Network Administrator interview loops

A network administrator keeps an organization's network working: the routers, switches and cabling that connect its computers, within each site and between sites. The US Bureau of Labor Statistics counts network and computer systems administrators as one occupation, but says they often specialize: network administrators in that infrastructure, systems administrators in the organization's software and its users' access (BLS, updated August 2026). On this site the second is the system administrator's job. O*NET lists network engineer as well as network administrator among the titles reported for the occupation (O*NET, updated 2026). Network security engineer is a separate title with its own plans here, such as incident response and a security assessment, which are about defending a network: detecting and answering attacks, and testing its defenses. The rounds below are about keeping one working, its firewall policy included.

As of October 2026 the job is posted in four settings, under several titles. Run in-house, it means a company's own offices: a MongoDB posting has its senior network engineer owning the switches, firewalls and access points in offices around the world, fitting out new ones with the real estate, AV and physical security teams, and advising on internet providers and cabling contractors (MongoDB). At a network operator it sits in a network operations center (NOC): a CityFibre posting for a NOC operations engineer has them watching its core and customer networks, acting on alarms from core links and taking the faults its support center escalates (CityFibre). At a managed service provider it means other organizations' networks: an Ensono posting, from a company that calls itself one, has its expert network engineer supporting every client's network, from its performance to its incidents and changes (Ensono). In the US federal service it is posted as IT specialist (network), in the 2210 information technology management series: a Western Area Power Administration posting, for duty stations in five states, covers routing, switching, Wi-Fi, firewalls and VPNs, including in the enclave that holds its SCADA control systems (USAJOBS). The loop below is written for the first: an organization's own network, a head office and a few branches looked after by one to three people.

In that job the network is the switches, Wi-Fi, internet links, VPNs, DNS and DHCP, and firewalls, kept working for people who only notice it when it stops. Most weeks are tickets and small changes. What decides the hire is the moment the explanation and the evidence part company: the failover probe says the link is up while forty people cannot load a page, an approved change contains a command that takes two floors off the network, a firewall rule with no hits turns out to be the one the disaster-recovery plan depends on. The role here is the network; servers, backups and identity belong to a system administrator and are not read in these rounds.

Networking is unusually easy to prepare for on paper. The layers of the OSI model, TCP against UDP, what a VLAN is and how a subnet mask works all have short, correct answers, and a candidate can give every one of them without ever having read an interface counter during an outage. The failures that cost an organization are different in kind: mostly quiet, and often self-inflicted — a health check that tests the wrong device, a trunk command that replaces a list it was meant to extend, a temporary rule that turned two years old. So the rounds below do not ask for definitions. Each gives the candidate something an interviewer can prepare in an evening, in the syntax of their own equipment: evidence cards handed over one request at a time, three packet captures of the same stalled file copy, someone else's change request, a rulebase export. Then the round scores what the candidate does with it.

Employers draw the line on AI in different places, including before the interview. Peloton rules AI tools out of every step of applying and interviewing, a policy printed on its postings, its senior network engineer's included (Peloton, as of October 2026). Anthropic, whose posting for a corporate network engineering manager linked to its guidance in October 2026, lets candidates use AI to refine an application they drafted themselves, but not on take-home assessments or in live interviews unless told otherwise (Anthropic, updated July 2025). None of the plans below says either way. The incident, change and design reviews send their material 24 hours ahead, with faults and false leads the packs do not label and the plans credit the candidate for sorting out, such as a DHCP relay pointed at a server retired in June. An assistant given a pack overnight could sort them out instead, so allowing one there changes what those rounds measure. The scenario-based questions round sends nothing: it hands over evidence a card at a time, on request, and scores the order of the requests. Beyond the packs, the rounds are worked out live: an ICMP policy a security lead has to accept, the call at 23:41 on a sheet handed over only then, a door-access request first raised in the room, and the plan for taking rules away. So decide before the first pack goes out, and tell the candidate which packs, and which parts of the hour, an assistant may be used on.

A loop is a set of round plans in order. Each round scores one to three competencies, every must-have is scored in at least two rounds, and the debrief goes competency by competency rather than round by round, so no single interview decides the hire. How these plans work covers the rest of the method.

Further reading, as of October 2026. Limoncelli, Hogan and Chalup's The Practice of System and Network Administration, Volume 1 (Addison-Wesley, third edition, 2016) is a book-length treatment of both halves of the occupation. Its chapter on service monitoring has sections on end-to-end tests and meta-monitoring, two of the additions the scenario-based questions round credits after the evening outage. Its chapter on server upgrades lists developing verification tests and writing a backout plan among the steps before the upgrade itself, which is what the change review asks of a rewritten change request: the undo written and tried, and the numbers that mean stop agreed, before the change runs. The Wireshark User's Guide explains why a capture taken on the machine that sent the packets can show their checksums as invalid when the network card fills them in afterwards, the first false lead in the incident review. NIST's Guidelines on Firewalls and Firewall Policy (SP 800-41 Rev. 1, September 2009) warns that rulesets grow more complicated with age and should be reviewed at regular intervals, not only during audits. The design review hands the candidate seven years of rules nobody owns and asks which of those with no hits can go; each of the three has a different answer. The guidelines' section on ICMP says that refusing all of it tends to hurt troubleshooting and performance, and that IPv4's destination-unreachable messages, type 3, should be let through, which bears on the policy the incident review ends with.