The Full Mock Interview Script (what he'll ask, in order)
A realistic 1-hour flow with a hands-on hiring manager for THIS role. Each question: what he's probing for + what your answer must hit. Full model answers live in 07 (Q1-Q30), depth in 02-06. Practice out loud; a typed answer is half an answer.
0. Opener (~5 min)
Q1. "Walk me through your current role and how it maps to this one — BGP, OpenShift, F5." Probing: do you actually own infrastructure, or process tickets? Real on-prem depth? Hit: the topology answer (09: F5 BGP + MetalLB BGP), scale (1000+ Linux, on-prem DC), redundancy angle (runbooks + mentoring 15 admins — their SPOF fear).
Q2. "Tell me about your BGP experience. What did you actually own?" Probing: resume-claim check. This is where the whiteboard story (09 Diagram A) lands. Hit: peers, advertisements, route maps on F5; MetalLB CRDs on OCP; the DR-failover war story; name the ASNs (ground-truth them tomorrow).
1. BGP fundamentals — he will ladder these (~15 min)
Q3. "Walk me through a BGP session coming up." → FSM states, TCP 179, OPEN/keepalive/UPDATE; "stuck in Active = ACL or reachability, not ASN — checked in that order."
Q4. "eBGP vs iBGP — what's actually different?" → loop prevention (AS_PATH vs split-horizon), next-hop inheritance, TTL 1 vs 255, LOCAL_PREF, full-mesh/RR.
Q5. "Two routes to the same prefix. How do you pick?" → the path-selection ladder (02 §4); "the two knobs I actually touch: local-pref outbound, prepend/MED inbound."
Q6. "Route in the BGP table but not installed. Why?" → inbound policy, unreachable NEXT_HOP (next-hop-self), max-prefix, better existing path.
Q7. "A session flaps every few minutes. Your process?" → alerting first, then L1 errors/CRC, MTU blackhole, CPU/CoPP starving keepalives, duplicate RID.
Q8. "Inbound vs outbound traffic influence?" → outbound = local-pref/weight; inbound = prepend/MED/communities; "you influence, you don't control — verify with traceroutes."
Q9. "Why route reflectors?" → iBGP split-horizon → N² full mesh; RRs reflect with originator/cluster-id; two for redundancy, peer to loopbacks.
Q10. "BFD or aggressive BGP timers?" → BFD sub-second at L1, timers eat CPU and flap under load; BFD on fabric + MetalLB sessions.
Q11. "Why leaf-spine eBGP in the DC?" → all links active, no STP, ECMP scale-out, blast-radius containment, fabric-level policy.
Q12. "BGP unnumbered — what problem?" → no link IPAM; IPv6 link-local + RFC 5549 extended next-hop; plug-and-play leaves.
Q13. "When does ECMP break?" → attribute mismatch, hash polarization (identical hashing spine+leaf), MTU asymmetry.
Q14. "Primary WAN dies. What do you do?" → scope, redundant path (local-pref design), inbound via second ISP (prepend), app verification, post-incident runbook update. "I test failover, not just hope it works."
2. OpenShift + MetalLB — his home turf (~15 min)
Q15. "Where does BGP sit in your OpenShift stack?" → THE layering answer (03 §4): OVN-K = overlay, no BGP; BGP only at MetalLB/FRR edge → ToR. "Keeping that boundary clean is what makes it debuggable."
Q16. "Walk a request from the internet to a pod in BGP mode." → hop-by-hop (05 + 03 §4): FW → fabric ECMP on /32 → node → OVN-K DNAT → pod (Geneve if remote).
Q17. "MetalLB L2 vs BGP — which and why?" → L2 = simple, single-node bottleneck, hairpin, election failover; BGP = ECMP, graceful withdraws, real redundancy. "Production = BGP mode. That's why I'm here."
Q18. "externalTrafficPolicy Cluster vs Local?" → SNAT + source-IP tradeoff; "same tradeoff as F5 SNAT automap vs transparency — I've debugged both."
Q19. "Worker dies. What happens to the VIP?" → speaker session drops → /32 withdrawn → ECMP set shrinks (BFD sub-second) → OVN-K reprograms backends; drain withdraws BEFORE pods terminate.
Q20. "OVN-K vs OpenShift SDN?" → OVN-K default since 4.12, SDN deprecated; ACL-compiled NetworkPolicies, EgressFirewall, better convergence.
Q21. "How do you scope the announcement policy?" → dedicated VIP CIDR, /32s, per-env pools, communities, BFD + auth + max-prefix on every peer. "Announcement policy is a security boundary."
3. Virtualization & migration — the project (~10 min)
Q22. "How do VMs run on OpenShift?" → KubeVirt: VM CRD, virt-launcher pod (QEMU/KVM), PVC disks (CDI), pod network or bridge NADs, live migration.
Q23. "Walk me through moving a Windows VM from vSphere to OCP." → MTV: provider + NetworkMap + StorageMap → warm migration, virt-v2v injects VirtIO → CBT incrementals → cutover → rollback window (04 §2).
Q24. "What breaks with Windows VMs?" → VirtIO drivers (boot SATA→virtio), RDM, static IP/MAC licensing, VMware Tools→qemu-ga, clock skew (Kerberos/AD!), snapshots for CBT.
Q25. "How do migrated VMs keep their VLANs?" → Multus bridge NADs on trunked workers → VM keeps L2 leg during coexistence.
Q26. "Patching nodes without breaking VMs?" → maintenance mode → live-migrate off → drain → MCO → back. "Deletes the maintenance-window problem."
Q27. "Containerize vs lift-and-shift — how do you decide?" → dependency audit (.NET/IIS, DB, licensing), cost of refactor vs risk of delay; MTV for the rest; phased.
4. Hardening — the second pillar (~8 min)
Q28. "Harden a BGP session for me." → GTSM, TCP-AO/MD5, max-prefix, bidirectional filters + deny-all, CoPP, RPKI/BCP38 at edge, logging/alerting on state change (06 §1 script).
Q29. "Micro-segment the cluster?" → default-deny NetworkPolicies (label-based), EgressFirewall, RBAC/SCC restricted-v2, encrypted etcd, secrets management.
Q30. "RHEL hardening?" → SELinux enforcing (sealert, never permissive), CIS via Ansible, firewalld zones, sysctls (rp_filter, syncookies), sshd MFA/key-only.
Q31. "You've used NinjaOne?" → HONEST answer + map SCCM/WSUS + Ansible model (06 §6). Never fake it.
5. Breadth + closer (~7 min)
Q32. "Best production incident you solved?" → ONE story: scope → diagnosis → fix → prevention. Use the DR/BGP story or the 50TB NFS migration.
Q33. "NFS vs iSCSI vs LVM for OpenShift storage?" → shared/read-many → NFS; DBs → iSCSI block; local-fast → LVM. Never etcd on NFS.
Q34. "What makes on-prem different from AWS?" → you own the fabric, the BGP, the VIPs, the DR. "That's the part I like — the cloud hides it."
Q35. "Questions for me?" → pick 3-4 from 07.
Interview mechanics
- He WILL interrupt — each interruption is a probe. Answer it in one sentence, then return to your thread. Interruption = engagement, not failure.
- If he's still deep in BGP at minute 25, you're winning — that's the filter question section.
- Anything you claim, be ready to go ONE level deeper on. If you say "route map," know the match conditions. If you say "BFD," know the multiplier. The ladder only gets steeper after a correct answer.
- The SPOF line to drop once, naturally: "The way I've worked against bus-factor on my team is runbooks and cross-training — that's why I'm excited about a team where I can share the BGP load." (Direct hit on why they're hiring.)