The master answer

There is one question you will almost certainly be asked. You have already learned the whole answer. What is left is delivering it in order, without freezing.

Why & what

Why this one question. "What happens when you type a URL and press Enter?" is loved by interviewers because one question tests eight topics at once.

It shows them whether you understand the layers as a connected system or as eight memorised definitions. Someone who really understands it narrates a journey. Someone who does not lists facts in random order.

What a good answer looks like. Six beats, in order, about ninety seconds total.

The rule for depth. Depth is negotiable, order is not. If you are running long, shorten each beat. Never drop one.

Beat 1 is the one people skip, and it is free marks — most candidates start at DNS and never mention that the machine had to get an address first.

How it works

The full answer, said out loud:

1. "First the machine needs to be on the network." DHCP's DORA exchange gives it an IP address, subnet mask, default gateway and DNS server.
2. "Then the name has to become an address." The browser checks its cache, then the OS cache, then asks a resolver, which queries root, then the TLD, then the authoritative server. Answer: an A record. This is UDP on port 53.
3. "Now, is that address local?" The host ANDs the destination with its subnet mask. It does not match, so the packet goes to the default gateway. It uses ARP to find the gateway's MAC address and builds an Ethernet frame.
4. "Crossing the internet." NAT rewrites the private source address to the public one. The router matches the destination against its routing table using longest prefix match and forwards. Every hop strips the frame and builds a new one, so MAC addresses change while the IP addresses stay the same.
5. "At the server." TCP completes a three-way handshake on port 443, TLS negotiates encryption and validates the certificate, then the browser sends GET /results.
6. "Coming back." The response arrives as numbered segments, TCP acknowledges and reorders them, and the browser renders the page.

Common confusion

Students think a longer answer scores better. Actually, a complete answer scores better, and length works against you.

An answer that spends ninety seconds on DNS alone and never reaches TCP looks worse than a ninety-second answer covering all six beats at moderate depth. The interviewer is checking for gaps, and a gap is invisible if you never got there.

Say all six. Then stop. If they want depth, they will ask — and a follow-up question you answer well is worth more than volunteering the same content unprompted.

Interview angle

Asked as: exactly the question above. Sometimes narrowed: "just the DNS part", or "what happens after the TCP connection opens".

Model answer: the six beats in section 3, spoken continuously. If you can say those without notes, this topic is done.