20 OS and Computer Networks Interview Questions, With Answers

In a technical round, operating systems and computer networks usually come up as short "explain this" questions between coding problems. Interviewers are not looking for textbook paragraphs. They want a clear definition, one concrete example, and the trade-off. Below are 20 questions that come up again and again (10 on OS, 10 on networks), each with an answer of the length you should actually give out loud.

Operating systems

1. What is the difference between a process and a thread?

A process is a running program with its own memory space: its own code, data, heap and open files. A thread is a path of execution inside a process. Threads of the same process share its memory and files, but each has its own stack, registers and program counter.

Because threads share memory, creating and switching between them is cheaper, and they can communicate simply by reading and writing shared data. The cost is that a bug in one thread can corrupt data used by the others, which is why threads need synchronisation. Processes are isolated: if one crashes, the others keep running. A web browser that runs each tab as a separate process is using exactly that isolation.

2. What is a context switch?

A context switch is the operating system saving the state of the running process or thread (registers, program counter, stack pointer) and loading the saved state of another, so that the CPU can run it. It happens when a time slice ends, when a task waits for I/O, or when a higher-priority task becomes ready.

It is pure overhead, because no useful work is done during the switch. Switching between threads of the same process is cheaper than switching between processes, because the memory mappings do not change.

3. Explain the common CPU scheduling algorithms.

• First-Come, First-Served (FCFS): run tasks in arrival order. Simple, but one long job makes everyone behind it wait (the convoy effect).
• Shortest Job First (SJF): run the shortest job next. It gives the lowest average waiting time, but needs to know job lengths in advance, and long jobs can starve.
• Round Robin: every task gets a fixed time slice (quantum) in turn. It is fair and responsive, which suits interactive systems. A very small quantum wastes time on context switches; a very large one behaves like FCFS.
• Priority scheduling: run the highest-priority task first. Low-priority tasks can starve; aging, which slowly raises the priority of tasks that have waited a long time, fixes that.

Also know the difference between preemptive scheduling, where a running task can be interrupted, and non-preemptive, where it runs until it finishes or blocks.

4. What is a deadlock, and what conditions cause it?

A deadlock is when a set of processes each hold a resource and wait for a resource held by another process in the set, so none of them can ever continue. All four of these conditions (the Coffman conditions) must hold at the same time:

1. Mutual exclusion: a resource can be used by only one process at a time.
2. Hold and wait: a process holds one resource while waiting for another.
3. No preemption: a resource cannot be taken away from a process; it must be released.
4. Circular wait: P1 waits for P2, which waits for P3, …, which waits for P1.

The everyday example is two threads: one locks A and then wants B, while the other locks B and then wants A.

5. How can deadlocks be prevented, avoided or handled?

• Prevention: break one of the four conditions. The most practical is breaking circular wait by always acquiring locks in a fixed global order (for example, always A before B).
• Avoidance: before granting a resource, check that the system stays in a safe state. The Banker's algorithm does this, but it needs each process's maximum demand in advance, so it is rarely used outside textbooks.
• Detection and recovery: let deadlocks happen, detect cycles in the wait-for graph, then kill a process or take back resources. Databases do this with transactions.
• Ignoring it: most general-purpose operating systems leave deadlock handling to applications. This is sometimes called the ostrich approach.

6. What is the difference between a mutex and a semaphore?

A mutex is a lock that allows exactly one thread into a critical section. It has an owner: the thread that locked it is the one that unlocks it.

A semaphore is a counter with two atomic operations: wait (P), which decrements it and blocks if it would go below zero, and signal (V), which increments it. A counting semaphore initialised to N lets up to N threads use a pool of N resources, such as database connections. A binary semaphore (0 or 1) looks like a mutex, but it has no owner, so one thread can signal another. That makes it useful for signalling ("the data is ready"), not just for locking.

7. What is virtual memory, and what is a page fault?

Virtual memory gives each process its own large address space that the operating system maps onto physical RAM, with parts kept on disk when RAM is short. Programs can then be larger than RAM, processes are isolated from one another, and memory does not need to be contiguous.

Memory is divided into fixed-size pages (virtual) and frames (physical), and a page table maps one to the other. A page fault happens when a process touches a page that is not currently in RAM. The OS pauses the process, loads the page from disk (evicting another page if RAM is full), updates the page table and resumes the process. The TLB is a small cache of recent page-table entries that makes the translation fast.

8. What is the difference between paging and segmentation? What is fragmentation?

Paging splits memory into equal fixed-size blocks. Segmentation splits it into variable-size logical units, such as code, stack and heap.

• Internal fragmentation: wasted space inside an allocated block. Paging has it, because the last page of a process is rarely full.
• External fragmentation: enough free memory in total, but in pieces too small to use. Segmentation and contiguous allocation have it; paging avoids it, because any free frame can be used.

9. What is thrashing?

Thrashing is when a system spends more time swapping pages between RAM and disk than doing real work. It happens when the running processes together need more pages than fit in RAM: each page fault evicts a page that is needed again almost immediately. CPU use drops even though the system looks busy.

The fixes are to run fewer processes at once, to give each process enough frames for its working set (the pages it is actively using), or to add RAM.

10. Name the page replacement algorithms. What is Belady's anomaly?

When RAM is full and a new page is needed, the OS must choose which page to evict:

• FIFO: evict the page that has been in memory longest. Simple, but it may throw out a page that is used constantly.
• LRU (Least Recently Used): evict the page unused for the longest time. Close to the best in practice, but expensive to track exactly, so real systems approximate it (for example, with the clock algorithm).
• Optimal: evict the page that will not be needed for the longest time in the future. It is impossible to implement, because it needs to know the future, but it serves as the benchmark for the others.

Belady's anomaly: with FIFO, giving a process more frames can sometimes cause more page faults. The reference string 1, 2, 3, 4, 1, 2, 5, 1, 2, 3, 4, 5 causes 9 faults with 3 frames and 10 faults with 4. LRU and Optimal never show this anomaly.

Computer networks

11. Explain the OSI model and the TCP/IP model.

The OSI model has seven layers, from the bottom up:

The TCP/IP model, which the internet actually uses, merges these into four layers: Link (OSI 1–2), Internet (3), Transport (4) and Application (5–7). A good way to remember the difference: OSI is the reference for talking about networks, and TCP/IP is what is implemented.

12. What is the difference between TCP and UDP?

Choose TCP when every byte must arrive correctly. Choose UDP when speed matters more than the odd lost packet: in a video call, a late frame is useless anyway.

13. Explain the TCP three-way handshake.

1. The client sends SYN with its starting sequence number.
2. The server replies SYN-ACK: it acknowledges the client's number and sends its own.
3. The client sends ACK to acknowledge the server's number.

Both sides now know the other is reachable and have agreed on sequence numbers, which TCP uses to order data and detect loss. Closing a connection usually takes four messages (FIN, ACK, FIN, ACK), because each side closes its direction separately.

14. What happens when you type a URL into a browser and press Enter?

1. DNS lookup: the browser finds the domain's IP address, checking caches first (browser, operating system, router) and then asking a DNS resolver.
2. TCP connection: the browser opens a connection to that IP, on port 443 for HTTPS, with the three-way handshake.
3. TLS handshake: the browser and server agree on encryption, and the browser checks the server's certificate.
4. HTTP request: the browser sends something like GET /index.html, with headers and cookies.
5. Server response: the server (often behind a load balancer) returns a status code, headers and the HTML.
6. Rendering: the browser parses the HTML, requests the CSS, JavaScript and images it references (more requests, often over the same connection), builds the page and paints it.

This is a favourite because it touches every layer. Say the steps in order, then offer to go deeper into any one of them.

15. How does DNS work?

DNS turns names like www.example.com into IP addresses. When nothing is cached, a recursive resolver (usually your ISP's, or a public one such as 8.8.8.8) does the work:

1. It asks a root server, which replies with the servers for .com.
2. It asks a .com (TLD) server, which replies with example.com's authoritative name servers.
3. It asks the authoritative server, which replies with the IP address.

The answer is cached for its TTL (time to live), so later lookups are fast. Common record types: A (IPv4 address), AAAA (IPv6), CNAME (an alias for another name), MX (mail server). DNS mostly uses UDP on port 53, and switches to TCP for large responses.

16. What is the difference between HTTP and HTTPS?

HTTPS is HTTP sent over TLS. TLS gives three things: encryption (nobody in between can read the traffic), integrity (nobody can change it unnoticed) and authentication (a certificate signed by a trusted authority proves you are talking to the real server). HTTP uses port 80, and HTTPS uses port 443.

In the TLS handshake, the server presents its certificate, the two sides agree on a cipher, and they use public-key cryptography to establish a shared secret key. The page data is then encrypted with fast symmetric encryption using that key.

17. Explain IP addresses, subnet masks and private ranges.

An IPv4 address is 32 bits, written as four numbers from 0 to 255 (for example 192.168.1.10). IPv6 addresses are 128 bits, written in hexadecimal; IPv6 exists because IPv4's roughly 4.3 billion addresses ran out.

A subnet mask or CIDR suffix says how many bits identify the network. In 192.168.1.0/24, the first 24 bits are the network and the last 8 identify hosts: 2⁸ = 256 addresses, of which 254 can be given to devices, because the first is the network address and the last is the broadcast address.

The private ranges, used inside homes and offices and not routed on the internet, are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. NAT on the router lets many private devices share one public address.

18. What is the difference between a hub, a switch and a router?

• A hub (layer 1) copies every incoming signal out of every port. It is simple and wasteful, and is rarely used now.
• A switch (layer 2) learns which MAC address is on which port and forwards each frame only where it needs to go, within one local network.
• A router (layer 3) connects different networks and forwards packets by IP address, for example between your home network and your ISP.

19. What is ARP?

ARP (Address Resolution Protocol) finds the MAC address for an IP address on the local network. To send a packet to 192.168.1.20, a computer broadcasts "Who has 192.168.1.20?", and that device replies with its MAC address. The answer is kept in an ARP cache. For an address outside the local network, the computer instead looks up the MAC address of its default gateway (the router) and sends the packet there.

20. Which port numbers and HTTP status codes should you know?

Ports: HTTP 80, HTTPS 443, SSH 22, FTP 21 (control), SMTP 25 (587 for sending mail from an email client), DNS 53, MySQL 3306, PostgreSQL 5432.

HTTP status codes:

• 2xx: success. 200 OK, 201 Created, 204 No Content.
• 3xx: redirection. 301 Moved Permanently, 302 Found (temporary), 304 Not Modified (use your cached copy).
• 4xx: the client's mistake. 400 Bad Request, 401 Unauthorized (not logged in), 403 Forbidden (logged in, but not allowed), 404 Not Found, 429 Too Many Requests.
• 5xx: the server's failure. 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable.

The difference between 401 and 403 is a common follow-up question.

How to revise these

• Say each answer out loud in under a minute. If you cannot, you do not know it well enough yet.
• For each topic, keep one concrete example ready: the browser tab for processes, two locks for deadlock, a video call for UDP.
• Expect the follow-up "why?" questions: why UDP for video, why LRU over FIFO, why HTTPS needs a certificate.

A mock technical interview asks questions like these and lets you hear how your answers sound. For the database side of core CS, see 25 SQL interview queries with answers.

FAQ