Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Cisco hiring for CCNA roles
Cisco is a networking and security company making routers, switches, security products, collaboration tools such as Webex, and observability software including Splunk. Its Bengaluru campus is one of its largest R&D centres outside the US. It hires in India for software engineers, test and validation engineers, network engineers and data analysts.
For CCNA roles, this Cisco practice set focuses most on Network Security (6), Wireless and Automation (6), IP Addressing and Subnetting (4), Routing and OSPF (4). It has 2 easy, 19 medium, 9 hard questions, so you can start easy and work up to the harder ones.
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for CiscoStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is AAA and the difference between TACACS+ and RADIUS?
AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.
02
How do you configure SSH access on a switch or router?
SSH needs a hostname, domain name, RSA keys, a local user and VTY lines restricted to SSH.
hostname R1
ip domain-name lab.local
crypto key generate rsa modulus 2048
ip ssh version 2
username admin privilege 15 secret Adm1nPass
line vty 0 4
login local
transport input ssh
03
What is a spine-leaf architecture and why is it used in data centers?
In spine-leaf, every leaf switch connects to every spine switch, and servers connect only to leaves. Any server is therefore at most two hops from another, giving predictable latency and good east-west bandwidth. Capacity is added by adding spines or leaves. It usually runs Layer 3 with ECMP to use all links, instead of relying on spanning tree.
04
How do you restrict SSH access to devices from only the management subnet?
Use a standard ACL on the VTY lines.
ip access-list standard MGMT-ONLY
permit 10.99.0.0 0.0.0.255
deny any log
line vty 0 15
access-class MGMT-ONLY in
transport input ssh
exec-timeout 10 0
login block-for 120 attempts 3 within 60
05
A Python script gets 401 errors when calling a controller REST API. What do you check?
401 Unauthorized means authentication failed. I check the username and password or API key, whether a token must first be requested from an auth endpoint and sent in a header like X-Auth-Token, whether the token expired, and the exact header name and format. I test the same call with curl or an API client to separate script bugs from credential issues.
Root Guard on a designated port puts it into root-inconsistent state if a superior BPDU arrives, protecting the planned root bridge, so it is used on distribution ports facing access switches. Loop Guard stops a non-designated port from becoming designated when BPDUs stop arriving, such as with a unidirectional fiber fault. UDLD complements Loop Guard by detecting one-way links.
07
Users complain Wi-Fi is slow in a conference room with 60 people. What do you check and fix?
This is usually a capacity, not a coverage, issue. I check client count per AP and channel utilisation on the controller. Fixes include adding APs with lower transmit power, steering clients to 5 or 6 GHz with band steering, disabling low data rates such as 1, 2 and 5.5 Mbps, using 20 or 40 MHz channels in dense areas, and limiting per-client bandwidth on the SSID.
08
An automation job pushed a wrong configuration to 50 switches and broke their uplinks. How do you recover and stop it happening again?
First stop the job, then recover through out-of-band console or a management network, using configuration archive rollback or a saved backup. In future, run changes with commit confirmed or reload in as a safety timer, test in a lab, use a dry run or check mode, deploy to one canary switch, then in small batches with automatic post-checks. Store templates in Git with peer review so every change is visible and reversible.
802.11n (Wi-Fi 4) works on 2.4 and 5 GHz with MIMO. 802.11ac (Wi-Fi 5) is 5 GHz only with wider channels and MU-MIMO downlink. 802.11ax (Wi-Fi 6 and 6E) adds OFDMA, BSS colouring and target wake time, and 6E adds the 6 GHz band. 802.11be (Wi-Fi 7) adds 320 MHz channels and multi-link operation. India opened part of the 6 GHz band for indoor use.
10
Syslog timestamps from different devices do not match during an incident review. What do you fix?
Clocks are not synchronised. I configure all devices to use the same internal NTP servers with ntp server, set the timezone with clock timezone IST 5 30, add service timestamps log datetime msec localtime, and enable NTP authentication. Then I check show ntp associations and show ntp status to confirm synchronisation. This makes future incident timelines reliable.
DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.
Variable Length Subnet Masking means using different prefix lengths inside one address block, so each subnet is sized to its need. You allocate the largest subnets first, then smaller ones, to avoid overlaps. For example, from 10.1.1.0/24 you could give a 100-user LAN a /25, a 50-user LAN a /26, and point-to-point WAN links /30 or /31. It saves address space compared with fixed-length subnetting.
13
A server team says an ACL you applied blocked all traffic, including allowed services. What happened?
Most likely the ACL lacks a permit for normal traffic, so the implicit deny dropped everything, or the order put a broad deny above the specific permits. It may also be applied in the wrong direction or on the wrong interface. I check show access-lists for hit counts, fix the sequence by inserting lines, and add a final permit or the needed entries. I always test ACLs with a rollback timer.
14
How do you configure AAA with TACACS+ and a local fallback?
Define the server, then method lists with local as backup.
aaa new-model
tacacs server ISE1
address ipv4 10.0.0.60
key Tac@csKey1
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting commands 15 default start-stop group tacacs+
username breakglass privilege 15 secret L0calOnly!
A /26 leaves 6 host bits, so 2 to the power 6 is 64 addresses and 62 usable hosts after removing network and broadcast. The mask is 255.255.255.192 and the block size is 256 minus 192, which is 64. So subnets of 192.168.1.0/26 start at .0, .64, .128 and .192. For 192.168.1.70/26 the network is .64 and broadcast .127.
17
Two OSPF routers on the same link are stuck in EXSTART state. What is the cause and fix?
EXSTART or EXCHANGE stuck usually means an MTU mismatch, because database description packets larger than the neighbour's MTU are dropped. I compare MTU with show interfaces and set ip mtu to match on both sides. As a temporary workaround, ip ospf mtu-ignore can be used, but fixing the MTU is better. Duplicate router IDs can also cause odd adjacency behaviour, so I check those too.
VLAN Trunking Protocol shares VLAN definitions from a server switch to clients in the same VTP domain. Modes are server, client, transparent and off. The risk is that a switch with a higher configuration revision number can overwrite and wipe VLANs across the domain. Many networks use transparent mode or VTP version 3 with a primary server to avoid this.
19
Your company is running out of IP addresses on a /24 user subnet. What options do you have?
Options: expand to a /23 if the adjacent block is free and update the router and DHCP scope; create a new VLAN and subnet for some users, which also limits broadcast size; shorten DHCP lease times if many guest devices hold leases; and move printers, phones and IoT devices to their own subnets. Long term, plan an addressing scheme with growth headroom and consider dual-stack IPv6.
20
How do you configure NTP, syslog and SNMPv3 on a device?
Another source with a lower AD may be providing the same prefix, such as a static route, so the OSPF route is not installed. Or a more specific route wins by longest match. The next hop may also be unreachable, or a distribute-list may filter it. I check show ip route for the prefix, show ip ospf database, and compare administrative distances.
22
Guest Wi-Fi users must reach only the internet, not internal networks. How do you enforce it?
Put guests in their own VLAN and subnet, ideally terminating on a firewall or a separate VRF. Apply an inbound extended ACL on the guest SVI that permits DHCP and DNS to the allowed servers, denies all RFC 1918 destinations, and then permits any to the internet. Enable client isolation on the wireless side and rate limit the guest SSID so it cannot consume the WAN.
23
A broadcast storm brought the network down after someone connected a cable between two wall ports. How do you prevent this?
Two wall ports patched to the same switch formed a loop. To stop it now, I find the port with rising broadcast counters and shut it. To prevent repeats, enable PortFast with BPDU Guard on all access ports, keep Rapid PVST+ running everywhere, add storm-control broadcast thresholds on access ports and enable errdisable recovery with a sensible interval.
Rapid PVST+ runs 802.1w per VLAN. It uses a proposal and agreement handshake on point-to-point links so ports move to forwarding in under a second, instead of waiting on timers. It has port roles root, designated, alternate and backup, and states discarding, learning and forwarding. Alternate ports provide an instant backup root port. It is the default on most modern IOS switches.
Set interface priority; higher wins and 0 never becomes DR.
interface GigabitEthernet0/0
ip ospf priority 255
! on a router that should never be DR
interface GigabitEthernet0/0
ip ospf priority 0
clear ip ospf process
Because election is non-preemptive, reset the process or the neighbours for the change to take effect.
26
What is EUI-64 and how is the interface ID generated?
EUI-64 builds a 64-bit interface ID from a 48-bit MAC. Split the MAC in half, insert FFFE in the middle and flip the seventh bit of the first byte. For MAC 0050.56AB.CDEF the ID becomes 0250:56FF:FEAB:CDEF. Routers can use ipv6 address 2001:db8:1::/64 eui-64. Hosts often prefer random privacy addresses instead, to avoid exposing the MAC.
Cost equals reference bandwidth divided by interface bandwidth. The default reference is 100 Mbps, so FastEthernet, Gigabit and 10 Gigabit all get cost 1, which hides the faster links. Change it with auto-cost reference-bandwidth 100000 on every router so 1G becomes 100 and 10G becomes 10. You can also set ip ospf cost directly on an interface. Path cost is the sum of outgoing interface costs.
28
An SVI shows status down/down even though it is configured. What could be wrong?
An SVI comes up only if the VLAN exists in the VLAN database and at least one access or trunk port in that VLAN is up and forwarding, and the SVI is not shut down. So I check show vlan brief for the VLAN, check that at least one port in it is connected, check trunks allow it, and run no shutdown on the SVI. On Layer 3 switches, ip routing must be enabled for routing.
29
What are the basic steps to configure a WLAN with WPA2 or WPA3 on a controller GUI?
Steps on a typical WLC GUI: create a dynamic interface with VLAN, IP and DHCP server; go to WLANs and create a new WLAN with profile name and SSID; map it to the dynamic interface; under Security choose WPA2 or WPA3 with PSK or 802.1X and add the RADIUS server for enterprise; set QoS profile; enable the WLAN and apply it to AP groups.
30
How does controller-based networking differ from traditional networking?
Traditionally each device has its own control plane and is configured box by box. In controller-based or software-defined networking, a central controller holds the policy and pushes it to devices through southbound APIs such as NETCONF or OpenFlow, while applications talk to the controller through northbound REST APIs. This gives consistent configuration, automation and network-wide visibility.
Tips to crack the Cisco CCNA interview
Revise computer networking deeply, including OSI layers, TCP/IP, subnetting, routing protocols and VLANs.
For test roles, be ready to explain how you would test a network feature, including traffic tools and automation with Python.
Read about Cisco's security and Splunk observability products, which have become a growing focus area.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Cisco interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Cisco CCNA interview?
Candidates usually go through 5 stages: Online assessment (aptitude + networking + coding); Technical round 1; Technical round 2; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Cisco CCNA interview?
This practice set leans on Network Security (6), Wireless and Automation (6), IP Addressing and Subnetting (4), Routing and OSPF (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Cisco interviewers ask you to walk through real work.
Are these the exact questions asked at Cisco?
No. These are curated practice questions that match the skills and difficulty usually tested in hardware & semiconductors interviews like Cisco's. They are not a leaked or verified list of past questions.
Where does Cisco hire CCNA professionals in India?
Cisco has large teams in Bengaluru, Pune, Chennai. Openings and locations change often, so check the Cisco careers page and filter by city and experience.