Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Cognizant hiring for CCNA roles
Cognizant is a US-headquartered IT services and consulting company with most of its workforce based in India. It provides application development, testing, cloud, digital engineering and data analytics services, with strong practices in healthcare, insurance and banking. In India it hires for programmer analyst, quality engineer and data roles through campus and off-campus programmes such as GenC.
For CCNA roles, this Cognizant practice set focuses most on IP Services (7), IP Addressing and Subnetting (5), Network Security (4), Network Fundamentals (4). It has 13 easy, 16 medium, 1 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Teaneck, New Jersey, USA
Main India offices
Chennai, Bengaluru, Pune, Hyderabad, Kolkata
Cognizant CCNA interview process
Online assessment (aptitude + reasoning)
Coding assessment
Technical interview
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for CognizantStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Explain root port, designated port and blocked port.
Every non-root switch picks one root port, its best path to the root based on lowest root path cost, then lowest sender bridge ID, then lowest sender port ID. On each segment, the switch with the best path becomes the designated port and forwards. Every remaining port becomes non-designated and blocks. All ports on the root bridge are designated.
RFC 3021 allows /31 on point-to-point links because there is no need for network and broadcast addresses when only two devices exist. A /31 gives exactly two usable addresses, saving half the space of a /30. It is common on ISP and data center fabric links. Both ends must support it; on IOS you simply configure ip address 10.0.0.0 255.255.255.254.
DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.
04
How do you configure inter-VLAN routing on a Layer 3 switch with SVIs?
Enable routing and create an SVI per VLAN as the gateway.
ip routing
interface vlan 10
ip address 192.168.10.1 255.255.255.0
ip helper-address 10.0.0.50
no shutdown
interface vlan 20
ip address 192.168.20.1 255.255.255.0
no shutdown
show ip route connected
05
How does controller-based networking differ from traditional networking?
Traditionally each device has its own control plane and is configured box by box. In controller-based or software-defined networking, a central controller holds the policy and pushes it to devices through southbound APIs such as NETCONF or OpenFlow, while applications talk to the controller through northbound REST APIs. This gives consistent configuration, automation and network-wide visibility.
06
Two hosts are in the same VLAN but one has mask /24 and the other /25. What problems may occur?
Each host decides local or remote using its own mask. With 192.168.1.10/24 and 192.168.1.200/25, the first thinks .200 is local and ARPs directly, but the second sees .10 as remote and sends replies to its gateway. Traffic can become one-way or asymmetric and may break completely if the gateway does not route it back. Fix the mask so both match the design.
A client asks its configured resolver, for example for www.example.com. If it is not cached, the resolver queries a root server, which refers it to the .com TLD server, which refers it to the authoritative server for example.com, which returns the A or AAAA record. The answer is cached for its TTL. DNS uses UDP 53 for most queries and TCP 53 for zone transfers and large replies.
The client sends a SYN with an initial sequence number. The server replies with SYN-ACK, acknowledging the client sequence and sending its own. The client sends an ACK and the session is established. Closing uses FIN and ACK from each side. A firewall that sees repeated SYNs without the final ACK may be looking at a SYN flood attack.
Enable per VLAN, trust uplinks and rate-limit user ports.
ip dhcp snooping
ip dhcp snooping vlan 10,20
no ip dhcp snooping information option
ip arp inspection vlan 10,20
interface GigabitEthernet1/0/48
ip dhcp snooping trust
ip arp inspection trust
interface range Gi1/0/1 - 46
ip dhcp snooping limit rate 15
show ip dhcp snooping binding
10
How do you handle pressure when an outage affects many users?
Situation: DHCP failed for 300 users at 9 a.m. on a Monday. Task: restore service while keeping managers updated. Action: I stayed calm, followed the bottom-up method, found the DHCP server's scope was full after a lease time change, extended the scope and shortened leases. I sent updates every 15 minutes. Result: users were back in 30 minutes, and we added scope utilisation alerts to monitoring.
11
What is the difference between a hub, a switch and a router?
A hub is a Layer 1 repeater: it floods every bit out of every port, so all ports share one collision domain. A switch is Layer 2: it learns MAC addresses and forwards frames only to the correct port, giving each port its own collision domain. A router is Layer 3: it forwards packets between IP networks and separates broadcast domains.
12
How do you configure port security with sticky MACs?
The TCP/IP model has four or five layers. Its Application layer covers OSI layers 5 to 7, Transport maps to Layer 4, Internet maps to Layer 3, and Network Access (or Link plus Physical) covers layers 1 and 2. CCNA uses the five-layer version. Real protocols such as HTTP, TCP and IP are defined by the TCP/IP suite, so it is the practical model.
14
Your company is running out of IP addresses on a /24 user subnet. What options do you have?
Options: expand to a /23 if the adjacent block is free and update the router and DHCP scope; create a new VLAN and subnet for some users, which also limits broadcast size; shorten DHCP lease times if many guest devices hold leases; and move printers, phones and IoT devices to their own subnets. Long term, plan an addressing scheme with growth headroom and consider dual-stack IPv6.
15
How do you configure a router as a DHCP relay and verify it?
Add the helper address on the client-facing interface.
interface vlan 20
ip helper-address 10.0.0.50
show ip interface vlan 20 | include Helper
debug ip dhcp server packet
The helper also forwards some other UDP broadcasts such as TFTP and DNS by default; use no ip forward-protocol udp to limit them.
16
Compare distance vector and link state routing protocols.
Distance vector protocols like RIP share their routing table with neighbours and trust what they hear, so they converge slowly and need loop prevention such as split horizon. Link state protocols like OSPF and IS-IS flood link state advertisements so each router builds a full topology map and runs Dijkstra's SPF algorithm. Link state converges faster and scales better but uses more memory and CPU.
17
Tell me about a time you automated or simplified a repetitive task.
Situation: our team manually backed up 80 router configs each week. Task: save time and avoid missed backups. Action: I enabled the archive feature with time-period on each device and later wrote a small Python script with Netmiko to pull and store configs in Git. Result: weekly effort dropped from four hours to zero, and we could see config differences after every change.
Dynamic Trunking Protocol negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access. Auto plus auto stays access, while desirable with auto or desirable forms a trunk. Attackers can use DTP to form a trunk and reach all VLANs, so best practice is to hard-code access or trunk and use switchport nonegotiate on trunks.
19
A newly configured router interface rejects the IP 192.168.5.64/26. Why?
With a /26 the block size is 64, so 192.168.5.64 is the network address of the subnet .64 to .127 and cannot be assigned to a host or interface. IOS reports a bad mask or overlap error. Use a usable address such as 192.168.5.65 instead. Similarly .127 would be the broadcast. Always calculate the subnet boundary before configuring addresses.
20
How do you back up and restore a device configuration?
Copy the config to a server and back.
copy running-config tftp://10.0.0.40/R1-backup.cfg
copy running-config scp://admin@10.0.0.40/R1.cfg
copy tftp://10.0.0.40/R1-backup.cfg running-config
configure replace flash:R1-good.cfg
archive
path flash:R1-archive
write-memory
configure replace gives a clean rollback instead of merging.
Network Address Translation rewrites IP addresses as packets cross a router, usually private inside addresses to public outside ones. Static NAT maps one inside address to one public address, often for servers. Dynamic NAT maps from a pool. PAT, or NAT overload, maps many inside hosts to one public IP using unique source ports, and is what almost every office and home router uses.
22
You have 192.168.10.0/24 and need subnets for 100, 50, 20 hosts and two point-to-point links. Design it with VLSM.
A site-to-site VPN connects whole networks, usually two routers or firewalls, using an always-on IPsec tunnel, so users do not need any client. A remote-access VPN connects individual users from laptops or phones to the company network using a client with TLS or IPsec, and authenticates each user. Both encrypt traffic over the internet to provide confidentiality and integrity.
These commands cover neighbours, interfaces, routes and the database.
show ip ospf neighbor
show ip ospf interface brief
show ip ospf interface Gi0/0
show ip route ospf
show ip ospf database
show ip protocols
show ip protocols shows router ID, networks, passive interfaces and the reference bandwidth.
From bottom to top: Physical, Data Link, Network, Transport, Session, Presentation and Application. Each layer serves the one above it. For example, Ethernet frames work at Layer 2, IP packets at Layer 3 and TCP segments at Layer 4. Engineers use the model to troubleshoot bottom-up: check cables and link lights first, then MAC learning, then IP reachability.
In 2.4 GHz each channel is about 22 MHz wide but channels are only 5 MHz apart, so most adjacent channels overlap and interfere. Channels 1, 6 and 11 are the only three non-overlapping channels, so neighbouring access points should alternate between them. The 5 GHz band has many more non-overlapping 20 MHz channels, which is why it is preferred for capacity.
802.1Q inserts a 4-byte tag after the source MAC in the Ethernet frame. The tag holds a 12-bit VLAN ID (1 to 4094 usable), 3 priority bits used by CoS for QoS, and a DEI bit. The tag is added when a frame leaves a trunk and removed at an access port. Older ISL encapsulation is obsolete; modern switches support only 802.1Q.
28
How do you configure PortFast and BPDU Guard on access ports?
Apply per port or globally for all PortFast ports.
interface range GigabitEthernet1/0/1 - 46
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
! or globally
spanning-tree portfast default
spanning-tree portfast bpduguard default
errdisable recovery cause bpduguard
errdisable recovery interval 300
DHCP uses the DORA process: the client broadcasts Discover, the server answers with an Offer, the client broadcasts a Request for that offer, and the server confirms with an Acknowledgement. The lease includes IP, mask, gateway, DNS servers and lease time. Clients renew at 50 percent of the lease. DHCP uses UDP ports 67 for the server and 68 for the client.
A floating static route is a backup static route with a higher administrative distance than the primary route, so it stays out of the routing table until the primary disappears. For example, if OSPF (AD 110) learns the main path, ip route 0.0.0.0 0.0.0.0 203.0.113.1 200 installs only when OSPF loses the route. It is common for backup internet or 4G links.
Tips to crack the Cognizant CCNA interview
Understand the GenC, GenC Next and GenC Elevate tracks so you know which skills and coding level each role expects.
Revise SQL queries, OOP concepts and basic testing terminology since many freshers are placed in development or QA projects.
Read about Cognizant's healthcare and life sciences domain work, which is a large part of its client base.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Cognizant interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Cognizant CCNA interview?
Candidates usually go through 4 stages: Online assessment (aptitude + reasoning); Coding assessment; Technical interview; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Cognizant CCNA interview?
This practice set leans on IP Services (7), IP Addressing and Subnetting (5), Network Security (4), Network Fundamentals (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Cognizant interviewers ask you to walk through real work.
Are these the exact questions asked at Cognizant?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like Cognizant's. They are not a leaked or verified list of past questions.
Where does Cognizant hire CCNA professionals in India?
Cognizant has large teams in Chennai, Bengaluru, Pune, Hyderabad, Kolkata. Openings and locations change often, so check the Cognizant careers page and filter by city and experience.