of many separate local area networks (LANs) linked through routers.

Series of interface points that allow other computers to communicate with the other layers of network protocol stack.

DHCP (Dynamic Host Configuration Protocol) is a protocol used to provide quick, automatic, and central management for the distribution of IP addresses within a network.DHCP is also used to configure the proper subnet mask, default gateway, and DNS server information on the device.

A three-way handshake is a method used in a TCP/IP network to create a connection between a local host/client and server. It is a three-step method that requires both the client and server to exchange SYN and ACK (acknowledgment) packets before actual data communication begins.

A virtual LAN (VLAN) abstracts the idea of the LAN; A VLAN might comprise a subset of the ports on a single switch or subsets of ports on multiple switches. By default, systems on one VLAN don’t see the traffic associated with systems on other VLANs on the same network.

VLANs allow network administrators to partition their networks to match the functional and security requirements of their systems without having to run new cables or make major changes in their current network infrastructure. IEEE 802.1Q is the standard defining VLANs; the VLAN identifier or tag consists of 12 bits in the Ethernet frame, creating an inherent limit of 4,096 VLANs on a LAN.

255.255.255.255 is a special broadcast address, which means “this network”: it lets you send a broadcast packet to the network you’re connected to, without actually caring about its address; in this, is similar to 127.0.0.1, which is a virtual address meaning “local host”.

Network configuration management (NCM) is the process of organizing and maintaining information about all the components of a computer network. When a network needs repair, modification, expansion or upgrading, the administrator refers to the network configuration management database to determine the best course of action. This database contains the locations and network addresses of all hardware devices, as well as information about the programs, versions and updates installed in network computers.

• Streamlining the processes of maintenance, repair, and expansion and upgrading.
• Minimizing configuration errors.
• Minimizing downtime.
• Optimizing network security.
• Ensuring that changes made to a device or system do not adversely affect other devices or systems.
• Rolling back changes to a previous configuration if results are unsatisfactory.
• Archiving the details of all network configuration changes.

Remote Procedure Call (RPC) is a protocol that one program can use to request a service from a program located in another computer on a network without having to understand the network’s details. A procedure call is also sometimes known as a function call or a subroutine call.

RPC uses the client-server model. The requesting program is a client and the service providing program is the server. Like a regular or local procedure call, an RPC is a synchronous operation requiring the requesting program to be suspended until the results of the remote procedure are returned. However, the use of lightweight processes or threads that share the same address space allows multiple RPCs to be performed concurrently.

The Realm Object Server synchronizes Realms between devices, provides authentication

 and access control services for Realms and offers backend integrations and server-side event handling.

Logon scripts are, surprisingly enough, scripts that run at logon time. These are used most times to allow for the continued access to share and device mapping as well as forcing updates and configuration changes. In this way, it allows for one-step modifications if servers get changed, shares get renamed, or printers get switched out for example.

The simple answer is that Multimode is cheaper but can’t transmit as far. Single Mode has a smaller core (the part that handles light) than Multimode but is better at keeping the light intact. This allows it to travel greater distances and at higher bandwidths than Multimode.

The problem is that the requirements for Single Mode are very specific and as a result it usually is more expensive than Multimode. Therefore, for applications, you will usually see Multimode in the datacenter with Single Mode for long-haul connections.

ARP, or Address Resolution Protocol can be likened to DNS for MAC Addresses. Standard DNS allows for the mapping of human-friendly URLs to IP addresses, while ARP allows for the mapping of IP addresses to MAC addresses. In this way it lets systems go from a regular domain name down to the actual piece of hardware it resides upon.

The Encrypted File System, Microsoft’s built-in file encryption utility has been around for quite some time. Files that have been encrypted in such a way can appear in Windows Explorer with a green tint as opposed to the black of normal files or blue for NTFS compressed files. Files that have been encrypted are tied to the specific user, and it can be difficult to decrypt the file without the user’s assistance.

On top of this, if the user loses their password it can become impossible to decrypt the files as the decryption process is tied to the user’s login and password. EFS can only occur on NTFS formatted partitions, and while it is capable of encrypting entire drives it is most often reserved to individual files and folders. For larger purposes, Bit locker is a better alternative.

Boot to LAN is most often used when you are doing a fresh install on a system. What you would do is setup a network-based installer capable of network-booting via PXE. Boot to LAN enables this by allowing a pre-boot environment to look for a DHCP server and connect to the broadcasting network installation server. Environments that have very large numbers of systems more often than not have the capability of pushing out images via the network. This reduces the amount of hands-on time that is required on each system and keeps the installs more consistent.

The 10 refers to the data transfer rate, in this case is 10Mbps. The word Base refers to base band, as oppose to broad band. T means twisted pair, which is the cable used for that network.

When a person decides to become a network administrator he/she must be aware that physical effort will not take part of the job and even if it is, in rare occasions, it is minimal. The work of a network administrator resumes to doing different tasks on the computer and giving phone calls for support. In rare occasions he may act as a system administrator but this is due to urgency.

Encoding: Encoding is for maintaining data usability and can be reversed by employing the same algorithm that encoded the content, i.e. no key is used.

Encryption: Encryption is for maintaining data confidentiality and requires the use of a key (kept secret) in order to return to plaintext.

Hashing: Hashing is for validating the integrity of content by detecting all modification thereof via obvious changes to the hash output.

Obfuscation: Obfuscation is used to prevent people from understanding the meaning of something and is often used with computer code to help prevent successful reverse engineering and/or theft of a product’s functionality.

“A domain local group is a security or distribution group that can contain universal groups, global groups, other domain local groups from its own domain, and accounts from any domain in the forest. You can give domain local security groups rights and permissions on resources that reside only in the same domain where the domain local group is located.

A global group is a group that can be used in its own domain, in member servers and in workstations of the domain, and in trusting domains. In all those locations, you can give a global group rights and permissions and the global group can become a member of local groups. However, a global group can contain user accounts that are only from its own domain.

A universal group is a security or distribution group that contains users, groups, and computers from any domain in its forest as members. You can give universal security groups rights and permissions on resources in any domain in the forest. Universal groups are not supported.”

Error 5 is very common when dealing with files and directories that have very specific permissions. When trying to copy elements from areas that have restricted permissions, or when trying to copy files to an area that has restricted permissions, you may get this error which basically means “Access denied”.

Checking out permissions, making sure that you have the appropriate permissions to both the source and destination locations, and making yourself the owner of those files can help to resolve this issue. Just remember that if you are not intended to be able to view these files to return the permissions back to normal once you are finished.

Multimode fiber has a relatively large light carrying core, usually 62.5 microns or larger in diameter. It is usually used for short distance transmissions with LED based fiber optic equipment. Single-mode fiber has a small light carrying core of 8 to 10 microns in diameter. It is normally used for long distance transmissions with laser diode based fiber optic transmission equipment.

This is based on transmission distance to be covered as well as the overall budget allowed. If the distance is less than a couple of miles, multimode fiber will work well and transmission system costs (transmitter and receiver) will be in the $500 to $800 range. If the distance to be covered is more than 3-5 miles, single mode fiber is the choice. Transmission systems designed for use with this fiber will typically cost more than $1000 (due to the increased cost of the laser diode).

/etc/passwd is the primary file in Unix/Linux operating system that stores information about user accounts and can be read by all users. /etc/shadow many times is used by the operating system instead due to security concerns and increased hashing capabilities. /etc/shadow more often than not is highly restricted to privileged users.

A Hub is a networking device that allows one to connect multiple PCs to a single network. Hubs may be based on Ethernet, Firewire, or USB connections.

A switch is a control unit that turns the flow of electricity on or off in a circuit. It may also be used to route information patterns in streaming electronic data sent over networks. In the context of a network, a switch is a computer networking device that connects network segments.

FTP or File Transfer Protocol, is one of the big legacy protocols that probably should be retired. FTP is primarily designed for large file transfers, with the capability of resuming downloads if they are interrupted. Access to an FTP server can be accomplished using two different techniques: Anonymous access and Standard Login. Both of these are basically the same, except Anonymous access does not require an active user login while a Standard Login does.

Here’s where the big problem with FTP lies however- the credentials of the user are transmitted in clear text which means that anybody listening on the wire could sniff the credentials extremely easily. Two competing implementations of FTP that take care this issue is SFTP (FTP over SSH) and FTPS (FTP with SSL). FTP uses TCP ports 20 and 21.

HTTP (Hypertext Transfer Protocol) is the set of rules for transferring files (text, graphic images, sound, video, and other multimedia files) on the World Wide Web. As soon as a Web user opens their Web browser, the user is indirectly making use of HTTP. HTTP is an application protocol that runs on top of the TCP/IP suite of protocols (the foundation protocols for the Internet).

Transmission Control Protocol/Internet Protocol (TCP/IP) is the language a computer uses to access the Internet. It consists of a suite of protocols designed to establish a network of networks to provide a host with access to the Internet.

TCP/IP is responsible for full-fledged data connectivity and transmitting the data end-to-end by providing other functions, including addressing, mapping and acknowledgment. TCP/IP contains four layers, which differ slightly from the OSI model.

Domain Name System or Domain Name Service, a DNS is an Internet or network server that helps to point domain names or hostnames to their associated Internet Protocol address and was introduced by Paul Mockapetris and Jon Postel in 1983. Without a DNS to resolve a domain name or the proper rights, users would have to know the IP address of each of the web pages or computers you wanted to access.

Internet Packet eXchange/Sequential Packet eXchange, IPX/SPX is a local-area network communications protocol developed by Novell. It exchanges information between network clients, applications, and network peripherals.

Internet Control Message Protocol, ICMP is an extension to the Internet Protocol defined by RFC 792 and an error reporting protocol for TCP/IP messages. Most users are familiar with ICMP from using the Ping command.

ICMP is used by computers and by all types of network devices, including network routers, which help identify problems and communicate the status of devices on the network. The ICMP message contains a TYPE, CODE, and CHECKSUM message that help identify a devices response.

AppleTalk is a protocol developed by Apple to handle networking with little to no configuration (you may be sensing a pattern here). It reached its peak in the late 80s and early 90s, but there are still some devices that utilize this protocol. Most of its core technology has been moved over to Bonjour, while UPnP (Universal Plug and Play) has picked up on its ideology and moved the concept forward across many different hardware and software packages

 Bonjour is one of the programs that come bundled with nearly every piece of Apple software (most notably iTunes) that handles a lot of its automatic discovery techniques. Best described as a hybrid of IPX and DNS, Bonjour discovers broadcasting objects on the network by using mDNS (multicast DNS) with little to no configuration required. Many admins will deliberately disable this service in a corporate environment due to potential security issues, however in a home environment it can be left up to the user to decide if the risk is worth the convenience.

A proxy is a computer server or software program that is part of the gateway server or another computer that separates a local network from outside networks. A proxy server will cache all pages accessed through the network allowing users who may want to visit that same page to load it faster and reduce the networks bandwidth. When a page is accessed that is not in the proxy server’s cache, the proxy server accesses the page using its own IP address, caches the page, and forward it to the user.

Being able to ping out to a server and see if it’s responding is a great way to troubleshoot connectivity issues. But what if you’re not able to ping ANY server?

Does that mean that your entire network is down?

Does it mean that your network cable needs to be replaced?

Does it mean that your network card is going bad? Or could it possibly be that sunspots, magnets, aliens and the Men in Black are all conspiring against you?

The answers to these questions could be very difficult, but at the very least you can rule out if your network card is going bad. 127.0.0.1 is the loopback connection on your network interface card (NIC) – pinging this address will see if it is responding.

If the ping is successful, then the hardware is good. If it isn’t, then you might have some maintenance in your future. 127.0.0.1 And localhost mean the same thing as far as most functions are concerned, however be careful when using them in situations like web programming as browsers can treat them very differently.

Two-factor authentication (2FA) is a technique used to increase the level of security by adding an additional step or component to the user verification process. Essentially, it requires the user to undergo two successfully authentications before access is granted. Each of the required modes of authentication is usually one of the followings:

• Something the user knows
• Something the user physically holds
• Something inseparable from the user’s body.

A gateway is like a door that opens for a data package to exit the interior network and step outside the network. The Router handles the transportation of data packages over the interior network.

The Asynchronous Transfer Mode or ATM is a connection technology that works by transmitting data into organized 53 bytes (small) packages through a physical environment with a high efficiency. Packing data into small cells reduces transportation delay so the speeds reached by this technology are very high; it can reach even 10 Gb per second.

A protocol data unit (PDU) is an open-system interconnection (OSI) term used in telecommunications that refers to a group of information added or removed by a layer of the OSI model. Each layer in the model uses the PDU to communicate and exchange information, which can only be read by the peer layer on the receiving device and is then handed over to next upper layer after stripping.

Reverse Address Resolution Protocol, RARP is originally defined in RFC 903 and performs the reverse steps of ARP. RARP uses the hardware address to determine the device’s IP address.

Address Resolution Protocol, ARP is a used with the IP for mapping a 32-bit Internet Protocol address to a MAC address that is recognized in the local network specified in RFC 826. Once recognized, the server or networking device returns a response containing the required address.

A generic question from the interviewer that wants to verify if the flow of the answer remains the same no matter what question is asked, so the details of the answer are not the ones that really count here. The “gear “ of a network admin must include CD-ROM’s, technical support links, networks analyzers, server log files, telephone numbers, README files and so on. Subscriptions to certain support companies are important to be declared.

FTP or File Transfer Protocol is the process file transfer between hosts and it’s provided by the TCP/IP. Two connections are made that are secure over the TCP: one for file copying and one for information control. These connections are also called virtual circuits. TFTP or the Trivial Transfer Protocol is using UDP to transfer file form a remote host to a local host but without the advantages of security and reliability.

A broadcast storm occurs when a network system is overwhelmed by continuous multicast or broadcast traffic. When different nodes are sending/broadcasting data over a network link, and the other network devices are rebroadcasting the data back to the network link in response, this eventually causes the whole network to melt down and lead to the failure of network communication.

There are many reasons a broadcast storm occurs, including poor technology, low port rate switches and improper network configurations. A broadcast storm is also known as a network storm.

Network traffic is also known as data traffic. Network traffic refers to the amount of data moving across a network at a given point of time. Network data is mostly encapsulated in network packets, which provide the load in the network. Network traffic is the main component for network traffic measurement, network traffic control and simulation. The proper organization of network traffic helps in ensuring the quality of service in a given network.

The signals transported through Transmission media care have two types:

Guided media: Guided media are the conduit types that allow transmission through coaxial cables, fiber optics and twisted-pairs. In this type of transmission, the data flow is dependable of the physical limits of the conducting material. The signal is transported over the metallic conductor as an electric current, this is the case for coaxial cables and twisted pairs. In the case of fiber optics lights signals are transmitted through a plastics or glass cable.

Unguided media: This type refers to wireless communication which uses the air to propagate the signal, along with the cellular phone technology, satellite technology and radio technology. The signal takes the form of electromagnetic waves and travels on the air without the need of a solid conductor.

A database server can be defined as a server dedicated to providing database services. Such a server runs the database software. A database server can typically be seen in a client-server environment where it provides information sought by the client systems. A database server is useful for organizations that have a lot of data to deal with on a regular basis.

If you have client-server architecture where the clients need process data too frequently, it is better to work with a database server. Some organizations use the file server to store and process data. A database server is much more efficient than a file server.

In Database Network the client executes SQL requests to the database server. The Network Database Server Process the client database request and the executed answers of SQL command are come back over the network computer. In the whole concept Database server serves its own power to process the request or search the requested result. The Database server some time also known as SQL engine.

All database functions are controlled by the database server. Any type of computer can be used as database server. It may be microcomputer, minicomputer or mainframe computer. In large organization networks, the mainframe computers are used as server.

RDP or Remote Desktop Protocol is the primary method by which Windows Systems can be remotely accessed for troubleshooting and is a software-driven method. KVM or Keyboard Video and Mouse on the other hand allows for the fast-switching between many different systems, but using the same keyboard, monitor and mouse for all.

KVM is usually a hardware-driven system, with a junction box placed between the user and the systems in question- but there are some options that are enhanced by software. KVM also doesn’t require an active network connection, so it can be very useful for using the same setup on multiple networks without having cross-talk.

External Media has been used for backups for a very long time but has started to fall out of favor in the past few years due to its speed limitations. As capacities continue to climb higher and higher, the amount of time it takes to not only perform a backup but also a restore skyrockets. Tapes have been particularly hit hard in this regard, primarily because they were quite sluggish even before the jump to the terabyte era.

Removable hard disks have been able to pick up on this trend however, as capacity and price have given them a solid lead in front of other options. But this takes us back to the question- why use EXTERNAL media? Internal media usually is able to connect faster, and is more reliable correct? Yes and no. While the estimated lifetime of storage devices has been steadily going up, there is always the chance for user error, data corruption, or hiccups on the hard disk.

As a result, having regular backups to external media is still one of the best bang-for-buck methods available. Removable hard disks now have the capability to connect very rapidly, even without the use of a dedicated hot-swap drive bay. Through eSATA or USB3, these connections are nearly as fast as if they were plugged directly into the motherboard.

Terminal Services provides the ability to host multiple, simultaneous client sessions on Windows Server 2003. Terminal Services is capable of directly hosting compatible multi-user client desktops running on a variety of Windows-based and non-Windows-based computers.

Standard Windows-based applications do not need modification to run on the terminal server, and all standard Windows Server 2003-? Based management infrastructure and technologies can be used to manage the client desktops. In this way, corporations can take advantage of the rich choice of applications and tools offered by today’s Windows operating system environment.

A shadow copy, also referred to as a snapshot, is a point-in-time copy of a replica stored on the Data Protection Manager (DPM) server. A replica is a complete point-in-time copy of the protected shares, folders, and files for a single volume on a file server. To start data protection, a full replica of the selected data must be copied to the storage pool on the DPM server.

Thereafter, the replica is periodically synchronized with changes to the protected data. DPM creates shadow copies of each replica in a protection group according to a specified schedule. You can access the shadow copies to recover previous versions of files in the event of data loss or corruption. You can recover data and you can also enable end-user recovery so that end users can recover their own data.

If the DPM server has adequate storage space, DPM can store a maximum of 64 shadow copies per protection group. When storage area limits have been reached and a new shadow copy is created, the oldest shadow copy is automatically deleted and cannot be restored.

When you select shadow copy times, DPM provides you with estimates for recovery range and maximum data loss. These estimates will help you specify a shadow copy schedule that provides adequate data protection and meets your recovery goals. A maximum of 8 shadow copies can be scheduled per day.

The Encrypted File System, Microsoft’s built-in file encryption utility has been around for quite some time. Files that have been encrypted in such a way can appear in Windows Explorer with a green tint as opposed to the black of normal files or blue for NTFS compressed files. Files that have been encrypted are tied to the specific user, and it can be difficult to decrypt the file without the user’s assistance.

On top of this, if the user loses their password it can become impossible to decrypt the files as the decryption process is tied to the user’s login and password. EFS can only occur on NTFS formatted partitions, and while it is capable of encrypting entire drives it is most often reserved to individual files and folders. For larger purposes, Bitlocker is a better alternative.

Ipconfig is one of the primary network connection troubleshooting and information tools available for Windows Operating Systems. It allows the user to see what the current information is, force a release of those settings if set by DHCP, force a new request for a DHCP lease, and clear out the local DNS cache among other functions it is able to handle. ifconfig is a similar utility for Unix/Linux systems that while at first glance seems to be identical, it actually isn’t.

It does allow for very quick (and thorough) access to network connection information, it does not allow for the DHCP functions that ipconfig does. These functions in fact are handled by a separate service/daemon called dhcpd

Domains and workgroups are two different methods for organizing computers in a network. The main difference between the two is in the manner they operate, chiefly how the computers and other resources on the networks are managed.

A workgroup is a type of peer-to-peer network. It is essentially the name for a Windows based peer-to-peer computer network. Computers in this kind of network can allow each other access to their files, printers, or Internet connection. In order to do this, every user must have an account on each of the workgroup’s computers that they require access to. These settings and access are managed by each computer’s user.

A domain, on the other hand, is a client/server network in which the security and resource management is centralized. This means that a singular administration has control over the domain and allows which users have access to which files. In a domain, there is a one single database for domain users. A user can log on at any workstation via their account and access the files

Also known as the program that can give your admin nightmares, telnet is a very small and versatile utility that allows for connections on nearly any port. Telnet would allow the admin to connect into remote devices and administer them via a command prompt. In many cases this has been replaced by SSH, as telnet transmits its data in clear text (like ftp).

Telnet can and does however get used in cases where the user is trying to see if a program is listening on a particular port, but they want to keep a low profile or if the connection type pre-dates standard network connectivity methods

Persistent MAC learning, also known as sticky MAC, is a port security feature that enables

an interface to retain dynamically learned MAC addresses when the switch is restarted or if the interface goes down and is brought back online.

The Encrypted File System, Microsoft’s built-in file encryption utility has been around for quite some time. Files that have been encrypted in such a way can appear in Windows Explorer with a green tint as opposed to the black of normal files or blue for NTFS compressed files. Files that have been encrypted are tied to the specific user, and it can be difficult to decrypt the file without the user’s assistance.

On top of this, if the user loses their password it can become impossible to decrypt the files as the decryption process is tied to the user’s login and password. EFS can only occur on NTFS formatted partitions, and while it is capable of encrypting entire drives it is most often reserved to individual files and folders. For larger purposes, Bit locker is a better alternative.

Booting from LAN means that the operating system can be loaded into the computer’s memory over the network. This essentially means that you can boot and load Windows on a computer without a hard disk or floppy.

SNMP is the “Simple Network Management Protocol”. Most systems and devices on a network are able to tell when they are having issues and present them to the user through either prompts or displays directly on the device. For administrators unfortunately, it can be difficult to tell when there is a problem unless the user calls them over. On devices that have SNMP enabled however, this information can be broadcast and picked up by programs that know what to look for.

In this way, reports can be run based on the current status of the network, find out what patches are current not installed, if a printer is jammed, etc. In large networks this is a requirement, but in any size network it can serve as a resource to see how the network is fairing and give a baseline of what its current health is.

The Protocol Data Unit or PDU is the data unit from the LLC level and has four fields:

1. a) The source service access point or SSAP
2. b) The destination service access point or DSAP
3. C) The information fields
4. d) The control fields

The first two are used for finding the protocol stacks by the LLC on the machines that send or receive data, they are addresses. The control field states when a PDU frame is a supervisory or an information frame.

This question is a check by the interviewer to see if the candidate is honest so you must admit you have made some errors in the past, everybody makes mistakes, but these are meant to makes us better, we have to learn from them.If the candidate says he/she never failed it is a big lie, everyone makes something wrong at a point.

It is impossible not to make a mistake from the multitude of options and data that are to be found in a network.Be cautious while answering this type of generic network administrator interview questions as a wrong answer might screw up your interview. Answer wisely and don’t mention even though you did a blunder in previous project.