Top 50 IT Infrastructure Interview Questions and Answers (2026)

Key takeaways

• Give a one-line definition first, then add a lab or job example, because interviewers listen for trade-offs rather than textbook wording.
• Cover the whole stack before interviews: servers, virtualisation, storage and backup, networking, security, cloud automation and monitoring, not just your strongest area.
• Practise the scenario questions, such as diagnosing slow servers or planning a restore, since they show how you actually think under pressure.

Each answer is short on purpose. In an interview, give the one-line definition first, then add an example from a lab or job. Interviewers listen for whether you understand trade-offs, not for textbook wording.

Fundamentals

1. What is IT infrastructure?

IT infrastructure is the hardware, software, network and facilities an organisation needs to run its IT services. It covers servers, storage, network devices, operating systems, identity systems, data centres and, today, cloud resources that are managed the same way.

2. What are the main components of IT infrastructure?

• Compute: physical servers, virtual machines, containers
• Storage: local disks, SAN, NAS, object storage, backup systems
• Network: switches, routers, firewalls, load balancers, Wi-Fi, WAN links
• Software: operating systems, hypervisors, directory services, monitoring tools
• Facilities: data centre or server room, power (UPS, generator), cooling, physical security

3. What is the difference between on-premises, cloud and hybrid infrastructure?

On-premises means you own and run the hardware in your own building or a colocation facility. Cloud means you rent compute, storage and services from a provider such as AWS, Azure or Google Cloud. Hybrid combines both, for example keeping a database on-premises for compliance while running web front ends in the cloud.

4. What is the difference between high availability and disaster recovery?

High availability keeps a service running through small failures, such as a failed disk or server, usually with redundant components in the same site. Disaster recovery restores service after a large event, such as losing a whole site, usually from another location. HA reduces downtime from minutes to seconds; DR makes recovery possible at all.

5. What are RTO and RPO?

RTO (recovery time objective) is how long a service can be down before the business is seriously hurt. RPO (recovery point objective) is how much data, measured in time, the business can afford to lose. An RPO of 15 minutes means you need backups or replication at least every 15 minutes.

6. What is an SLA, and how is it different from an SLO?

An SLA (service level agreement) is a formal promise to a customer, often with penalties, such as 99.9% monthly uptime. An SLO (service level objective) is the internal target the team aims for, usually stricter than the SLA so there is a safety margin.

Servers and virtualisation

7. What is virtualisation?

Virtualisation creates software versions of physical resources, so one physical server can run many isolated virtual machines. It improves hardware use, speeds up provisioning and makes snapshots, migration and recovery easier.

8. What is a hypervisor, and what are Type 1 and Type 2?

A hypervisor creates and runs virtual machines. A Type 1 (bare-metal) hypervisor runs directly on hardware, for example VMware ESXi, Microsoft Hyper-V or KVM, and is used in data centres. A Type 2 (hosted) hypervisor runs on top of a desktop OS, for example VMware Workstation or VirtualBox, and is used for labs and testing.

9. What is the difference between a virtual machine and a container?

A VM includes a full guest operating system and is isolated by the hypervisor. A container shares the host's kernel and packages only the application and its libraries, so it starts in seconds and uses less memory. VMs give stronger isolation; containers give faster, denser deployment.

10. What is server consolidation?

Server consolidation means moving many under-used physical servers onto fewer hosts, usually as VMs. It cuts power, cooling, space and licence costs, but you must plan capacity so one host failure doesn't take down too many services.

11. What is live migration?

Live migration moves a running VM from one host to another with no noticeable downtime, for example vMotion in VMware or live migration in Hyper-V and KVM. It lets you patch or replace hosts without stopping services. It needs shared or replicated storage and compatible CPUs.

12. What is hyper-converged infrastructure (HCI)?

HCI combines compute, storage and networking in standard servers managed as one cluster, instead of separate servers and a SAN. Storage is pooled from the local disks of each node. It is simpler to scale but ties storage growth to compute growth.

13. What is a domain controller?

A domain controller is a Windows server running Active Directory Domain Services. It authenticates users and computers (mainly with Kerberos), stores the directory and applies Group Policy. Run at least two so logins keep working if one fails.

14. What is patch management, and how do you do it safely?

Patch management is the process of finding, testing and applying updates. Do it safely by keeping an inventory, prioritising by severity and exposure, testing on a pilot group, scheduling a maintenance window with a rollback plan (snapshot or backup), and then confirming the patch level in reports.

Storage and backup

15. What is RAID, and which levels are common?

A strong answer adds: RAID protects against disk failure, not against deletion, corruption or ransomware, so it is never a backup.

16. What is the difference between SAN, NAS and object storage?

A SAN gives servers block storage over a dedicated network (Fibre Channel or iSCSI), and the server formats it like a local disk. A NAS shares files over the network using SMB or NFS. Object storage, such as Amazon S3, stores data as objects with metadata over HTTP and suits backups, media and very large volumes.

17. What is the 3-2-1 backup rule?

Keep at least three copies of your data, on two different types of media, with one copy off-site. Many teams now add an offline or immutable copy as well, because ransomware often targets backups first.

18. What are full, incremental and differential backups?

A full backup copies everything. An incremental copies only what changed since the last backup of any type, so it is fast but a restore needs the full plus every incremental. A differential copies everything changed since the last full backup, so restores need only two sets, but each differential grows over time.

19. Is a snapshot a backup?

No. A snapshot usually depends on the original disk and lives on the same storage, so if that storage fails or is encrypted, the snapshot goes with it. Snapshots are good for quick rollback before a change. Backups must be stored separately.

20. How do you know your backups actually work?

You test restores on a schedule. Restore sample files, a full VM and a database to an isolated environment, time it against the RTO, and record the result. A backup job that reports "success" but has never been restored is an assumption.

Networking

Networking questions come up in almost every infrastructure interview. For deeper practice, see our networking interview questions.

21. What is the difference between a switch and a router?

A switch connects devices within the same network and forwards frames by MAC address (Layer 2). A router connects different networks and forwards packets by IP address (Layer 3), choosing a path using its routing table. Layer 3 switches can do both inside a campus.

22. What is a VLAN?

A VLAN splits one physical switch into several logical networks. Devices in different VLANs cannot talk directly; traffic must pass through a router or firewall. VLANs are used to separate users, servers, voice and guests.

23. What is network segmentation, and why does it matter?

Segmentation divides a network into zones with controlled traffic between them. It limits how far an attacker or worm can spread, reduces broadcast traffic and makes compliance easier, for example by isolating payment systems.

24. How does DNS work?

DNS turns names such as www.example.com into IP addresses. The client asks a recursive resolver, which queries the root, the top-level domain (.com) and then the domain's authoritative server, and caches the answer for its TTL. DNS uses port 53, mostly over UDP, with TCP for large responses and zone transfers.

25. How does DHCP assign an address?

DHCP uses four messages, often remembered as DORA: Discover, Offer, Request, Acknowledge. The server leases an IP address plus the subnet mask, gateway and DNS servers. Servers use reserved or static addresses; clients usually use DHCP.

26. What are private IP address ranges?

The RFC 1918 private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. They are not routed on the internet, so devices using them reach the internet through NAT.

27. What is a load balancer, and what is the difference between Layer 4 and Layer 7?

A load balancer spreads traffic across several servers and stops sending traffic to unhealthy ones. A Layer 4 balancer decides using IP and port only, so it is fast and protocol-neutral. A Layer 7 balancer reads HTTP details such as the URL or headers, so it can route by path, terminate TLS and handle cookies.

28. What is the difference between a forward proxy and a reverse proxy?

A forward proxy sits in front of clients and makes requests on their behalf, often for filtering or caching outbound web traffic. A reverse proxy sits in front of servers and receives requests on their behalf, often for load balancing, TLS termination and caching.

29. What is a CDN?

A content delivery network caches website content on servers close to users. It reduces latency, offloads the origin server and absorbs traffic spikes and some DDoS attacks.

30. How do you troubleshoot "the server is unreachable"?

Work up the layers. Check the link and interface status, then the IP, mask and gateway (ip a or ipconfig), then ping the gateway and the server, traceroute to see where it stops, DNS with nslookup or dig, and finally whether the service port is open with ss -tlnp on the server and firewall rules in between.

Security

31. What types of firewall are there?

Packet-filtering firewalls check addresses and ports. Stateful firewalls also track connections. Next-generation firewalls add application awareness, intrusion prevention and user identity. Host-based firewalls, such as Windows Defender Firewall or firewalld, protect a single machine.

32. What is a VPN, and when would you use site-to-site versus remote access?

A VPN creates an encrypted tunnel over an untrusted network. Site-to-site VPNs join two office networks permanently. Remote-access VPNs connect individual users to the corporate network. Many organisations now replace broad remote-access VPNs with zero trust access to specific applications.

33. What is zero trust?

Zero trust means no user or device is trusted just because it is inside the network. Every request is authenticated, authorised and checked for device health, with least-privilege access. NIST SP 800-207 is the standard reference architecture.

34. How do you harden a new server?

• Install only required packages and disable unused services
• Patch it before it goes into production
• Use key-based or MFA admin access, disable direct root or default admin logins
• Restrict ports with a host firewall
• Send logs to a central system and add it to monitoring and backup
• Apply a baseline such as a CIS Benchmark

35. What is the principle of least privilege?

Users, services and administrators get only the access they need, for only as long as they need it. In practice that means separate admin accounts, role-based access, time-limited elevation and regular access reviews.

36. How would you protect infrastructure against ransomware?

Combine prevention and recovery: patch internet-facing systems quickly, enforce MFA, limit admin rights, segment the network, monitor with EDR, and keep offline or immutable backups that you have test-restored. Recovery capability is what decides whether an attack becomes a disaster.

Cloud and automation

37. What are IaaS, PaaS and SaaS?

IaaS rents raw infrastructure such as VMs, storage and networks (for example Amazon EC2 or Azure Virtual Machines). PaaS provides a managed platform where you deploy code without managing servers (for example Azure App Service or Google App Engine). SaaS delivers finished software (for example Microsoft 365). The higher you go, the less you manage.

38. What is the shared responsibility model?

The cloud provider secures the underlying infrastructure: data centres, hardware and the virtualisation layer. The customer secures what they put on it: data, identities, access settings, and the OS and applications in IaaS. Misconfigured storage buckets and weak IAM are customer-side failures.

39. What is Infrastructure as Code?

Infrastructure as Code (IaC) defines servers, networks and settings in version-controlled files, so environments are built the same way every time. Terraform and OpenTofu are common for provisioning; Ansible is common for configuration. Our Infrastructure as Code interview questions go deeper.

40. What is configuration drift?

Drift happens when a system's real settings slowly differ from its documented or coded state, usually through manual fixes. It causes "works on one server only" problems. IaC, configuration management and regular compliance scans prevent it.

41. What is Kubernetes, and why do infrastructure teams care?

Kubernetes orchestrates containers across a cluster: it schedules them, restarts failed ones, scales them and handles service discovery. Infrastructure teams run the clusters, storage, networking and access controls that application teams deploy onto.

42. What is the difference between vertical and horizontal scaling?

Vertical scaling adds CPU or RAM to one machine; it is simple but has a ceiling and usually needs a restart. Horizontal scaling adds more machines behind a load balancer; it needs stateless or clustered applications but scales further and improves availability.

Monitoring and operations

43. Which metrics do you monitor on a server?

CPU usage and load, memory and swap, disk space and disk I/O latency, network throughput and errors, and service-level checks such as whether the website returns HTTP 200 in time. Alert on symptoms users feel, not on every metric.

44. Which monitoring tools have you used?

Name tools you have genuinely used and what you did with them. Common ones are Zabbix and Nagios for infrastructure checks, Prometheus with Grafana for metrics and dashboards, and an ELK or similar stack for logs. Interviewers will ask a follow-up, so don't list tools you have never touched.

45. What is SNMP used for?

SNMP lets a monitoring system read status and counters from network devices and servers, and receive alerts (traps). Polling uses UDP port 161 and traps use UDP 162. Use SNMPv3, which adds authentication and encryption, instead of v1 or v2c community strings.

46. What is ITIL?

ITIL is a widely used framework of IT service management practices, such as incident, problem, change and service request management. PeopleCert has introduced ITIL (Version 5), and ITIL 4 certifications remain valid. Interviewers care more that you can follow the processes than which version you studied.

47. What is the difference between an incident and a problem?

An incident is an unplanned interruption, such as "email is down"; the goal is to restore service quickly. A problem is the underlying cause of one or more incidents; the goal is to find and remove the root cause so it doesn't recur.

48. Why does change management matter?

Many outages are caused by changes. Change management makes sure each change is planned, reviewed, scheduled and has a rollback plan, and that the people affected know about it. Standard low-risk changes can be pre-approved so the process doesn't slow routine work.

Scenario questions

49. A critical server is down at 2 a.m. What do you do?

Acknowledge the alert and inform stakeholders through the incident process. Check whether the host is reachable, then console or out-of-band access (iLO, iDRAC) for power and hardware state, then logs. Restore service first, for example by failing over, and only then dig into root cause. Write up what happened afterwards.

50. Users say "the network is slow". How do you investigate?

Narrow it down: one user or everyone, one application or all, one site or all? Check interface utilisation and errors on the switches and WAN links, test latency with ping and path with traceroute, look for recent changes, and confirm whether it is really the network or a slow server, DNS or application.

How should you prepare for an IT infrastructure interview?

Three habits make the biggest difference. Build a small home lab so your answers come from things you've done. Prepare two or three real stories about outages or projects using situation, action and result. And be honest when you don't know something; explain how you would find out.

Next step

Pick the five questions above you'd struggle to explain without notes and practise them in a lab this week. Linux is the base layer of most modern infrastructure, so if that is your weak spot, structured RHCSA and RHCE training is a solid foundation for infrastructure roles.

Related reading

• [2026] Cloud Infrastructure Interview Questions and Answers
• [2026] Top 50+ Cloud Architecture Interview Questions and Answers
• Green IT: The Path to Energy-Efficient Technology