Home/Interview prep/Network Operations Center (NOC) Analyst

Walk into the interview already prepared.

Timed mock tests and model answers written by working engineers, for every level from fresher to lead. Pick any of our 75 courses below.

Topic: Network Operations Center (NOC) Analyst. Questions are shared by related courses. View the Network Operations Center (NOC) Analyst course → · Follow the NOC Engineer roadmap and salary guide →

All Network Operations Center (NOC) Analyst interview questions at a glance+

Fresher (0–3 years): NOC Analyst L1

  1. Walk me through what happens when you type a URL into a browser.
  2. Explain the OSI model with a troubleshooting example at each layer.
  3. A monitoring alert says a server is down. What do you do in the first 5 minutes?
  4. What is the difference between an incident, a problem and a change?
  5. TCP vs UDP: what's the difference? Give examples.
  6. How do you use ping, traceroute and nslookup together?
  7. What is a subnet? How many usable hosts are in a /26?
  8. Why do you want to work in a NOC, including night shifts?
  9. At which OSI layer do routers make forwarding decisions?
  10. Which port does DNS use by default?
  11. Which protocol does the ping command use?
  12. How many usable host addresses are in a /24 subnet?
  13. Which protocol automatically assigns IP addresses to devices?
  14. Which of these is connection-oriented and guarantees delivery?
  15. A MAC address belongs to which OSI layer?
  16. What is an SNMP trap?
  17. In syslog, which severity level is the most critical?
  18. In ITIL, what is the difference between an incident and a problem?
  19. A P1 alert fires for a customer-facing outage. What should you do first?
  20. What does MTTR usually stand for in a NOC?
  21. What does traceroute show you?
  22. A website won't load by name, but pinging its IP address works. What is the most likely cause?
  23. Which pattern most strongly suggests a DDoS attack?

Mid-level (3–8 years): NOC Engineer L2 / L3

  1. Users at one branch say "everything is slow". How do you troubleshoot end to end?
  2. A BGP session to the ISP is stuck in "Active". How do you troubleshoot?
  3. How would you reduce alert noise in a NOC?
  4. Describe a major incident you handled.
  5. How do you decide severity and priority?
  6. Which repetitive NOC task would you automate first, and how?
  7. A change you approved caused an outage. What do you do?
  8. What makes a good runbook?
  9. OSPF is best described as a…
  10. Which TCP port does BGP use?
  11. What is the main purpose of Spanning Tree Protocol?
  12. HSRP and VRRP provide…
  13. Which standard tags frames on a VLAN trunk?
  14. A WAN link is slow only during business hours. What do you check first?
  15. CRC errors keep increasing on an interface. What is the likely cause?
  16. What does NetFlow (or sFlow/IPFIX) give you?
  17. Which is the best way to reduce alert fatigue?
  18. A change caused an outage. Which ITIL practice should prevent this next time?
  19. Users reach internal apps but not the internet. The default route exists. Where do you look next?
  20. An internal host is scanning hundreds of internal IPs. Best NOC response?
  21. A 99.9% monthly availability SLA allows roughly how much downtime per month?
  22. After a server migration, some users still reach the old IP. Most likely reason?
  23. What is the best first use of automation in a NOC?

Experienced (8–15 years): NOC Lead / Manager

  1. How would you design a 24×7 NOC from scratch?
  2. How do you run a major incident bridge?
  3. How do you define SLOs and use error budgets?
  4. How do you introduce AIOps and automation without losing the team's trust?
  5. Which metrics do you report to leadership?
  6. Walk me through handling a large-scale route leak or DDoS.
  7. How do you grow L1 engineers to L2 and avoid shift burnout?
  8. How do you build a strong postmortem culture?
  9. During a major incident, what is the incident commander's main job?
  10. A blameless postmortem focuses on…
  11. Which controls best protect you from accepting a BGP route leak?
  12. What does RPKI origin validation check?
  13. What is the difference between an SLO and an SLA?
  14. An error budget is…
  15. The main benefit of AIOps event correlation in a large NOC is…
  16. Which KPI best reflects customer experience for a NOC?
  17. A volumetric DDoS is saturating your internet links. What is the most effective action?
  18. ECMP is used to…
  19. Some flows see packet loss but others don't, on a path with 4 ECMP links. The likely cause?
  20. Which signal is the best trigger for a capacity upgrade?
  21. Which is the most important requirement for safe auto-remediation?
  22. In a follow-the-sun NOC, what matters most?
  23. Your ISP breached its SLA during a P1. Best course of action?