Junior Network Administrator Interview

- Beverly Eze is proving fundamental networking knowledge for an entry-level role defending the D.o.D.I.N.

- Topics include fundamental networking concepts, being stig-ready, and a zero trust mindset.

Image summary: A photograph shows a high-tech operations center where three professionals wearing headsets monitor multiple computer screens displaying global maps and data analytics. This illustrates the professional environment of a network administrator in a cyber command setting.

Mission Brief - Scenario Overview

Applying for Junior Network Administrator at U.S.C.Y.B.E.R.C.O.M. This is an entry-level role and an intensive learning opportunity. The interview goal is to prove I understand how networks operate and how to defend the Department of Defense Information Network with security-first fundamentals.

- lan Topologies, focusing on physical and logical layout.

- O.S.I Model and Layers, focusing on the troubleshooting framework.

- Networking Devices, focusing on hubs, Internet Protocol Security, and stig hardened devices.

- Common Protocols, focusing on ports and Transmission Control Protocol versus User Datagram Protocol.

- I.P Ranges, focusing on R.F.C 1918 private versus public addresses.

- Class and Subnet Mask, focusing on classful to Classless Inter-Domain Routing.

- The Autonomous System, focusing on Border Gateway Protocol, Autonomous System Numbers, and Department of Defense Autonomous System 721.

Image summary: A photograph of a network switch with numerous blue ethernet cables plugged into its ports, illustrating the hardware aspect of networking infrastructure.

Interview Focus: Prove Basics. Answer fundamental questions to demonstrate readiness for mission support and Zero Trust operations.

Goal: Show I understand how networks operate and how to defend through segmentation, logging, and least privilege.

lan Topologies - Part 1

What is a lan Topology? It is the physical and logical layout of devices in a Local Area Network. It determines fault tolerance, cost, and how we troubleshoot at U.S.C.Y.B.E.R.C.O.M enclaves.

Image summary: A series of three diagrams illustrating network topologies. The Bus topology shows devices connected to a single shared line. The Star topology shows devices radiating from a single central point. The Ring topology shows devices connected in a closed loop.

- For the Bus topology, which uses a shared backbone, all devices share one coaxial backbone cable with taps.

- It is simple and cheap, such as 10.B.A.S.E.2 legacy.

- There is a single point of failure, meaning a break equals the whole lan being down.

- Collisions are hard to isolate.

- For the Star topology, the primary configuration is a central switch. This is the most common today, where all hosts connect to a central switch or hub.

- It is easy to manage, and failure is isolated to one link.

- It supports V.L.A.N's, monitoring, and stig hardening.

- It is used in the U.S.C.Y.B.E.R.C.O.M user access layer.

- For the Ring topology, which uses token circulation, each device connects to two neighbors, and data circulates.

- There are no collisions due to token passing.

- Examples include some fiber M.A.N's and F.D.D.I.

- One break can disrupt the ring, which requires a dual ring.

lan Topologies - Part 2

- Mesh topology provides maximum resilience.

Image summary: A diagram illustrating a mesh network where multiple nodes, labeled H1, H2, and H3, are interconnected by lines, showing that every device has a path to every other device.

Every device connects to every other device in a full mesh, or many in a partial mesh.

- It offers the highest redundancy with no single point of failure and self-healing paths.

- It involves high cost and cabling complexity, requiring n cubed links for a full mesh.

- It is used for critical backbones, military cores, and Department of Defense Information Network inter-enclave links.

- Hybrid topologies represent the enterprise reality.

Image summary: A diagram of a hybrid network showing several user nodes labeled U1 through U4 connected to central switches, combining different topology styles.

This is a combination of topologies, such as Star-Bus or Star-Ring. Most enterprise networks use this approach.

- It uses star at the access layer for users, and mesh or bus at the distribution and core layers.

- This balances cost, manageability, and resilience.

- Logical versus physical topology can differ; for example, it may be a physical star but a logical bus.

Interview Answer: For U.S Cyber Command, I recommend Star plus Partial Mesh Hybrid. Star for the user access layer allows for easy troubleshooting and vlan segmentation, while Partial Mesh for the core and distribution provides resilience under attack, ensuring no single failure isolates an enclave. This matches Zero Trust segmentation.

O.S.I Model and Layers

This is a standard for troubleshooting to isolate where an issue occurs. Encapsulation goes from Layer 7 Data, to Layer 4 Segment, to Layer 3 Packet, to Layer 2 Frame, and finally to Layer 1 Bits.

- Layer 7 is the Application layer, including H.T.T.P, D.N.S, and S.M.T.P. These are user services, closest to the end user, and handle data.

- Layer 6 is the Presentation layer, which handles encryption, compression, and formatting, such as T.L.S and S.S.L. This also handles data.

- Layer 5 is the Session layer, which manages sessions and checkpoints, such as Net.B.I.O.S and R.P.C. This also handles data.

- Layer 4 is the Transport layer, including T.C.P for reliable three-way handshakes and U.D.P for fast transport via ports. This handles segments.

- Layer 3 is the Network layer, including I.P, routing, and path selection, where routers operate. This handles packets.

- Layer 2 is the Data Link layer, including mac, switching, framing, and V.L.A.N's, where switches operate. This handles frames.

- Layer 1 is the Physical layer, consisting of cables, fiber, signals, and hubs, with bits on the wire. This handles bits.

Image summary: A vertical stack diagram titled OSI 7-Layer Model - Encapsulation Flow shows the seven layers. It displays the layers in descending order from Application at the top to Physical at the bottom.

- For troubleshooting, use a top-down or bottom-up isolation approach.

- From a Cyber View, firewalls cover Layers 3 through 7 Deep Packet Inspection.

- In terms of D.o.D.I.N Relevance, logging occurs per layer.

Networking Devices - Part 1

Devices and their O.S.I layers — how traffic is forwarded and where we gain security control.

- Hubs are obsolete repeaters. They repeat signals to all ports, have a single collision domain, and no mac learning. They are insecure and operate in half duplex only.

- Switches are access workhorses. They learn mac addresses, provide a separate collision domain per port, and support V.L.A.N's and 802.1.Q trunking. They provide the D-O-D Information Network access layer, and S.T.P prevents loops.

- Routers handle inter-vlan and wide area network traffic. They route by I.P, maintain a routing table, separate broadcast domains, and run O.S.P.F or EIGRP. Tools include show ip route and A.C.L's at the boundary.

- Access Points bridge wireless to wired connections. They bridge 802.11 to Ethernet and use W.P.A.3-Enterprise and 802.1.X for D-O-D enclaves.

Image summary: A close-up photograph showing the back of a network switch with numerous blue ethernet cables plugged into a dense array of ports, illustrating the physical hardware of networking infrastructure.

Security Tie-In: Every device must be stig-compliant. This includes hardened ios, disabled unused ports, logging to SIEM, port-security with sticky mac, and B.P.D.U Guard on access ports to prevent rogue switches.

Networking Devices - Part 2

Advanced devices for security are critical for U.S.C.Y.B.E.R.C.O.M defense. All must be hardened, logged, and stig-compliant.

- Firewall L.3-L.7, focusing on next generation and zones. This provides stateful filtering, access control lists, and deep packet inspection to enforce inside, outside, and D.M.Z segmentation.

Image summary: A network diagram showing traffic flowing from an inside zone, denoted as 10.x TRUST, through a firewall with access control lists and intrusion prevention systems, to a public DMZ or outside zone.

- Default deny and log everything for SIEM.

- I.D.S versus I.P.S, focusing on detection and prevention. Intrusion Detection Systems provide alerts, while Intrusion Prevention Systems are inline and drop malicious traffic.

- These are signature and anomaly based.

- They are critical for D.o.D.I.N defense.

- Load Balancer, focusing on availability.

- It distributes traffic across servers for resilience and scale.

- It performs health checks and S.S.L offload.

- It prevents a single point of failure.

- Modem, Access Point, and W.I.D.S.

Modems modulate for wan. Access Points bridge wireless to wired lan, requiring W.P.A.3 Enterprise and 802.1.X. In the Department of Defense, all wireless is monitored and approved only.

Image summary: A photograph of a professional network rack mounting a high-density networking device with multiple blue ports.

Common Protocols

The rules that make communication work. For U.S.C.Y.B.E.R.C.O.M: know ports for A.C.L's, logging, and threat hunting.

- T.C.P is reliable, connection-oriented, and uses a three-way handshake of SYN, SYN-ACK, and ACK. It provides ordered delivery and retransmission.

- It is slower and used for web, email, and file transfer.

- Common T.C.P ports include 80, 43, 2, and 25.

- U.D.P is fast, connectionless, and has no handshake. It is best-effort with low latency.

- It is used for D.N.S, D.H.C.P, VoIP, and streaming.

- Common U.D.P ports include 53, 67, 68, and 161.

Image summary: A table titled Common Protocols and Ports lists common ports, their associated protocols, and their uses. For example, port 2 is SSH for secure remote access, port 53 is DNS for name resolution, and port 80 or 43 is HTTP or HTTPS for web traffic.

- D.N.S on port 53 uses U.D.P or T.C.P. Name resolution and donsek protect against spoofing, which is critical for D.o.D.I.N.

- D.H.C.P on ports 67 and 68 uses U.D.P. The dora process stands for Discover, Offer, Request, and Acknowledge. Rogue D.H.C.P is a threat.

- S.S.H on port 2 uses T.C.P for secure remote access, replacing Telnet on port 23. This is key for stig-compliant management.

- I.C.M.P and S.N.M.P: I.C.M.P is for ping and traceroute. S.N.M.P ports 161 and 162 use U.D.P for monitoring and are secure with version 3.

- Under the 2 and 43 section, S.S.H and H.T.T.P.S are encrypted management and web protocols that must be allowed explicitly.

- Under the 53 and 67 section, D.N.S and D.H.C.P are U.D.P core services that should be monitored for exfiltration.

- Under the SYN-ACK section, the T.C.P handshake serves as a baseline for I.D.S and I.P.S detection.

I.P Ranges - Private vs Public

IPV4 is 32-bit with approximately 4.3 billion addresses. This is why we need private ranges and nat. In the Department of Defense, we use R.F.C.1918 internally, plus nat to public for OPSEC and conservation.

- Private R.F.C.1918 is not routable on the internet.

Image summary: A table lists three private IP ranges. The first is ten point zero point zero point zero slash eight, used for large enterprises with sixteen point seven million hosts. The second is one hundred seventy two point sixteen point zero point zero slash twelve, for medium networks with about one million addresses. The third is one hundred ninety two point sixteen eight point zero point zero slash sixteen, for small home networks with sixty-five thousand five hundred thirty-six hosts.

- Public I.P addresses are globally routable, assigned by I.A.N.A or A.R.I.N, and unique on the Internet. They are billed and advertised via B.G.P, and must be protected as they are directly exposed.

- For example, two hundred three point zero point one hundred thirteen point one hundred forty-five is reachable from anywhere but needs firewalling and logging.

Image summary: A flow diagram shows a private IP address, ten point fifteen point two point ten inside an enclave, translating through NAT or PAT and firewall translates to a public IP address, two hundred three point zero point one hundred thirteen point five, which is then sent to the internet via BGP.

- Loopback one hundred twenty seven point zero point zero point eight is used for local stack testing where localhost never leaves the host.

- apipa one hundred sixty nine point two hundred fifty-four point zero point zero slash sixteen is an auto-config used when D.H.C.P fails, which indicates an issue.

- R.F.C.1918 matters because it reduces the attack surface and enables Zero Trust segmentation.

- nat and OPSEC hide the internal topology from adversaries.

Interview Point: At Cyber Command, we run ten dot x internally per D.I.S.A guidance, nat at the boundary, and log translations for forensics.

Class of Network and Default Subnet Mask

The historical classful system, which is still asked in interviews, is now supplemented by CIDR. This serves as a foundation for understanding subnetting and Department of Defense I.P planning.

I.P Classes and Default Subnet Masks

Image summary: A table listing IP address classes. Class A has a range of 0 to 127 with a default mask of 255.0.0.0, CIDR /8, and over 16 million hosts. Class B ranges from 128 to 191 with a default mask of 25.25.0.0, CIDR /16, and 65,534 hosts. Class C ranges from 192 to 23 with a default mask of 25.25.25.0, CIDR /24, and 254 hosts. Class D for multicast ranges from 24 to 239 and has no default mask, CIDR, or host count.

- Class A is 10.0.0.0/8, which is used for Large D-O-D networks.

- Class B is 172.16.0.0/16, which is used for Medium networks.

- Class C is 192.168.1.0/24, which is used for small L.A.N's with 254 hosts.

Subnetting — Why It Matters

Borrowing host bits allows for the creation of subnets. This enables segmentation and reduces broadcast domains, which contains breaches, moving toward a zero trust architecture.

For example, using 192.168.1.0/24 and changing it to /26 results in 2 borrowed bits, which creates 2 to the power of 2, or 4 subnets. The remaining host bits are 6, providing 2 to the power of 6 minus 2, or 62 hosts per subnet. Examples of these subnets are .0 to 0.63, 0.64 to 0.127, 0.128 to 0.191, and 0.192 to 0.25.

Image summary: A small diagram illustrating subnetting formulas. It shows that 2 to the power of n equals the number of subnets, where n is the number of borrowed bits, and 2 to the power of h minus 2 equals the number of hosts, where h is the number of host bits left.

Classes D and E Interview Point

- Class D, ranging from 224 to 239, is used for Multicast, such as O.S.P.F 24.0.0.5.

- Class E, ranging from 240 to 25, is experimental or reserved.

- At U.S.C.Y.B.E.R.C.O.M, 10.x /8 private and nat are used internally for OPSEC, then subnetted to /16 per enclave and /24 per vlan.

The Autonomous System

An Autonomous System, or A.S, is the Internet's building block. It is a collection of I.P networks under single administrative control with defined routing policy, which is how the Department of Defense connects globally.

- What is an A.S? It consists of networks under one admin, such as the Department of Defense, an I.S.P, or a university, with one routing policy. It is identified by an A.S.N.

- Regarding A.S.N's and Types, these are unique 16-bit numbers from 0 to 65,535 and 32-bit numbers. Department of Defense examples include A.S 721 and 5972. Types include Single-homed, Multi-homed, Transit, and Stub, with 10.x inside and B.G.P at the edge.

- B.G.P, or Border Gateway Protocol, is used between A.S.e's. It is an Exterior Gateway Protocol that uses T.C.P port 179 and path-vector routing. Routes between Autonomous Systems are handled via peering at boundary routers.

- Inside an A.S, Interior Gateway Protocols such as O.S.P.F, EIGRP, and I.S-I.S route inside an A.S for fast convergence. O.S.P.F is used inside Department of Defense enclaves, while B.G.P is used outside.

Image summary: A diagram illustrates two separate Autonomous Systems. On the left is Autonomous System 721, the Department of Defense network using OSPF inside. On the right is Autonomous System 15109, representing ISP or Internet BGP peers. A double-headed arrow labeled BGP TCP 179 connects the two, showing that BGP routes between ASes while OSPF or EIGRP routes inside an AS.

Regarding relevance to U.S.C.Y.B.E.R.C.O.M, we must defend Department of Defense Autonomous Systems. This means understanding B.G.P hijacking, route leaks, and prefix spoofing, as adversararies can divert Department of Defense Information Network traffic if B.G.P trust is broken. Key areas include B.G.P.sec, R.P.K.I R.O.A, and monitoring A.S path.

Interview Summary & Why I'm Ready

Defending the D.o.D.I.N with fundamentals.

- Under what I understand: an end-to-end view from physical to global. This includes topologies and how L.A.N's are built.

- O.S.I: how data flows and is troubleshooted.

- Devices: what moves it, including switches, routers, firewalls, and I.P.S.

- Protocols and ports: rules, T.C.P versus U.D.P.

- Addressing: R.F.C 1918, classes, slash twenty-four slash twenty-eight, and subnetting.

- A.S and B.G.P: how D-O-D A.S 721 peers to the Internet.

- Troubleshooting Mindset: layer-by-layer, evidence-based.

- Layer one: link lights, cabling, and interface down.

- Layer two: show mac table, and vlan mismatch.

- Layer three: ping, traceroute, and show ip route.

- Layers four through seven: netstat, Wireshark, and logs.

- Tools: ipconfig, nslookup, ssh, and S.N.M.P.

- The method is to define, isolate O.S.I, capture, fix, and then document.

- Security-First: every concept is tied to defense.

- Segmentation reduces blast radius.

- Least privilege via A.C.L's and V.L.A.N's.

- Logging everything to SIEM.

- Zero Trust: never trust, always verify.

- Follow S.T.I.G's, change control, and documentation.

- For Junior Admin, eager to learn, follow, and support mission.

Beverly Eze — Ready to Support U.S.C.Y.B.E.R.C.O.M. Eager to learn, follow S.T.I.G's, document changes, defend D.o.D.I.N. Aligned to D-O-D 8570.

- Network Plus In Progress.

- Security Plus Next.

- C.C.N.A Aligned.