Skip to content
CCNA
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

CCNA Interview Questions & Answers

All 200 unique questions in one place — 60 easy, 96 medium, 44 hard — grouped by topic.

Practise by topic

Network Fundamentals · 25IP Addressing and Subnetting · 25Switching and VLANs · 25STP and EtherChannel · 25Routing and OSPF · 25IP Services · 25Network Security · 25Wireless and Automation · 25

Practise the way your interview works

Company-wise CCNA questionsExperience-wise CCNA questionsRole-wise CCNA questionsCity-wise CCNA questionsMost asked CCNA questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCCNA mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCCNA topic sheets
Solved overallStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What are the seven layers of the OSI model?

Network FundamentalsEasy
Save to ▾
Show answer
From bottom to top: Physical, Data Link, Network, Transport, Session, Presentation and Application. Each layer serves the one above it. For example, Ethernet frames work at Layer 2, IP packets at Layer 3 and TCP segments at Layer 4. Engineers use the model to troubleshoot bottom-up: check cables and link lights first, then MAC learning, then IP reachability.
02

How does the TCP/IP model map to the OSI model?

Network FundamentalsEasy
Save to ▾
Show answer
The TCP/IP model has four or five layers. Its Application layer covers OSI layers 5 to 7, Transport maps to Layer 4, Internet maps to Layer 3, and Network Access (or Link plus Physical) covers layers 1 and 2. CCNA uses the five-layer version. Real protocols such as HTTP, TCP and IP are defined by the TCP/IP suite, so it is the practical model.
03

What is the difference between TCP and UDP?

Network FundamentalsEasy
Save to ▾
Show answer
TCP is connection-oriented: it uses a three-way handshake, sequence numbers, acknowledgements, retransmission, windowing and flow control, so delivery is reliable and ordered. UDP is connectionless with an 8-byte header and no retransmission, so it is faster and lighter. HTTPS, SSH and SMTP use TCP; DNS queries, DHCP, SNMP, TFTP and voice or video RTP streams use UDP.
04

Explain the TCP three-way handshake.

Network FundamentalsEasy
Save to ▾
Show answer
The client sends a SYN with an initial sequence number. The server replies with SYN-ACK, acknowledging the client sequence and sending its own. The client sends an ACK and the session is established. Closing uses FIN and ACK from each side. A firewall that sees repeated SYNs without the final ACK may be looking at a SYN flood attack.
05

What is the difference between a hub, a switch and a router?

Network FundamentalsEasy
Save to ▾
Show answer
A hub is a Layer 1 repeater: it floods every bit out of every port, so all ports share one collision domain. A switch is Layer 2: it learns MAC addresses and forwards frames only to the correct port, giving each port its own collision domain. A router is Layer 3: it forwards packets between IP networks and separates broadcast domains.
06

Users on a new floor report no network connectivity at all and the switch port LEDs are off. What is your approach?

Network FundamentalsEasy
Save to ▾
Show answer
No link light means a Layer 1 problem. I verify the switch has power and the ports are not administratively shut down with show ip interface brief. I test the cable with a tester, check the patch panel mapping and confirm the NIC is enabled. If the switch uses PoE for phones or access points, I also check the power budget with show power inline.
07

How do you check interface status and errors on an IOS device?

Network FundamentalsEasy
Save to ▾
Show answer
show ip interface brief gives status and IP of all interfaces, and show interfaces gives counters and duplex. Router# show ip interface brief Router# show interfaces GigabitEthernet0/1 Router# show interfaces status Router# clear counters GigabitEthernet0/1 Status up/down means Layer 1 is up but Layer 2 keepalives fail; administratively down means the interface is shut.
08

How do you do the basic initial configuration of a new switch?

Network FundamentalsEasy
Save to ▾
Show answer
Set the hostname, secure access and save the config. enable configure terminal hostname SW1 enable secret Str0ngPass service password-encryption banner motd #Authorized access only# line console 0 password ConPass login end copy running-config startup-config
09

What is the difference between running-config and startup-config?

Network FundamentalsEasy
Save to ▾
Show answer
running-config lives in RAM and holds the active configuration, so every change applies immediately but is lost on reload. startup-config is stored in NVRAM and is loaded at boot. You save with copy running-config startup-config or write memory. To roll back unsaved changes you can reload without saving, which is why many engineers use reload in 10 before risky remote changes.
10

Why do you want to build a career in networking?

Network FundamentalsEasy
Save to ▾
Show answer
Situation: in college I set up the hostel Wi-Fi and LAN for 120 students. Task: fix constant drop-outs. Action: I learned VLANs, channel planning and DHCP, then practiced every CCNA topic in Packet Tracer and GNS3. Result: complaints dropped sharply, and I realised I enjoy solving real problems that affect many people. Networking underpins cloud, security and automation, so it gives me a long and growing career path.
11

What is a collision domain and a broadcast domain?

Network FundamentalsMedium
Save to ▾
Show answer
A collision domain is a segment where two devices sending at the same time can collide; every switch port is its own collision domain, and with full duplex collisions do not occur. A broadcast domain is the set of devices that receive a Layer 2 broadcast. Routers and VLANs separate broadcast domains, so one VLAN equals one broadcast domain.
12

Compare single-mode and multimode fiber.

Network FundamentalsMedium
Save to ▾
Show answer
Single-mode fiber has a small core (about 9 microns) and uses a laser, so it carries light over long distances, often 10 km or more. Multimode fiber has a larger core (50 or 62.5 microns), uses cheaper LED or VCSEL optics and suits shorter runs inside a building or data center, usually up to a few hundred metres at 10 Gbps. SFP modules must match the fiber type.
13

What is the difference between a two-tier and a three-tier campus design?

Network FundamentalsMedium
Save to ▾
Show answer
A three-tier design has access, distribution and core layers: access connects users, distribution aggregates access switches and applies policy, and the core provides fast transport between distribution blocks. A two-tier or collapsed-core design merges core and distribution, which suits small and medium campuses with fewer buildings. Three-tier scales better when there are many distribution blocks.
14

What is a spine-leaf architecture and why is it used in data centers?

Network FundamentalsMedium
Save to ▾
Show answer
In spine-leaf, every leaf switch connects to every spine switch, and servers connect only to leaves. Any server is therefore at most two hops from another, giving predictable latency and good east-west bandwidth. Capacity is added by adding spines or leaves. It usually runs Layer 3 with ECMP to use all links, instead of relying on spanning tree.
15

A user complains the network is slow and the switch port shows many late collisions and CRC errors. What do you check?

Network FundamentalsMedium
Save to ▾
Show answer
Late collisions usually mean a duplex mismatch, and CRC errors point to bad cabling or interference. I would run show interfaces on the port to see duplex, speed and error counters, check the PC NIC settings, and set both sides to auto or hard-code both identically. Then I would replace the patch cable, clear counters and watch whether errors still increase.
16

A PC can ping its default gateway but cannot open any website. How would you troubleshoot?

Network FundamentalsMedium
Save to ▾
Show answer
Gateway reachability proves Layers 1 to 3 locally, so I move upward. I ping a public IP address; if that works but names fail, DNS is the problem, so I check the configured DNS server with ipconfig /all and test with nslookup. If the public IP also fails, I check the router's default route, NAT and upstream link. Finally I check proxy settings and any firewall blocking ports 80 and 443.
17

Your company is adding a new branch with 40 users. What network components would you propose?

Network FundamentalsMedium
Save to ▾
Show answer
A branch router or SD-WAN edge for the WAN link and internet, one or two 48-port PoE access switches for PCs, phones and access points, and wireless access points managed by a controller or the cloud. I would add a firewall function, DHCP and DNS settings, VLANs for data, voice, guest and management, and a backup 4G or broadband link for resilience.
18

How do you configure SSH access on a switch or router?

Network FundamentalsMedium
Save to ▾
Show answer
SSH needs a hostname, domain name, RSA keys, a local user and VTY lines restricted to SSH. hostname R1 ip domain-name lab.local crypto key generate rsa modulus 2048 ip ssh version 2 username admin privilege 15 secret Adm1nPass line vty 0 4 login local transport input ssh
19

How do you use CDP and LLDP to discover neighbours?

Network FundamentalsMedium
Save to ▾
Show answer
CDP is a proprietary Layer 2 discovery protocol enabled by default on IOS; LLDP is the open IEEE 802.1AB standard. show cdp neighbors show cdp neighbors detail configure terminal lldp run show lldp neighbors detail Detail output shows the neighbour's IP, platform and port. Disable CDP on internet-facing ports with no cdp enable.
20

Which commands would you use to test end-to-end reachability and find where packets stop?

Network FundamentalsMedium
Save to ▾
Show answer
ping tests reachability and round-trip time, and traceroute shows each Layer 3 hop. R1# ping 10.2.2.2 source Loopback0 R1# traceroute 10.2.2.2 PC> tracert 10.2.2.2 An extended ping lets you set source, size and the DF bit to test MTU. Where traceroute shows asterisks, that hop is dropping or filtering ICMP.
21

How does a switch learn and forward frames?

Network FundamentalsMedium
Save to ▾
Show answer
A switch reads the source MAC of each incoming frame and records it with the port in the MAC address table. For forwarding it looks up the destination MAC: a known unicast goes out one port, while unknown unicast, broadcast and most multicast frames are flooded in the VLAN. Entries age out after 300 seconds by default. Check with show mac address-table.
22

Tell me about a time you solved a difficult network outage.

Network FundamentalsMedium
Save to ▾
Show answer
Situation: a branch lost access to the data center during month-end close. Task: restore service fast. Action: I worked bottom-up, found the WAN link up but OSPF stuck in EXSTART, and traced it to an MTU change by the provider. I set ip ospf mtu-ignore as a temporary fix and raised a ticket for the MTU. Result: service was back in 25 minutes and I documented the check in our runbook.
23

A server team reports that a link between two switches is up but traffic is dropping intermittently. What do you check?

Network FundamentalsHard
Save to ▾
Show answer
I check show interfaces on both ends for input errors, CRC, runts, giants, output drops and resets. Output drops suggest congestion, so I look at utilisation and QoS. CRC errors suggest a bad cable, dirty fiber or faulty SFP, so I check optical levels with show interfaces transceiver. I also confirm both sides agree on speed and duplex and that the MTU matches.
24

After a core switch replacement, ping works across the campus but large file transfers and some VPN sessions hang. What do you suspect?

Network FundamentalsHard
Save to ▾
Show answer
Suspect an MTU mismatch. Small pings fit in one frame, but full-size packets are dropped when one link or the new switch uses a smaller MTU, or when ICMP is blocked so Path MTU Discovery fails. Test with ping using a size of 1472 and the do-not-fragment bit, compare interface MTU on both ends, and check jumbo frame settings. Fix by matching MTU end to end or adjusting TCP MSS on tunnel interfaces.
25

Tell me about a time you led a network migration or a major change.

Network FundamentalsHard
Save to ▾
Show answer
Situation: our office had to move 300 users from old access switches to a new stack in one weekend. Task: I owned the plan. Action: I documented every port, pre-built configs, ran a pilot on one floor, wrote a rollback plan and kept a call bridge open with the desktop team. Result: we finished two hours early with only three port issues, fixed on Monday morning. I learned that a tested rollback plan gives the whole team confidence.
26

What are the IPv4 address classes and private ranges?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
Class A is 1 to 126 with a default /8, Class B is 128 to 191 with /16, Class C is 192 to 223 with /24, Class D 224 to 239 is multicast and Class E is reserved. RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 127.0.0.0/8 is loopback and 169.254.0.0/16 is APIPA link-local. Today addressing is classless (CIDR).
27

How many usable hosts are in a /26 subnet and what is the block size?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
A /26 leaves 6 host bits, so 2 to the power 6 is 64 addresses and 62 usable hosts after removing network and broadcast. The mask is 255.255.255.192 and the block size is 256 minus 192, which is 64. So subnets of 192.168.1.0/26 start at .0, .64, .128 and .192. For 192.168.1.70/26 the network is .64 and broadcast .127.
28

What is the structure of an IPv6 address and how is it shortened?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
IPv6 addresses are 128 bits written as eight groups of four hex digits separated by colons. Leading zeros in each group can be dropped, and one run of consecutive all-zero groups can be replaced with :: only once. For example 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1. A typical LAN uses a /64 prefix.
29

How does ARP work and what is a gratuitous ARP?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
When a host needs the MAC for an IP on its subnet, it broadcasts an ARP request and the owner replies with a unicast ARP reply; the result is cached. For remote destinations the host ARPs for its default gateway. A gratuitous ARP is an unsolicited announcement of a host's own IP-to-MAC mapping, used after failover, for example by HSRP, to update switch and host tables.
30

A host shows IP 169.254.12.5. What does this mean and what will you check?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
169.254.x.x is an APIPA address, assigned when the host fails to get a DHCP lease. I would check that the port is up and in the correct VLAN, that the DHCP server has free addresses in the scope, and that the router interface for that VLAN has ip helper-address pointing to the server if the server is remote. Then I run ipconfig /renew and check server logs.
31

A newly configured router interface rejects the IP 192.168.5.64/26. Why?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
With a /26 the block size is 64, so 192.168.5.64 is the network address of the subnet .64 to .127 and cannot be assigned to a host or interface. IOS reports a bad mask or overlap error. Use a usable address such as 192.168.5.65 instead. Similarly .127 would be the broadcast. Always calculate the subnet boundary before configuring addresses.
32

How do you configure IPv4 and IPv6 on a router interface?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
Enable IPv6 routing globally, then add both addresses to the interface. ipv6 unicast-routing interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ipv6 address 2001:db8:1:1::1/64 ipv6 address fe80::1 link-local no shutdown Verify with show ip interface brief and show ipv6 interface brief.
33

How do you verify IP settings and test from a Windows and Linux host?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
Windows and Linux both have a small core toolkit. ipconfig /all (IP, mask, gateway, DNS, DHCP server) ipconfig /release && ipconfig /renew arp -a ip addr ; ip route ; ip neigh resolvectl status nslookup example.com Add ping and tracert or traceroute to test the path.
34

How do you keep your subnetting skills sharp for interviews and work?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
Situation: in my first job, subnetting questions slowed me down during tickets. Task: get fast and accurate. Action: I practised ten random subnetting problems daily on a timer, memorised block sizes, and built my own spreadsheet for VLSM checks. I also reviewed real routing tables at work. Result: I solve most problems in under 30 seconds and now help juniors with IP planning during change reviews.
35

Find the network, broadcast and usable range for 172.16.45.200/21.

IP Addressing and SubnettingMedium
Save to ▾
Show answer
A /21 mask is 255.255.248.0, so the interesting octet is the third with block size 8. 45 falls in the block starting at 40 (40 to 47). Network: 172.16.40.0 Broadcast: 172.16.47.255 Usable: 172.16.40.1 - 172.16.47.254 Hosts: 2^11 - 2 = 2046
36

What is VLSM and why is it used?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Variable Length Subnet Masking means using different prefix lengths inside one address block, so each subnet is sized to its need. You allocate the largest subnets first, then smaller ones, to avoid overlaps. For example, from 10.1.1.0/24 you could give a 100-user LAN a /25, a 50-user LAN a /26, and point-to-point WAN links /30 or /31. It saves address space compared with fixed-length subnetting.
37

You have 192.168.10.0/24 and need subnets for 100, 50, 20 hosts and two point-to-point links. Design it with VLSM.

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Allocate largest first so blocks align. 100 hosts -> /25: 192.168.10.0/25 (.1 - .126) 50 hosts -> /26: 192.168.10.128/26 (.129 - .190) 20 hosts -> /27: 192.168.10.192/27 (.193 - .222) Link 1 -> /30: 192.168.10.224/30 Link 2 -> /30: 192.168.10.228/30 Free for growth: 192.168.10.232 - .255
38

What is route summarization and how do you calculate a summary?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Summarization advertises one prefix that covers several contiguous networks, shrinking routing tables and hiding instability. Write the networks in binary and keep the common leading bits. For 10.1.4.0/24 to 10.1.7.0/24, the third octet values 4 to 7 share the first six bits (000001), so the summary is 10.1.4.0/22. Make sure the summary does not include networks that live elsewhere.
39

Why are /31 subnets used on point-to-point links?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
RFC 3021 allows /31 on point-to-point links because there is no need for network and broadcast addresses when only two devices exist. A /31 gives exactly two usable addresses, saving half the space of a /30. It is common on ISP and data center fabric links. Both ends must support it; on IOS you simply configure ip address 10.0.0.0 255.255.255.254.
40

Explain the main IPv6 address types.

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Global unicast (2000::/3) is publicly routable. Unique local (fc00::/7, in practice fd00::/8) is like private IPv4. Link-local (fe80::/10) is auto-created on every IPv6 interface and used for neighbour discovery and routing next hops. Multicast is ff00::/8, for example ff02::1 all nodes and ff02::2 all routers. Anycast is a unicast address shared by several devices. IPv6 has no broadcast.
41

What is SLAAC and how is it different from DHCPv6?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
With SLAAC a host learns the /64 prefix from a router advertisement and builds its own interface ID, without a server. Stateless DHCPv6 adds extra options such as DNS while the address still comes from SLAAC. Stateful DHCPv6 assigns the address itself and keeps bindings, similar to DHCPv4. RA flags M (managed) and O (other config) tell hosts which method to use.
42

Two hosts are in the same VLAN but one has mask /24 and the other /25. What problems may occur?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Each host decides local or remote using its own mask. With 192.168.1.10/24 and 192.168.1.200/25, the first thinks .200 is local and ARPs directly, but the second sees .10 as remote and sends replies to its gateway. Traffic can become one-way or asymmetric and may break completely if the gateway does not route it back. Fix the mask so both match the design.
43

Your company is running out of IP addresses on a /24 user subnet. What options do you have?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Options: expand to a /23 if the adjacent block is free and update the router and DHCP scope; create a new VLAN and subnet for some users, which also limits broadcast size; shorten DHCP lease times if many guest devices hold leases; and move printers, phones and IoT devices to their own subnets. Long term, plan an addressing scheme with growth headroom and consider dual-stack IPv6.
44

How do you quickly calculate how many subnets and hosts a mask gives?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Use two formulas and memorise the mask octets. Subnets = 2^(borrowed bits) Hosts = 2^(host bits) - 2 Example: 10.0.0.0/8 to /20 -> 2^12 = 4096 subnets, 2^12 - 2 = 4094 hosts Mask octets: 128 192 224 240 248 252 254 255 Block size = 256 - mask octet
45

Describe a time you made a configuration mistake. How did you handle it?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Situation: I applied a /25 mask instead of /24 on a core VLAN interface during a change window. Task: fix it fast and own the error. Action: monitoring alerted on half the users, I checked my change, corrected the mask within ten minutes and informed my lead immediately. Result: impact was short, and I added a peer-review step and a pre-written rollback to every change plan afterwards.
46

How do you mentor junior engineers who struggle with subnetting and troubleshooting?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
I start with the block-size method instead of binary tables, because it is fast and easy to remember. I give them daily five-minute subnetting drills, then real tickets where I let them lead while I watch and ask questions. For example, one junior engineer kept guessing during outages, so I taught him a fixed bottom-up checklist. Within two months he was closing Layer 2 and Layer 3 tickets on his own and teaching the next new joiner.
47

What is EUI-64 and how is the interface ID generated?

IP Addressing and SubnettingHard
Save to ▾
Show answer
EUI-64 builds a 64-bit interface ID from a 48-bit MAC. Split the MAC in half, insert FFFE in the middle and flip the seventh bit of the first byte. For MAC 0050.56AB.CDEF the ID becomes 0250:56FF:FEAB:CDEF. Routers can use ipv6 address 2001:db8:1::/64 eui-64. Hosts often prefer random privacy addresses instead, to avoid exposing the MAC.
48

How does IPv6 Neighbor Discovery replace ARP?

IP Addressing and SubnettingHard
Save to ▾
Show answer
NDP uses ICMPv6 messages. A host sends a Neighbor Solicitation to the target's solicited-node multicast address (ff02::1:ffXX:XXXX) and gets a Neighbor Advertisement with the MAC. Router Solicitation and Router Advertisement messages provide prefix and gateway. Duplicate Address Detection uses NS to check that an address is unique. Using multicast instead of broadcast reduces load on other hosts.
49

During a merger both companies use 10.0.0.0/16. How do you allow them to communicate?

IP Addressing and SubnettingHard
Save to ▾
Show answer
Overlapping address space means routing alone cannot work. Short term, use NAT on the interconnect so each side sees the other as a different translated range, for example twice NAT or policy NAT. Long term, renumber one network into a free range, which is cleaner but needs planning for DHCP, DNS, firewall rules and static IPs. I would also document the IP address management plan to prevent repeats.
50

How would you plan an IP addressing scheme for a company with 10 branches?

IP Addressing and SubnettingHard
Save to ▾
Show answer
I would reserve a large block, for example 10.0.0.0/16, and give each branch a summarizable /20 such as 10.0.16.0/20, 10.0.32.0/20 and so on. Inside each, assign fixed ranges per role: users, voice, wireless, servers, management and WAN links. This lets each branch be summarized as one route, keeps firewall rules simple, and leaves room to grow. I keep it in an IPAM tool.
51

What is a VLAN and why is it used?

Switching and VLANsEasy
Save to ▾
Show answer
A VLAN is a logical Layer 2 broadcast domain created on a switch, independent of physical location. VLANs separate users, voice, guests and servers, reduce broadcast traffic, and improve security because traffic between VLANs must pass through a router or Layer 3 switch where it can be filtered. For example, finance and guest Wi-Fi users can share switches but stay isolated.
52

What is the difference between an access port and a trunk port?

Switching and VLANsEasy
Save to ▾
Show answer
An access port belongs to one VLAN and carries untagged frames, typically to PCs, printers or servers. A trunk port carries traffic for many VLANs between switches, routers or hypervisors, adding an 802.1Q tag to identify each frame's VLAN, except the native VLAN which is sent untagged. Access ports can also carry a separate voice VLAN for IP phones.
53

What is 802.1Q tagging?

Switching and VLANsEasy
Save to ▾
Show answer
802.1Q inserts a 4-byte tag after the source MAC in the Ethernet frame. The tag holds a 12-bit VLAN ID (1 to 4094 usable), 3 priority bits used by CoS for QoS, and a DEI bit. The tag is added when a frame leaves a trunk and removed at an access port. Older ISL encapsulation is obsolete; modern switches support only 802.1Q.
54

What is inter-VLAN routing and what are the ways to do it?

Switching and VLANsEasy
Save to ▾
Show answer
Hosts in different VLANs need a Layer 3 device to communicate. Options are: a router with one physical interface per VLAN (legacy), router-on-a-stick using one trunk with subinterfaces, or a Layer 3 switch with switched virtual interfaces (SVIs). SVIs are the most common in campuses because routing happens in hardware at line rate, with no single trunk bottleneck.
55

How do you create a VLAN and assign an access port?

Switching and VLANsEasy
Save to ▾
Show answer
Create the VLAN, name it, and set the port mode and VLAN. vlan 20 name SALES interface GigabitEthernet1/0/5 switchport mode access switchport access vlan 20 switchport voice vlan 150 spanning-tree portfast show vlan brief
56

How do you verify VLANs, trunks and MAC learning on a switch?

Switching and VLANsEasy
Save to ▾
Show answer
These show commands cover most VLAN troubleshooting. show vlan brief show interfaces trunk show interfaces Gi1/0/5 switchport show mac address-table vlan 20 show mac address-table address 0050.56ab.cdef show interfaces status They show VLAN membership, allowed and active VLANs on trunks, native VLAN and where each MAC was learned.
57

Tell me about a time you worked with a difficult end user during a ticket.

Switching and VLANsEasy
Save to ▾
Show answer
Situation: a senior manager was angry that his laptop lost network access before a client call. Task: fix it fast and calm him down. Action: I listened, gave a clear time estimate, found the port had been moved to a wrong VLAN in a recent change, corrected it and confirmed the call worked. Result: he was back online in ten minutes, and I added a port description check to our change process.
58

What is the native VLAN and what problems can a mismatch cause?

Switching and VLANsMedium
Save to ▾
Show answer
The native VLAN is the VLAN whose frames cross a trunk untagged, VLAN 1 by default. Both ends must use the same native VLAN; if they differ, frames leak between VLANs and CDP logs a native VLAN mismatch. For security, set the native VLAN to an unused ID, do not put users in it, and optionally tag it with vlan dot1q tag native to prevent VLAN hopping.
59

What is DTP and why should you disable it?

Switching and VLANsMedium
Save to ▾
Show answer
Dynamic Trunking Protocol negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access. Auto plus auto stays access, while desirable with auto or desirable forms a trunk. Attackers can use DTP to form a trunk and reach all VLANs, so best practice is to hard-code access or trunk and use switchport nonegotiate on trunks.
60

What is VTP and what are its risks?

Switching and VLANsMedium
Save to ▾
Show answer
VLAN Trunking Protocol shares VLAN definitions from a server switch to clients in the same VTP domain. Modes are server, client, transparent and off. The risk is that a switch with a higher configuration revision number can overwrite and wipe VLANs across the domain. Many networks use transparent mode or VTP version 3 with a primary server to avoid this.
61

What is a voice VLAN and how does it work?

Switching and VLANsMedium
Save to ▾
Show answer
A voice VLAN lets an IP phone and a PC share one switch port while keeping their traffic separate. The port is an access port in the data VLAN, and the switch tells the phone through CDP or LLDP-MED to tag voice frames with the voice VLAN. This allows QoS priority for voice and separate addressing. Configure it with switchport voice vlan.
62

What is a Layer 3 switch and how is it different from a router?

Switching and VLANsMedium
Save to ▾
Show answer
A Layer 3 switch forwards packets between VLANs in hardware using SVIs or routed ports, giving very high throughput with many Ethernet ports. A router usually has fewer ports but richer WAN features such as NAT, VPN, deep QoS, varied WAN interfaces and large routing tables. In campuses, Layer 3 switches handle inter-VLAN routing while routers or firewalls handle the edge.
63

A PC in VLAN 20 cannot reach a PC in VLAN 30. What do you check?

Switching and VLANsMedium
Save to ▾
Show answer
First I check each PC has the correct IP, mask and gateway for its VLAN. Then I confirm the switch ports are in the right VLANs with show vlan brief, and that the trunk to the Layer 3 device allows both VLANs using show interfaces trunk. On the Layer 3 device I check the SVIs or subinterfaces are up and have the right IPs, and that no ACL blocks the traffic.
64

After adding a new VLAN, users on one access switch cannot use it but others can. Why?

Switching and VLANsMedium
Save to ▾
Show answer
The most likely cause is the trunk to that switch does not allow the new VLAN, because someone configured an explicit allowed list. Check show interfaces trunk and add it with switchport trunk allowed vlan add 50, not without add, which would replace the list. Also confirm the VLAN exists on that switch with show vlan brief, especially if VTP is transparent.
65

A trunk between two switches is not forming. What would you check?

Switching and VLANsMedium
Save to ▾
Show answer
I check show interfaces trunk and show interfaces switchport on both sides. Common causes are mismatched modes (both dynamic auto), one side hard-coded as access, encapsulation not set on older switches, or the port being err-disabled. Native VLAN mismatch and allowed list differences do not stop the trunk but break traffic. Best fix is switchport mode trunk on both ends with nonegotiate.
66

How do you configure an 802.1Q trunk securely?

Switching and VLANsMedium
Save to ▾
Show answer
Hard-code the trunk, disable negotiation, change the native VLAN and prune VLANs. interface GigabitEthernet1/0/48 switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate switchport trunk native vlan 999 switchport trunk allowed vlan 10,20,30,99 show interfaces trunk
67

How do you configure router-on-a-stick?

Switching and VLANsMedium
Save to ▾
Show answer
Use one trunk link and a subinterface per VLAN with 802.1Q encapsulation. interface GigabitEthernet0/0 no shutdown interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 interface GigabitEthernet0/0.20 encapsulation dot1Q 20 ip address 192.168.20.1 255.255.255.0 The switch port facing the router must be a trunk.
68

How do you configure inter-VLAN routing on a Layer 3 switch with SVIs?

Switching and VLANsMedium
Save to ▾
Show answer
Enable routing and create an SVI per VLAN as the gateway. ip routing interface vlan 10 ip address 192.168.10.1 255.255.255.0 ip helper-address 10.0.0.50 no shutdown interface vlan 20 ip address 192.168.20.1 255.255.255.0 no shutdown show ip route connected
69

How do you handle a change that must be done during a night window?

Switching and VLANsMedium
Save to ▾
Show answer
Situation: we had to migrate 30 access ports to new VLANs overnight. Task: finish with zero business impact. Action: I prepared configs in advance, got peer review, scheduled a rollback, informed the helpdesk and tested each floor with a laptop after changes. Result: the migration finished an hour early, morning tickets were zero, and the plan became our template for later VLAN changes.
70

Logs show MAC address flapping for several hosts between an access port and an uplink. What do you check?

Switching and VLANsMedium
Save to ▾
Show answer
MAC flapping means the switch sees the same source MAC arriving on two ports, which usually points to a Layer 2 loop, a misconfigured server NIC team, or a virtual machine host bridging two uplinks. Check show mac address-table for the MAC, trace both ports, verify STP state and look for unmanaged switches or hypervisor teaming in active-active mode without a matching port channel. Fix the loop or teaming, and keep BPDU Guard on access ports.
71

What is the MAC address table and what happens when it is full?

Switching and VLANsHard
Save to ▾
Show answer
The MAC address table, stored in CAM, maps MAC addresses to ports and VLANs. When it fills, as in a MAC flooding attack, new addresses cannot be learned and the switch floods unknown unicast frames out of all ports in the VLAN, which lets an attacker sniff traffic. Port security limiting MACs per port prevents this.
72

An SVI shows status down/down even though it is configured. What could be wrong?

Switching and VLANsHard
Save to ▾
Show answer
An SVI comes up only if the VLAN exists in the VLAN database and at least one access or trunk port in that VLAN is up and forwarding, and the SVI is not shut down. So I check show vlan brief for the VLAN, check that at least one port in it is connected, check trunks allow it, and run no shutdown on the SVI. On Layer 3 switches, ip routing must be enabled for routing.
73

How would you redesign a flat network where 600 users sit in VLAN 1?

Switching and VLANsHard
Save to ▾
Show answer
I would split users into VLANs by function or floor, each with a /24 or smaller, put voice, wireless, printers, servers and management in their own VLANs, and route between them on a Layer 3 core with SVIs. DHCP scopes and helper addresses would be added per VLAN. I would migrate in phases with a rollback plan and move VLAN 1 out of use for both users and the native VLAN.
74

How do you make an access switch port a routed port on a Layer 3 switch?

Switching and VLANsHard
Save to ▾
Show answer
A routed port behaves like a router interface and does not belong to any VLAN. interface GigabitEthernet1/0/1 no switchport ip address 10.0.0.1 255.255.255.252 no shutdown Routed uplinks between distribution and core avoid spanning tree on those links and allow fast routing convergence with ECMP.
75

What is a private VLAN?

Switching and VLANsHard
Save to ▾
Show answer
A private VLAN splits one VLAN into a primary VLAN and secondary VLANs. Isolated ports can talk only to promiscuous ports such as the gateway, while community ports can talk to each other and to promiscuous ports. It is used in hosting, DMZs and hotel networks to isolate customers on the same subnet without creating many subnets. It requires VTP transparent mode or VTP v3.
76

Why is Spanning Tree Protocol needed?

STP and EtherChannelEasy
Save to ▾
Show answer
Redundant Layer 2 links create loops, and Ethernet frames have no TTL, so broadcasts circulate forever, causing broadcast storms, MAC table instability and duplicate frames. STP (802.1D) blocks redundant paths so there is one loop-free path to every switch, and unblocks a backup link if the active one fails. Without it, a single loop can take down a whole campus within seconds.
77

How is the root bridge elected?

STP and EtherChannelEasy
Save to ▾
Show answer
Switches exchange BPDUs and the one with the lowest bridge ID becomes root. The bridge ID is the priority (default 32768 plus the VLAN number in PVST) followed by the MAC address, so if priorities tie, the lowest MAC wins. Because the oldest switch often has the lowest MAC, you should set priority manually, for example spanning-tree vlan 10 root primary on the core.
78

What is EtherChannel and its benefits?

STP and EtherChannelEasy
Save to ▾
Show answer
EtherChannel bundles 2 to 8 physical links into one logical port-channel. STP sees it as one link, so all members forward instead of one being blocked. It adds bandwidth and redundancy, as one member failing does not drop the channel. Traffic is load-balanced per flow using a hash of MAC, IP or port fields, so a single flow still uses only one member link.
79

How do you set the root bridge and verify STP?

STP and EtherChannelEasy
Save to ▾
Show answer
Set priorities on the intended primary and secondary roots, then verify. spanning-tree mode rapid-pvst spanning-tree vlan 10,20 root primary ! on the backup switch spanning-tree vlan 10,20 root secondary show spanning-tree vlan 10 show spanning-tree root show spanning-tree summary
80

How do you configure PortFast and BPDU Guard on access ports?

STP and EtherChannelEasy
Save to ▾
Show answer
Apply per port or globally for all PortFast ports. interface range GigabitEthernet1/0/1 - 46 switchport mode access spanning-tree portfast spanning-tree bpduguard enable ! or globally spanning-tree portfast default spanning-tree portfast bpduguard default errdisable recovery cause bpduguard errdisable recovery interval 300
81

How do you prioritise when several tickets arrive at the same time?

STP and EtherChannelEasy
Save to ▾
Show answer
Situation: on a night shift I got a core link down alert, two user tickets and a printer issue at once. Task: handle everything with minimum impact. Action: I prioritised by business impact, confirmed redundancy had taken over for the core link, raised a priority ticket with the carrier, then fixed the user tickets and logged the printer for morning. Result: no SLA was breached and the handover was clear.
82

Explain root port, designated port and blocked port.

STP and EtherChannelMedium
Save to ▾
Show answer
Every non-root switch picks one root port, its best path to the root based on lowest root path cost, then lowest sender bridge ID, then lowest sender port ID. On each segment, the switch with the best path becomes the designated port and forwards. Every remaining port becomes non-designated and blocks. All ports on the root bridge are designated.
83

What are the STP port states and timers in classic 802.1D?

STP and EtherChannelMedium
Save to ▾
Show answer
States are blocking, listening, learning, forwarding and disabled. Timers are hello 2 seconds, forward delay 15 seconds and max age 20 seconds. A port moves from blocking through listening and learning, each 15 seconds, so convergence can take 30 to 50 seconds. That delay is why Rapid STP and PortFast are used in modern networks.
84

How is Rapid PVST+ different from classic STP?

STP and EtherChannelMedium
Save to ▾
Show answer
Rapid PVST+ runs 802.1w per VLAN. It uses a proposal and agreement handshake on point-to-point links so ports move to forwarding in under a second, instead of waiting on timers. It has port roles root, designated, alternate and backup, and states discarding, learning and forwarding. Alternate ports provide an instant backup root port. It is the default on most modern IOS switches.
85

What are the default STP path costs for common link speeds?

STP and EtherChannelMedium
Save to ▾
Show answer
With short (802.1D revised) costs: 10 Mbps is 100, 100 Mbps is 19, 1 Gbps is 4 and 10 Gbps is 2. With the long pathcost method, 1 Gbps is 20000 and 10 Gbps is 2000, which distinguishes higher speeds. Root path cost is the sum of costs on ports toward the root, and the lowest total wins when choosing root ports.
86

Compare LACP and PAgP.

STP and EtherChannelMedium
Save to ▾
Show answer
LACP (802.3ad, now 802.1AX) is the open standard with modes active and passive; at least one side must be active. PAgP is proprietary with modes desirable and auto; at least one side must be desirable. Mode on forces the channel with no negotiation, which can cause loops if the other side is not configured. LACP is preferred because it works with servers, firewalls and other vendors.
87

What must match for an EtherChannel to form?

STP and EtherChannelMedium
Save to ▾
Show answer
Member interfaces must have the same speed and duplex, the same mode (access or trunk), the same access VLAN or the same native and allowed VLAN list on trunks, and compatible negotiation modes. Mismatched settings put members into suspended state. Configure settings on the port-channel interface so they are pushed to members, and verify with show etherchannel summary.
88

A broadcast storm brought the network down after someone connected a cable between two wall ports. How do you prevent this?

STP and EtherChannelMedium
Save to ▾
Show answer
Two wall ports patched to the same switch formed a loop. To stop it now, I find the port with rising broadcast counters and shut it. To prevent repeats, enable PortFast with BPDU Guard on all access ports, keep Rapid PVST+ running everywhere, add storm-control broadcast thresholds on access ports and enable errdisable recovery with a sensible interval.
89

Traffic is taking a slow path because an old access switch became root bridge. How do you fix it?

STP and EtherChannelMedium
Save to ▾
Show answer
The old switch has the lowest MAC with default priority, so it won the election. I set the core or distribution switch as root with spanning-tree vlan 1-4094 priority 4096, or root primary, and the secondary with 8192. I add Root Guard on distribution downlinks so access switches can never become root again. Then I verify with show spanning-tree root.
90

An EtherChannel shows members in suspended state. What do you check?

STP and EtherChannelMedium
Save to ▾
Show answer
Suspended (s) usually means a configuration mismatch between members or with the far end. I compare speed, duplex, trunk mode, native VLAN and allowed VLANs on each member and the port-channel with show run interface, check LACP modes on both sides, and look at logs. I fix the config on the port-channel, then shut and no shut members so they rejoin. show etherchannel summary should show P flags.
91

How do you configure an LACP EtherChannel trunk?

STP and EtherChannelMedium
Save to ▾
Show answer
Put members in a channel group with mode active, then configure the port-channel. interface range GigabitEthernet1/0/47 - 48 channel-group 1 mode active interface Port-channel1 switchport mode trunk switchport trunk allowed vlan 10,20,99 port-channel load-balance src-dst-ip show etherchannel summary
92

Tell me about a time you had to learn a new technology quickly.

STP and EtherChannelMedium
Save to ▾
Show answer
Situation: our team moved from PVST to MST for a data center with 600 VLANs, and I had not used MST. Task: be ready for the migration in two weeks. Action: I read the configuration guides, built the design in a GNS3 lab, broke it deliberately and wrote a step-by-step checklist. Result: the migration ran in one window without outage, and I ran a short knowledge session for the team.
93

What is Root Guard and Loop Guard?

STP and EtherChannelHard
Save to ▾
Show answer
Root Guard on a designated port puts it into root-inconsistent state if a superior BPDU arrives, protecting the planned root bridge, so it is used on distribution ports facing access switches. Loop Guard stops a non-designated port from becoming designated when BPDUs stop arriving, such as with a unidirectional fiber fault. UDLD complements Loop Guard by detecting one-way links.
94

What is MST and when would you use it?

STP and EtherChannelHard
Save to ▾
Show answer
Multiple Spanning Tree (802.1s) maps many VLANs to a small number of STP instances, so a switch does not run one instance per VLAN as PVST does. Switches in the same MST region must share the name, revision and VLAN-to-instance mapping. It suits large networks with hundreds of VLANs and multi-vendor environments, and supports load sharing by making different instances root on different switches.
95

A 4 x 1G EtherChannel to a server shows one link at 95 percent and others nearly idle. Why?

STP and EtherChannelHard
Save to ▾
Show answer
Load balancing is per flow based on a hash. If the method is src-mac and most traffic comes from one router MAC, all flows hash to one link. I change port-channel load-balance to src-dst-ip or src-dst-mixed-ip-port so many flows spread across members. If the traffic is a single large flow, it can never exceed one member, so faster links would be needed.
96

Users report short outages every few minutes and logs show topology changes. How do you troubleshoot?

STP and EtherChannelHard
Save to ▾
Show answer
Frequent TCNs flush MAC tables and cause flooding. I run show spanning-tree detail to find the port and switch originating topology changes, then follow it hop by hop. Common causes are a flapping link, a host port without PortFast that changes state each time a PC reboots, or a failing NIC. I fix the link and enable PortFast on edge ports so they do not generate TCNs.
97

How do you configure a Layer 3 EtherChannel?

STP and EtherChannelHard
Save to ▾
Show answer
Make members routed ports first, then put the IP on the port-channel. interface range TenGigabitEthernet1/1/1 - 2 no switchport channel-group 10 mode active interface Port-channel10 no switchport ip address 10.0.0.1 255.255.255.252 show etherchannel 10 summary show ip interface brief
98

How would you influence which port becomes the root port on a switch?

STP and EtherChannelHard
Save to ▾
Show answer
The root port is chosen by lowest cost, then sender bridge ID, then sender port ID. To prefer a link I lower its cost. interface GigabitEthernet1/0/49 spanning-tree vlan 10 cost 2 On the upstream switch you can change port priority instead. interface GigabitEthernet1/0/1 spanning-tree vlan 10 port-priority 64
99

What is UDLD and why is it important on fiber links?

STP and EtherChannelHard
Save to ▾
Show answer
UniDirectional Link Detection sends probes to confirm a neighbour receives traffic in both directions. On fiber, one strand can fail so a port receives but cannot send, which may make STP unblock a port and create a loop. UDLD normal mode logs and marks the port, while aggressive mode err-disables it. It is commonly enabled on fiber uplinks together with Loop Guard.
100

Tell me about a time a change you approved caused an outage. What did you do and what changed afterwards?

STP and EtherChannelHard
Save to ▾
Show answer
Situation: I approved a change that set a new root bridge priority, but the engineer applied it on the wrong switch and the campus reconverged during business hours. Task: restore service and find the gap. Action: we rolled back in ten minutes, informed users and ran a blameless review. Result: we added device name checks to the change template, peer review of exact commands and a maintenance window rule for any STP change. There was no repeat incident that year.
101

How does a router choose the best route to a destination?

Routing and OSPFEasy
Save to ▾
Show answer
First it uses longest prefix match: the most specific matching prefix wins, so 10.1.1.0/24 beats 10.1.0.0/16. If the same prefix comes from different sources, the lowest administrative distance wins. If the same protocol offers several paths, the lowest metric wins, and equal metrics can be load-balanced with ECMP. Only the winners are installed in the routing table.
102

What are the default administrative distances you should know?

Routing and OSPFEasy
Save to ▾
Show answer
Connected 0, static 1, EIGRP summary 5, eBGP 20, internal EIGRP 90, OSPF 110, IS-IS 115, RIP 120, external EIGRP 170 and iBGP 200. A value of 255 means the route is never used. AD compares trust between sources, so a static route with AD 1 beats OSPF for the same prefix unless you configure a floating static with a higher AD.
103

How is the OSPF router ID chosen?

Routing and OSPFEasy
Save to ▾
Show answer
The router ID is a 32-bit value chosen in this order: manually configured router-id, then the highest IP on an up loopback interface, then the highest IP on an up physical interface. It is chosen when the OSPF process starts, so changes need clear ip ospf process. Best practice is to set it manually so it is stable and easy to recognise in the database.
104

How do you configure IPv4 static and default routes?

Routing and OSPFEasy
Save to ▾
Show answer
Use a next-hop IP, an exit interface, or both. ip route 10.2.0.0 255.255.0.0 192.168.12.2 ip route 0.0.0.0 0.0.0.0 203.0.113.1 ! floating backup with AD 200 ip route 0.0.0.0 0.0.0.0 198.51.100.1 200 ! IPv6 ipv6 route ::/0 2001:db8:12::2 show ip route static
105

Which commands verify OSPF operation?

Routing and OSPFEasy
Save to ▾
Show answer
These commands cover neighbours, interfaces, routes and the database. show ip ospf neighbor show ip ospf interface brief show ip ospf interface Gi0/0 show ip route ospf show ip ospf database show ip protocols show ip protocols shows router ID, networks, passive interfaces and the reference bandwidth.
106

How do you read a line in the IOS routing table?

Routing and OSPFEasy
Save to ▾
Show answer
Example line: O 10.2.2.0/24 [110/20] via 10.0.12.2, 00:05:12, GigabitEthernet0/0 O is the source (OSPF), 10.2.2.0/24 the prefix, 110 the administrative distance and 20 the metric, 10.0.12.2 the next hop, then the age and exit interface. C is connected, L local host route, S static, D EIGRP and an asterisk marks the candidate default.
107

How do you approach working in a 24x7 network operations shift?

Routing and OSPFEasy
Save to ▾
Show answer
Situation: I joined a NOC that ran rotating shifts. Task: stay effective and keep handovers clean. Action: I followed runbooks, kept a shift log of every alert and action, raised early escalations for anything outside my scope and used quiet hours to lab new topics. Result: I handled shift incidents within SLA, earned positive feedback for clear handovers and was moved to the L2 team in a year.
108

What is a floating static route?

Routing and OSPFMedium
Save to ▾
Show answer
A floating static route is a backup static route with a higher administrative distance than the primary route, so it stays out of the routing table until the primary disappears. For example, if OSPF (AD 110) learns the main path, ip route 0.0.0.0 0.0.0.0 203.0.113.1 200 installs only when OSPF loses the route. It is common for backup internet or 4G links.
109

Compare distance vector and link state routing protocols.

Routing and OSPFMedium
Save to ▾
Show answer
Distance vector protocols like RIP share their routing table with neighbours and trust what they hear, so they converge slowly and need loop prevention such as split horizon. Link state protocols like OSPF and IS-IS flood link state advertisements so each router builds a full topology map and runs Dijkstra's SPF algorithm. Link state converges faster and scales better but uses more memory and CPU.
110

How does OSPF form a neighbour adjacency?

Routing and OSPFMedium
Save to ▾
Show answer
Routers send hellos to 224.0.0.5. They become neighbours if area ID, subnet and mask, hello and dead timers, authentication and stub flags match, and the router IDs are unique. States go Down, Init, 2-Way, ExStart, Exchange, Loading and Full. In ExStart and Exchange they agree master and slave and swap database descriptions, which is where an MTU mismatch causes a stuck adjacency.
111

What are DR and BDR in OSPF and why are they needed?

Routing and OSPFMedium
Save to ▾
Show answer
On multi-access networks such as Ethernet, a full mesh of adjacencies would create too many LSAs. OSPF elects a Designated Router and Backup DR; other routers (DROTHERs) form full adjacency only with them and stay 2-Way with each other. The highest interface priority wins, then highest router ID; priority 0 means never DR. Election is non-preemptive, so a new better router does not take over.
112

How is OSPF cost calculated?

Routing and OSPFMedium
Save to ▾
Show answer
Cost equals reference bandwidth divided by interface bandwidth. The default reference is 100 Mbps, so FastEthernet, Gigabit and 10 Gigabit all get cost 1, which hides the faster links. Change it with auto-cost reference-bandwidth 100000 on every router so 1G becomes 100 and 10G becomes 10. You can also set ip ospf cost directly on an interface. Path cost is the sum of outgoing interface costs.
113

Why does OSPF use areas and what is area 0?

Routing and OSPFMedium
Save to ▾
Show answer
Areas limit how far detailed LSAs flood, so SPF runs on a smaller database and changes in one area do not force recalculation everywhere. Area 0 is the backbone and every other area must connect to it, directly or through a virtual link. Routers connecting areas are ABRs and can summarize routes between areas. Single-area OSPF is the focus of CCNA.
114

What are the first hop redundancy protocols and how does HSRP work?

Routing and OSPFMedium
Save to ▾
Show answer
FHRPs give hosts a virtual gateway IP shared by two or more routers. HSRP is proprietary: routers elect an active router by highest priority (default 100), and the standby takes over the virtual IP and MAC if hellos stop. Preempt lets a higher priority router reclaim the role. VRRP is the open standard, and GLBP adds load sharing across several routers.
115

Two OSPF routers are directly connected but show no neighbour at all. How do you troubleshoot?

Routing and OSPFMedium
Save to ▾
Show answer
I check that the interfaces are up and in the same subnet, then show ip ospf interface to compare area, hello and dead timers, network type and authentication. I make sure the interface is not passive and that the network statement or ip ospf area command covers it. Finally I check that no ACL blocks protocol 89 or multicast 224.0.0.5, and use debug ip ospf adj if needed.
116

How do you configure single-area OSPFv2?

Routing and OSPFMedium
Save to ▾
Show answer
Set a router ID, enable OSPF on interfaces and make user ports passive. router ospf 1 router-id 1.1.1.1 auto-cost reference-bandwidth 100000 passive-interface GigabitEthernet0/1 network 10.0.12.0 0.0.0.3 area 0 network 192.168.1.0 0.0.0.255 area 0 default-information originate Or per interface: ip ospf 1 area 0
117

How do you configure HSRP for a VLAN gateway?

Routing and OSPFMedium
Save to ▾
Show answer
Configure the same group and virtual IP on both switches, with higher priority on the active one. interface vlan 10 ip address 192.168.10.2 255.255.255.0 standby version 2 standby 10 ip 192.168.10.1 standby 10 priority 110 standby 10 preempt show standby brief Hosts use 192.168.10.1 as their gateway.
118

Describe a situation where you had to explain a technical issue to a non-technical manager.

Routing and OSPFMedium
Save to ▾
Show answer
Situation: a routing loop during a carrier change caused a two-hour outage and the operations head wanted an explanation. Task: explain cause and prevention simply. Action: I used a road map analogy, explained that two routers kept sending traffic to each other, showed the timeline and our fix, and listed three prevention steps with dates. Result: management approved a proper change review board, and trust in our team improved.
119

Describe a time you disagreed with a senior engineer about a network design. How did you handle it?

Routing and OSPFMedium
Save to ▾
Show answer
Situation: a senior engineer wanted static routes for twelve new branches. Task: I believed OSPF would scale better. Action: instead of arguing in the meeting, I built both options in a lab, measured failover time and listed the change effort for each. I shared the results privately first. Result: we agreed on OSPF with summarization at the hub, and he asked me to write the standard. I learned that data persuades better than opinions.
120

Two OSPF routers on the same link are stuck in EXSTART state. What is the cause and fix?

Routing and OSPFHard
Save to ▾
Show answer
EXSTART or EXCHANGE stuck usually means an MTU mismatch, because database description packets larger than the neighbour's MTU are dropped. I compare MTU with show interfaces and set ip mtu to match on both sides. As a temporary workaround, ip ospf mtu-ignore can be used, but fixing the MTU is better. Duplicate router IDs can also cause odd adjacency behaviour, so I check those too.
121

A route you expect from OSPF is in the OSPF database but not in the routing table. Why?

Routing and OSPFHard
Save to ▾
Show answer
Another source with a lower AD may be providing the same prefix, such as a static route, so the OSPF route is not installed. Or a more specific route wins by longest match. The next hop may also be unreachable, or a distribute-list may filter it. I check show ip route for the prefix, show ip ospf database, and compare administrative distances.
122

A branch has a primary MPLS link with OSPF and a backup broadband link. How do you design failover?

Routing and OSPFHard
Save to ▾
Show answer
Run OSPF over MPLS for the primary path. For the backup, use a floating static default route via the broadband link with AD higher than OSPF, for example 250, or run an IPsec tunnel with OSPF at a higher cost. Track the primary with IP SLA if the provider does not drop the link on failure, so the backup activates even when the interface stays up.
123

Traffic is not load balancing across two equal links even though both are in OSPF. What do you check?

Routing and OSPFHard
Save to ▾
Show answer
Both paths must have equal total cost to be installed as ECMP. I check show ip route for two next hops. If only one shows, I compare interface costs, which differ if bandwidth or the reference bandwidth differs. I also check maximum-paths. Even with ECMP, load sharing is per flow using CEF, so a single large flow uses one link only.
124

How do you change OSPF DR election on a segment?

Routing and OSPFHard
Save to ▾
Show answer
Set interface priority; higher wins and 0 never becomes DR. interface GigabitEthernet0/0 ip ospf priority 255 ! on a router that should never be DR interface GigabitEthernet0/0 ip ospf priority 0 clear ip ospf process Because election is non-preemptive, reset the process or the neighbours for the change to take effect.
125

After adding a second internet router, some sessions break at the stateful firewall because return traffic uses the other exit. How do you fix it?

Routing and OSPFHard
Save to ▾
Show answer
This is asymmetric routing: the firewall sees only one direction of the flow and drops it. Make the path symmetric by using one active exit per prefix, for example HSRP or a higher OSPF default-route cost on the backup, and advertise inbound routes consistently with the same preference. If both links must be active, pair the firewalls with state sharing or use NAT per exit so return traffic comes back to the router that sent it.
126

How does DHCP work?

IP ServicesEasy
Save to ▾
Show answer
DHCP uses the DORA process: the client broadcasts Discover, the server answers with an Offer, the client broadcasts a Request for that offer, and the server confirms with an Acknowledgement. The lease includes IP, mask, gateway, DNS servers and lease time. Clients renew at 50 percent of the lease. DHCP uses UDP ports 67 for the server and 68 for the client.
127

What is a DHCP relay agent and why is it needed?

IP ServicesEasy
Save to ▾
Show answer
DHCP Discover is a broadcast, and routers do not forward broadcasts, so a central DHCP server cannot hear clients on other subnets. A relay agent, configured with ip helper-address on the gateway interface, converts the broadcast into a unicast to the server and adds the gateway IP so the server picks the right scope. This lets one server serve many VLANs.
128

What is NAT and what are its types?

IP ServicesEasy
Save to ▾
Show answer
Network Address Translation rewrites IP addresses as packets cross a router, usually private inside addresses to public outside ones. Static NAT maps one inside address to one public address, often for servers. Dynamic NAT maps from a pool. PAT, or NAT overload, maps many inside hosts to one public IP using unique source ports, and is what almost every office and home router uses.
129

What is NTP and why does time matter on network devices?

IP ServicesEasy
Save to ▾
Show answer
NTP synchronises clocks over UDP 123 using a hierarchy of strata, where stratum 1 servers connect to an atomic or GPS clock. Correct time matters because syslog and incident timelines must line up across devices, certificates and authentication protocols check time, and logs are legal evidence. Devices can be NTP clients, servers or peers, and NTP authentication protects against fake time sources.
130

What are syslog severity levels?

IP ServicesEasy
Save to ▾
Show answer
Syslog has eight levels from 0 to 7: emergency, alert, critical, error, warning, notification, informational and debugging. A useful memory line is Every Awesome Computer Engineer Will Need Ice cream Daily. Setting logging trap 6 sends levels 0 to 6 to the server. Syslog uses UDP 514 by default, and logs should carry timestamps with service timestamps log datetime msec.
131

How do you configure a DHCP server on a router?

IP ServicesEasy
Save to ▾
Show answer
Exclude static addresses first, then define the pool. ip dhcp excluded-address 192.168.10.1 192.168.10.20 ip dhcp pool VLAN10 network 192.168.10.0 255.255.255.0 default-router 192.168.10.1 dns-server 8.8.8.8 1.1.1.1 lease 7 show ip dhcp binding show ip dhcp pool
132

How do you handle pressure when an outage affects many users?

IP ServicesEasy
Save to ▾
Show answer
Situation: DHCP failed for 300 users at 9 a.m. on a Monday. Task: restore service while keeping managers updated. Action: I stayed calm, followed the bottom-up method, found the DHCP server's scope was full after a lease time change, extended the scope and shortened leases. I sent updates every 15 minutes. Result: users were back in 30 minutes, and we added scope utilisation alerts to monitoring.
133

Explain the NAT terms inside local, inside global, outside local and outside global.

IP ServicesMedium
Save to ▾
Show answer
Inside local is the private address of an inside host, for example 192.168.1.10. Inside global is the public address that represents it outside, for example 203.0.113.5. Outside global is the real address of the remote host. Outside local is how the remote host appears to inside users, usually the same as outside global unless destination NAT is used. show ip nat translations displays these columns.
134

How does DNS resolution work?

IP ServicesMedium
Save to ▾
Show answer
A client asks its configured resolver, for example for www.example.com. If it is not cached, the resolver queries a root server, which refers it to the .com TLD server, which refers it to the authoritative server for example.com, which returns the A or AAAA record. The answer is cached for its TTL. DNS uses UDP 53 for most queries and TCP 53 for zone transfers and large replies.
135

What is SNMP and the differences between v2c and v3?

IP ServicesMedium
Save to ▾
Show answer
SNMP lets a manager poll devices for counters and receive traps or informs about events, using a MIB with OIDs. Polling uses UDP 161 and traps UDP 162. SNMPv2c uses a plain-text community string with no encryption. SNMPv3 adds user-based authentication and encryption with authPriv mode, so it is the version to use in production, especially on networks reachable from many teams.
136

What is QoS and why is it needed?

IP ServicesMedium
Save to ▾
Show answer
Quality of Service gives different treatment to traffic types when links are congested. Voice needs low delay (under 150 ms one way), low jitter (under 30 ms) and low loss (under 1 percent), while bulk file transfer can wait. QoS tools classify and mark traffic, queue it with priority queues for voice, and police or shape rates. Without congestion QoS has no effect.
137

Users behind a router can reach local servers but not the internet after a firewall change. NAT is configured. What do you check?

IP ServicesMedium
Save to ▾
Show answer
I check show ip nat translations to see whether translations appear when users browse. If none, I verify ip nat inside and ip nat outside on the correct interfaces, that the ACL used by NAT matches the user subnets, and that the overload interface has an IP. I also check the default route and run show ip nat statistics for hits and misses.
138

A new VLAN's users do not get DHCP addresses, but other VLANs work. What do you check?

IP ServicesMedium
Save to ▾
Show answer
I check that the SVI for the new VLAN is up and has ip helper-address pointing to the DHCP server, that the server has a scope for that subnet with the right gateway, and that the scope is activated. I confirm the VLAN is allowed on trunks. If DHCP snooping is enabled, I check the uplink is trusted, otherwise offers from the server are dropped.
139

Syslog timestamps from different devices do not match during an incident review. What do you fix?

IP ServicesMedium
Save to ▾
Show answer
Clocks are not synchronised. I configure all devices to use the same internal NTP servers with ntp server, set the timezone with clock timezone IST 5 30, add service timestamps log datetime msec localtime, and enable NTP authentication. Then I check show ntp associations and show ntp status to confirm synchronisation. This makes future incident timelines reliable.
140

An internal web server must be reachable from the internet on a public IP. How do you set it up?

IP ServicesMedium
Save to ▾
Show answer
Use static NAT or port forwarding so the public IP maps to the server's private IP, for example ip nat inside source static tcp 192.168.1.20 443 203.0.113.10 443. Add an ACL or firewall rule allowing only port 443 inbound, put the server in a DMZ VLAN, and create a public DNS record. Ideally place a firewall or reverse proxy in front instead of exposing the server directly.
141

How do you configure PAT (NAT overload)?

IP ServicesMedium
Save to ▾
Show answer
Mark interfaces, match inside hosts with an ACL and overload the outside interface. interface GigabitEthernet0/1 ip nat inside interface GigabitEthernet0/0 ip nat outside access-list 1 permit 192.168.0.0 0.0.255.255 ip nat inside source list 1 interface GigabitEthernet0/0 overload show ip nat translations
142

How do you configure a router as a DHCP relay and verify it?

IP ServicesMedium
Save to ▾
Show answer
Add the helper address on the client-facing interface. interface vlan 20 ip helper-address 10.0.0.50 show ip interface vlan 20 | include Helper debug ip dhcp server packet The helper also forwards some other UDP broadcasts such as TFTP and DNS by default; use no ip forward-protocol udp to limit them.
143

How do you back up and restore a device configuration?

IP ServicesMedium
Save to ▾
Show answer
Copy the config to a server and back. copy running-config tftp://10.0.0.40/R1-backup.cfg copy running-config scp://admin@10.0.0.40/R1.cfg copy tftp://10.0.0.40/R1-backup.cfg running-config configure replace flash:R1-good.cfg archive path flash:R1-archive write-memory configure replace gives a clean rollback instead of merging.
144

Tell me about a time you automated or simplified a repetitive task.

IP ServicesMedium
Save to ▾
Show answer
Situation: our team manually backed up 80 router configs each week. Task: save time and avoid missed backups. Action: I enabled the archive feature with time-period on each device and later wrote a small Python script with Netmiko to pull and store configs in Git. Result: weekly effort dropped from four hours to zero, and we could see config differences after every change.
145

After moving DHCP to a new central server, remote PCs get addresses but IP phones fail to download their configuration. What do you check?

IP ServicesMedium
Save to ▾
Show answer
The phones need extra DHCP options that were probably not copied, such as option 150 or option 66 for the TFTP or call server and sometimes a voice VLAN option. Check the scope options on the new server, confirm the relay on each SVI points to it, and capture the DHCP offer to see which options arrive. Also verify the voice VLAN scope exists and that ACLs allow TFTP from the phone subnets to the call server.
146

What are DSCP and CoS markings?

IP ServicesHard
Save to ▾
Show answer
CoS is a 3-bit priority field in the 802.1Q tag, values 0 to 7, used only on Layer 2 trunks. DSCP is a 6-bit field in the IP header, values 0 to 63, which survives across routed hops. Common values: EF (46) for voice, AF41 (34) for video, CS3 (24) for call signalling and default (0) for best effort. Mark close to the source and trust markings only at controlled boundaries.
147

What is the difference between policing and shaping?

IP ServicesHard
Save to ▾
Show answer
Policing drops or re-marks traffic that exceeds a rate immediately, with no buffering, so it causes TCP retransmissions; it is used inbound or by ISPs. Shaping buffers excess traffic and sends it later, smoothing bursts to a configured rate at the cost of delay; it is used outbound, for example to match a 100 Mbps subscription on a 1 Gbps port.
148

Voice calls are choppy during office hours when the WAN link is busy. How do you fix it?

IP ServicesHard
Save to ▾
Show answer
Choppy voice under load means congestion on the WAN. I make sure phones mark RTP as EF and the access switches trust phone markings, then on the WAN router create a policy with a low latency priority queue for EF limited to the needed bandwidth, CBWFQ for other classes, and shaping to the real carrier rate so queuing happens on my router, not the provider's.
149

How do you configure NTP, syslog and SNMPv3 on a device?

IP ServicesHard
Save to ▾
Show answer
A typical management baseline: ntp server 10.0.0.10 prefer clock timezone IST 5 30 service timestamps log datetime msec localtime logging host 10.0.0.20 logging trap informational snmp-server group NMS v3 priv snmp-server user nmsuser NMS v3 auth sha AuthPass1 priv aes 128 PrivPass1 snmp-server host 10.0.0.30 version 3 priv nmsuser
150

Which QoS classes would you build for a typical branch WAN?

IP ServicesHard
Save to ▾
Show answer
A simple five-class model works for most branches. Voice (EF) priority queue, about 10 percent Video (AF41) guaranteed 20-25 percent Signalling (CS3) 5 percent Business apps (AF21) 25-30 percent Default (BE) remaining, with fair queuing Scavenger (CS1) small share for backups and updates
151

What are the key elements of a security program for a network?

Network SecurityEasy
Save to ▾
Show answer
A security program combines user awareness training, physical access control, and technical controls such as strong authentication, firewalls, IPS, VPNs and patching. It is built around the CIA triad: confidentiality, integrity and availability. Policies define what is allowed, and logging and monitoring detect problems. CCNA focuses on device hardening, ACLs, Layer 2 security, AAA, VPNs and wireless security.
152

What is the difference between standard and extended ACLs?

Network SecurityEasy
Save to ▾
Show answer
Standard ACLs (1 to 99 and 1300 to 1999) match only the source IP, so they should be placed close to the destination. Extended ACLs (100 to 199 and 2000 to 2699) match protocol, source, destination and ports, so they can be placed close to the source to drop unwanted traffic early. Named ACLs work for both and allow editing individual lines by sequence number.
153

How are ACL entries processed and what is the implicit deny?

Network SecurityEasy
Save to ▾
Show answer
ACL entries are checked top-down and the first match decides permit or deny; later lines are ignored. Every ACL ends with an invisible deny any, so traffic that matches no line is dropped. Therefore specific entries must come before general ones, and an ACL with only deny statements blocks everything. Always add a permit for allowed traffic and test after applying.
154

Explain password security best practices for network devices.

Network SecurityEasy
Save to ▾
Show answer
Use enable secret, not enable password, so the hash is strong (type 8 or 9 on modern IOS). Create local users with secret, enforce minimum length with security passwords min-length, and use AAA with TACACS+ for central control. Disable Telnet, use SSH v2, set exec-timeout on lines, and add login block-for to slow brute force. Avoid type 7 passwords, which are easily reversed.
155

A user's port keeps going into err-disabled state. How do you investigate?

Network SecurityEasy
Save to ▾
Show answer
I run show interfaces status err-disabled and show errdisable recovery to see the cause, such as psecure-violation, bpduguard or link-flap. If it is port security, the user may have plugged in a small switch or a docking station with an extra MAC, so I check show port-security interface. I fix the cause, then shut and no shut the port, or set the max MAC count appropriately.
156

How do you configure port security with sticky MACs?

Network SecurityEasy
Save to ▾
Show answer
Port security works on static access ports. interface GigabitEthernet1/0/10 switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security mac-address sticky switchport port-security violation restrict show port-security interface Gi1/0/10
157

How do you stay updated on network security threats?

Network SecurityEasy
Save to ▾
Show answer
Situation: as a fresher I realised many interview questions asked about recent attacks. Task: build a habit of learning. Action: I follow vendor security advisories, CERT-In alerts and a few security newsletters, practise in a home lab with packet captures, and read the release notes of devices we use. Result: I can explain current threats in interviews and suggested patching a vulnerable IOS version in my internship.
158

What is a wildcard mask and how is it used in ACLs?

Network SecurityMedium
Save to ▾
Show answer
A wildcard mask tells the router which bits must match: 0 means must match and 1 means ignore. It is often the inverse of the subnet mask, so 192.168.1.0 0.0.0.255 matches the whole /24. host 10.1.1.1 equals 0.0.0.0 and any equals 255.255.255.255. Wildcards are also used in OSPF network statements. Calculate it by subtracting the mask from 255.255.255.255.
159

What is port security and what are its violation modes?

Network SecurityMedium
Save to ▾
Show answer
Port security limits the MAC addresses allowed on an access port, either statically or by sticky learning. If an extra MAC appears, the violation mode acts: shutdown (default) err-disables the port, restrict drops the frames, logs and increments a counter, and protect silently drops frames. It stops MAC flooding and unauthorised devices on user ports.
160

How does DHCP snooping protect the network?

Network SecurityMedium
Save to ▾
Show answer
DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.
161

What is AAA and the difference between TACACS+ and RADIUS?

Network SecurityMedium
Save to ▾
Show answer
AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.
162

What is the difference between site-to-site and remote-access VPNs?

Network SecurityMedium
Save to ▾
Show answer
A site-to-site VPN connects whole networks, usually two routers or firewalls, using an always-on IPsec tunnel, so users do not need any client. A remote-access VPN connects individual users from laptops or phones to the company network using a client with TLS or IPsec, and authenticates each user. Both encrypt traffic over the internet to provide confidentiality and integrity.
163

A server team says an ACL you applied blocked all traffic, including allowed services. What happened?

Network SecurityMedium
Save to ▾
Show answer
Most likely the ACL lacks a permit for normal traffic, so the implicit deny dropped everything, or the order put a broad deny above the specific permits. It may also be applied in the wrong direction or on the wrong interface. I check show access-lists for hit counts, fix the sequence by inserting lines, and add a final permit or the needed entries. I always test ACLs with a rollback timer.
164

Users suddenly receive IP addresses from a wrong subnet. What do you suspect and how do you fix it?

Network SecurityMedium
Save to ▾
Show answer
A rogue DHCP server, often a home router plugged into a wall port, is answering requests. I find it by checking the DHCP server IP on an affected client with ipconfig /all, then tracing its MAC with show mac address-table. I shut that port, and prevent it permanently by enabling DHCP snooping on user VLANs with only uplinks trusted.
165

Guest Wi-Fi users must reach only the internet, not internal networks. How do you enforce it?

Network SecurityMedium
Save to ▾
Show answer
Put guests in their own VLAN and subnet, ideally terminating on a firewall or a separate VRF. Apply an inbound extended ACL on the guest SVI that permits DHCP and DNS to the allowed servers, denies all RFC 1918 destinations, and then permits any to the internet. Enable client isolation on the wireless side and rate limit the guest SSID so it cannot consume the WAN.
166

How do you write and apply an extended named ACL?

Network SecurityMedium
Save to ▾
Show answer
Allow web traffic from one subnet to a server and block the rest of that subnet. ip access-list extended WEB-ONLY 10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.80 eq 443 20 deny ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255 30 permit ip any any interface vlan 10 ip access-group WEB-ONLY in show access-lists WEB-ONLY
167

How do you restrict SSH access to devices from only the management subnet?

Network SecurityMedium
Save to ▾
Show answer
Use a standard ACL on the VTY lines. ip access-list standard MGMT-ONLY permit 10.99.0.0 0.0.0.255 deny any log line vty 0 15 access-class MGMT-ONLY in transport input ssh exec-timeout 10 0 login block-for 120 attempts 3 within 60
168

Tell me about a time you found a security issue and reported it.

Network SecurityMedium
Save to ▾
Show answer
Situation: during a routine audit I noticed SNMP v2c with the default community public on several access switches. Task: close the gap without disrupting monitoring. Action: I reported it to my lead with evidence, proposed SNMPv3 with an ACL, tested with the monitoring team and rolled out in two batches. Result: the risk was closed in a week and SNMP checks were added to our device baseline.
169

What is Dynamic ARP Inspection?

Network SecurityHard
Save to ▾
Show answer
DAI checks ARP packets on untrusted ports against the DHCP snooping binding table and drops ARP replies whose IP-to-MAC mapping does not match. This stops ARP spoofing and man-in-the-middle attacks where an attacker claims to be the default gateway. Static hosts need ARP ACLs. It requires DHCP snooping enabled in the same VLAN and trusted uplink ports.
170

What is 802.1X port-based authentication?

Network SecurityHard
Save to ▾
Show answer
802.1X lets a switch or access point block a port until the user or device authenticates. The supplicant is the client, the authenticator is the switch or AP, and the authentication server is a RADIUS server. EAP messages are carried over the LAN as EAPoL and then inside RADIUS. On success the RADIUS server can assign a VLAN or ACL. MAB is a fallback for devices without supplicants.
171

What are the main components of IPsec?

Network SecurityHard
Save to ▾
Show answer
IPsec uses IKE (v1 or v2) to authenticate peers and negotiate keys, ESP to encrypt and authenticate data, and optionally AH for authentication only, which breaks with NAT. Algorithms include AES for encryption, SHA-256 for integrity and Diffie-Hellman groups for key exchange. Tunnel mode encrypts the whole original packet and is used for site-to-site VPNs.
172

Auditors find that network devices use shared admin passwords and Telnet. What is your remediation plan?

Network SecurityHard
Save to ▾
Show answer
Disable Telnet with transport input ssh, enable SSH v2, and move admin login to AAA with TACACS+ so each engineer has a personal account with command authorisation and accounting logs. Keep one local fallback account in a password vault. Restrict VTY access with an ACL to the management subnet. Roll out with automation, test on a pilot, then document it for the audit.
173

How do you enable DHCP snooping and DAI?

Network SecurityHard
Save to ▾
Show answer
Enable per VLAN, trust uplinks and rate-limit user ports. ip dhcp snooping ip dhcp snooping vlan 10,20 no ip dhcp snooping information option ip arp inspection vlan 10,20 interface GigabitEthernet1/0/48 ip dhcp snooping trust ip arp inspection trust interface range Gi1/0/1 - 46 ip dhcp snooping limit rate 15 show ip dhcp snooping binding
174

How do you configure AAA with TACACS+ and a local fallback?

Network SecurityHard
Save to ▾
Show answer
Define the server, then method lists with local as backup. aaa new-model tacacs server ISE1 address ipv4 10.0.0.60 key Tac@csKey1 aaa authentication login default group tacacs+ local aaa authorization exec default group tacacs+ local aaa accounting commands 15 default start-stop group tacacs+ username breakglass privilege 15 secret L0calOnly!
175

A security scan shows that switch and router management interfaces are reachable from user VLANs. How do you lock down management access?

Network SecurityHard
Save to ▾
Show answer
Move management to a dedicated VLAN or out-of-band network, ideally in a management VRF. Apply an access-class ACL on VTY lines allowing only the jump host subnet, disable Telnet and HTTP, keep SSH version 2 and HTTPS only if needed, and use AAA with TACACS+ for per-user login and logging. Add control plane policing, block management subnets at the user VLAN gateways and rescan to confirm the fix.
176

What are the main 802.11 Wi-Fi standards?

Wireless and AutomationEasy
Save to ▾
Show answer
802.11n (Wi-Fi 4) works on 2.4 and 5 GHz with MIMO. 802.11ac (Wi-Fi 5) is 5 GHz only with wider channels and MU-MIMO downlink. 802.11ax (Wi-Fi 6 and 6E) adds OFDMA, BSS colouring and target wake time, and 6E adds the 6 GHz band. 802.11be (Wi-Fi 7) adds 320 MHz channels and multi-link operation. India opened part of the 6 GHz band for indoor use.
177

Why are channels 1, 6 and 11 used in 2.4 GHz?

Wireless and AutomationEasy
Save to ▾
Show answer
In 2.4 GHz each channel is about 22 MHz wide but channels are only 5 MHz apart, so most adjacent channels overlap and interfere. Channels 1, 6 and 11 are the only three non-overlapping channels, so neighbouring access points should alternate between them. The 5 GHz band has many more non-overlapping 20 MHz channels, which is why it is preferred for capacity.
178

What are SSID, BSSID and ESS?

Wireless and AutomationEasy
Save to ▾
Show answer
The SSID is the network name users see. The BSSID is the MAC address of the access point radio serving a BSS, the basic service set of one AP and its clients. An ESS is multiple BSSs sharing the same SSID connected by a wired distribution system, so clients can roam between APs. Each AP can broadcast several SSIDs, each with its own BSSID.
179

What are the data plane, control plane and management plane?

Wireless and AutomationEasy
Save to ▾
Show answer
The data plane forwards packets, using tables such as the FIB and MAC table, ideally in hardware. The control plane builds those tables using protocols like OSPF, STP and ARP. The management plane is how admins and tools interact with the device, through SSH, SNMP, syslog and APIs. Separating them helps understanding of SDN, where the control plane can be centralised.
180

What is a REST API and which HTTP methods map to CRUD?

Wireless and AutomationEasy
Save to ▾
Show answer
A REST API exposes resources at URLs and is stateless, usually with JSON payloads over HTTPS. CRUD maps to HTTP verbs: POST creates, GET reads, PUT replaces or PATCH partly updates, and DELETE removes. Responses use status codes such as 200 OK, 201 Created, 401 Unauthorized, 404 Not Found and 500 Server Error. Controllers expose northbound REST APIs for automation.
181

How would you represent an interface configuration in JSON and YAML?

Wireless and AutomationEasy
Save to ▾
Show answer
The same data in both formats. JSON: { "interface": "GigabitEthernet0/1", "enabled": true, "ipv4": ["192.168.1.1/24"] } YAML: interface: GigabitEthernet0/1 enabled: true ipv4: - 192.168.1.1/24
182

Where do you see yourself in five years in networking?

Wireless and AutomationEasy
Save to ▾
Show answer
Situation: I started with CCNA and a support role. Task: build a clear path. Action: I plan to master routing, switching and wireless in the next two years, pass CCNP Enterprise, and build automation skills in Python and Ansible alongside cloud networking. Result I aim for: a network engineer or architect role leading campus and SD-WAN projects, mentoring juniors and owning designs end to end.
183

What is the difference between autonomous APs, controller-based APs and cloud-managed APs?

Wireless and AutomationMedium
Save to ▾
Show answer
Autonomous APs are configured one by one and suit very small sites. Lightweight APs are managed by a Wireless LAN Controller using CAPWAP tunnels, which centralises configuration, RF management and roaming, and suits campuses. Cloud-managed APs are configured from a cloud dashboard, ideal for many branches. Split-MAC means real-time functions stay on the AP while management sits on the controller.
184

What is CAPWAP?

Wireless and AutomationMedium
Save to ▾
Show answer
Control and Provisioning of Wireless Access Points is the protocol between lightweight APs and the WLC. It builds two tunnels: a control tunnel on UDP 5246, encrypted with DTLS, and a data tunnel on UDP 5247 that carries client traffic in central switching mode. In FlexConnect or local switching mode, client data is switched locally at the AP instead of being tunnelled.
185

Compare WPA2 and WPA3 security.

Wireless and AutomationMedium
Save to ▾
Show answer
WPA2 uses AES-CCMP; WPA2-Personal uses a pre-shared key that is vulnerable to offline dictionary attacks, and WPA2-Enterprise uses 802.1X with RADIUS. WPA3-Personal replaces PSK with SAE, which resists offline guessing and gives forward secrecy. WPA3-Enterprise offers a 192-bit mode. WPA3 requires protected management frames. Open networks can use OWE for encryption without passwords.
186

How does controller-based networking differ from traditional networking?

Wireless and AutomationMedium
Save to ▾
Show answer
Traditionally each device has its own control plane and is configured box by box. In controller-based or software-defined networking, a central controller holds the policy and pushes it to devices through southbound APIs such as NETCONF or OpenFlow, while applications talk to the controller through northbound REST APIs. This gives consistent configuration, automation and network-wide visibility.
187

Compare Ansible, Puppet and Chef for network automation.

Wireless and AutomationMedium
Save to ▾
Show answer
Ansible is agentless, uses SSH or APIs, writes playbooks in YAML and uses a push model, so it is the most popular for network devices. Puppet uses an agent, a declarative manifest language and a pull model. Chef uses Ruby-based recipes with an agent and pull model. Puppet and Chef are more common for servers. All support idempotent configuration management.
188

Users complain Wi-Fi is slow in a conference room with 60 people. What do you check and fix?

Wireless and AutomationMedium
Save to ▾
Show answer
This is usually a capacity, not a coverage, issue. I check client count per AP and channel utilisation on the controller. Fixes include adding APs with lower transmit power, steering clients to 5 or 6 GHz with band steering, disabling low data rates such as 1, 2 and 5.5 Mbps, using 20 or 40 MHz channels in dense areas, and limiting per-client bandwidth on the SSID.
189

Users can connect to the corporate SSID but get no IP address. What do you check?

Wireless and AutomationMedium
Save to ▾
Show answer
Association works, so the issue is between the AP or WLC and DHCP. I check the WLAN is mapped to the right dynamic interface and VLAN, that the VLAN is allowed on the WLC and AP trunks, and that DHCP relay or helper is set on the VLAN gateway. In FlexConnect local switching, I check the AP switchport trunk and VLAN mapping. Finally I check the DHCP scope.
190

A Python script gets 401 errors when calling a controller REST API. What do you check?

Wireless and AutomationMedium
Save to ▾
Show answer
401 Unauthorized means authentication failed. I check the username and password or API key, whether a token must first be requested from an auth endpoint and sent in a header like X-Auth-Token, whether the token expired, and the exact header name and format. I test the same call with curl or an API client to separate script bugs from credential issues.
191

How do you write a simple Python script to fetch interface data from a device?

Wireless and AutomationMedium
Save to ▾
Show answer
Netmiko handles SSH sessions; keep credentials in a file or vault, not the script. import yaml from netmiko import ConnectHandler # r1.yml holds device_type, host, username, password with open('r1.yml') as f: device = yaml.safe_load(f) with ConnectHandler(**device) as conn: output = conn.send_command('show ip interface brief') print(output)
192

Write a simple Ansible playbook that configures NTP on IOS devices.

Wireless and AutomationMedium
Save to ▾
Show answer
Ansible uses YAML and the ios_config module. - name: Configure NTP hosts: ios_switches gather_facts: no connection: network_cli tasks: - name: Set NTP server ios_config: lines: - ntp server 10.0.0.10 save_when: modified
193

What are the basic steps to configure a WLAN with WPA2 or WPA3 on a controller GUI?

Wireless and AutomationMedium
Save to ▾
Show answer
Steps on a typical WLC GUI: create a dynamic interface with VLAN, IP and DHCP server; go to WLANs and create a new WLAN with profile name and SSID; map it to the dynamic interface; under Security choose WPA2 or WPA3 with PSK or 802.1X and add the RADIUS server for enterprise; set QoS profile; enable the WLAN and apply it to AP groups.
194

Tell me about a time you took initiative beyond your assigned work.

Wireless and AutomationMedium
Save to ▾
Show answer
Situation: our team got many Wi-Fi complaints but had no data. Task: nobody had asked, but I wanted to find the cause. Action: I did a walk-through survey with a free tool, mapped channels and signal, and found three APs on the same 2.4 GHz channel and one dead AP. I shared a short report with fixes. Result: after the changes, Wi-Fi tickets dropped by about 60 percent in a month.
195

What are the WLC port and interface types?

Wireless and AutomationHard
Save to ▾
Show answer
Physical ports include service ports for out-of-band management, distribution system ports that connect to the switch as trunks, and redundancy ports for HA. Logical interfaces include the management interface used for CAPWAP and admin access, dynamic interfaces that map WLANs to VLANs, and a virtual interface used for web auth and DHCP relay. A LAG bundles distribution ports.
196

What is an underlay and an overlay network?

Wireless and AutomationHard
Save to ▾
Show answer
The underlay is the physical IP network of switches and routers that provides basic reachability, for example OSPF or IS-IS on routed links. The overlay is a virtual network built on top using tunnels such as VXLAN, so logical segments can stretch across the fabric independent of physical topology. SD-Access and SD-WAN use this model, with a fabric controlling the overlay.
197

A new lightweight AP does not join the controller. How do you troubleshoot?

Wireless and AutomationHard
Save to ▾
Show answer
I check the AP gets a DHCP address and can reach the WLC management IP. It discovers the controller through DHCP option 43, the standard CAPWAP controller DNS name, broadcast or a primed controller IP, so I verify one of these. Then I check UDP 5246 and 5247 are not blocked, the AP's clock and certificate are valid, the country code matches, and the WLC has AP licences available.
198

Your manager wants to stop configuring 200 switches manually. What would you propose?

Wireless and AutomationHard
Save to ▾
Show answer
I would start with a source of truth for devices and variables, then use Ansible playbooks with Jinja2 templates to generate and push standard configs over SSH, keeping them in Git with peer review. A controller such as Catalyst Center could handle day-0 provisioning and compliance. I would start with read-only tasks like backups and audits, then move to small, tested change automation.
199

How do you call a REST API from Python and parse the JSON?

Wireless and AutomationHard
Save to ▾
Show answer
Use the requests library and convert the reply to a dictionary. import requests url = 'https://controller.example.local/api/v1/network-device' headers = {'X-Auth-Token': token, 'Accept': 'application/json'} r = requests.get(url, headers=headers, timeout=10) r.raise_for_status() for dev in r.json()['response']: print(dev['hostname'], dev['managementIpAddress'])
200

An automation job pushed a wrong configuration to 50 switches and broke their uplinks. How do you recover and stop it happening again?

Wireless and AutomationHard
Save to ▾
Show answer
First stop the job, then recover through out-of-band console or a management network, using configuration archive rollback or a saved backup. In future, run changes with commit confirmed or reload in as a safety timer, test in a lab, use a dry run or check mode, deploy to one canary switch, then in small batches with automatic post-checks. Store templates in Git with peer review so every change is visible and reversible.

Frequently asked questions

What jobs can I get after learning CCNA?

Freshers with CCNA knowledge usually start as network support engineers, NOC engineers, desktop and network support associates or junior network administrators. With two to four years of experience you can move to network engineer, wireless engineer or network security engineer roles. IT services companies, telecom operators, data centers, banks and large enterprises across Bengaluru, Pune, Hyderabad, Noida, Gurugram, Chennai and Mumbai hire for these roles throughout the year.

Who is eligible to learn CCNA?

There is no formal eligibility for the CCNA exam. It suits B.Tech, BCA, MCA, B.Sc IT and diploma students, freshers and working professionals from desktop support, IT helpdesk or telecom who want a networking career. You need basic computer skills and patience for subnetting practice. Programming is not required to start, although a little Python helps with the automation section of the exam.

How long does it take to learn CCNA?

Most learners need about 10 to 12 weeks of regular study, around two hours a day, to cover the full 200-301 syllabus with labs. Subnetting and OSPF take the most practice. Working professionals often take three to four months. Plan the last two weeks for mock tests and revision, and spend at least half your time in Packet Tracer or GNS3 labs, not only reading.

Is the CCNA certification still valuable in 2026?

Yes. CCNA 200-301 remains the most common entry-level networking certification asked for in Indian job descriptions for support, NOC and network engineer roles. It is valid for three years and can be renewed with continuing education credits or a higher exam. Employers value it most when combined with real lab skills, so be ready to configure and troubleshoot live in interviews.

Do I need real Cisco devices to practise for CCNA?

No. Packet Tracer is enough for most CCNA topics, including VLANs, STP, OSPF, NAT, DHCP and ACLs. GNS3 or EVE-NG with virtual router images gives a more realistic IOS experience for advanced practice. A second-hand switch can help you learn console access and cabling, but it is optional. Wireshark is useful for seeing protocols such as ARP, DHCP and TCP in action.

What should I learn after CCNA?

After CCNA, most engineers move to CCNP Enterprise for advanced routing, switching, SD-WAN and automation, or to a security track with firewalls and VPNs. Others add cloud networking on AWS or Azure, or Python and Ansible for network automation. Choose based on your role: NOC and support engineers usually go for CCNP, while those in cloud teams combine CCNA with a cloud certification.