Easy CCNA Interview Questions

From bottom to top: Physical, Data Link, Network, Transport, Session, Presentation and Application. Each layer serves the one above it. For example, Ethernet frames work at Layer 2, IP packets at Layer 3 and TCP segments at Layer 4. Engineers use the model to troubleshoot bottom-up: check cables and link lights first, then MAC learning, then IP reachability.

The TCP/IP model has four or five layers. Its Application layer covers OSI layers 5 to 7, Transport maps to Layer 4, Internet maps to Layer 3, and Network Access (or Link plus Physical) covers layers 1 and 2. CCNA uses the five-layer version. Real protocols such as HTTP, TCP and IP are defined by the TCP/IP suite, so it is the practical model.

TCP is connection-oriented: it uses a three-way handshake, sequence numbers, acknowledgements, retransmission, windowing and flow control, so delivery is reliable and ordered. UDP is connectionless with an 8-byte header and no retransmission, so it is faster and lighter. HTTPS, SSH and SMTP use TCP; DNS queries, DHCP, SNMP, TFTP and voice or video RTP streams use UDP.

The client sends a SYN with an initial sequence number. The server replies with SYN-ACK, acknowledging the client sequence and sending its own. The client sends an ACK and the session is established. Closing uses FIN and ACK from each side. A firewall that sees repeated SYNs without the final ACK may be looking at a SYN flood attack.

A hub is a Layer 1 repeater: it floods every bit out of every port, so all ports share one collision domain. A switch is Layer 2: it learns MAC addresses and forwards frames only to the correct port, giving each port its own collision domain. A router is Layer 3: it forwards packets between IP networks and separates broadcast domains.

No link light means a Layer 1 problem. I verify the switch has power and the ports are not administratively shut down with show ip interface brief. I test the cable with a tester, check the patch panel mapping and confirm the NIC is enabled. If the switch uses PoE for phones or access points, I also check the power budget with show power inline.

running-config lives in RAM and holds the active configuration, so every change applies immediately but is lost on reload. startup-config is stored in NVRAM and is loaded at boot. You save with copy running-config startup-config or write memory. To roll back unsaved changes you can reload without saving, which is why many engineers use reload in 10 before risky remote changes.

Situation: in college I set up the hostel Wi-Fi and LAN for 120 students. Task: fix constant drop-outs. Action: I learned VLANs, channel planning and DHCP, then practiced every CCNA topic in Packet Tracer and GNS3. Result: complaints dropped sharply, and I realised I enjoy solving real problems that affect many people. Networking underpins cloud, security and automation, so it gives me a long and growing career path.

Class A is 1 to 126 with a default /8, Class B is 128 to 191 with /16, Class C is 192 to 223 with /24, Class D 224 to 239 is multicast and Class E is reserved. RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 127.0.0.0/8 is loopback and 169.254.0.0/16 is APIPA link-local. Today addressing is classless (CIDR).

A /26 leaves 6 host bits, so 2 to the power 6 is 64 addresses and 62 usable hosts after removing network and broadcast. The mask is 255.255.255.192 and the block size is 256 minus 192, which is 64. So subnets of 192.168.1.0/26 start at .0, .64, .128 and .192. For 192.168.1.70/26 the network is .64 and broadcast .127.

IPv6 addresses are 128 bits written as eight groups of four hex digits separated by colons. Leading zeros in each group can be dropped, and one run of consecutive all-zero groups can be replaced with :: only once. For example 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1. A typical LAN uses a /64 prefix.

When a host needs the MAC for an IP on its subnet, it broadcasts an ARP request and the owner replies with a unicast ARP reply; the result is cached. For remote destinations the host ARPs for its default gateway. A gratuitous ARP is an unsolicited announcement of a host's own IP-to-MAC mapping, used after failover, for example by HSRP, to update switch and host tables.

169.254.x.x is an APIPA address, assigned when the host fails to get a DHCP lease. I would check that the port is up and in the correct VLAN, that the DHCP server has free addresses in the scope, and that the router interface for that VLAN has ip helper-address pointing to the server if the server is remote. Then I run ipconfig /renew and check server logs.

With a /26 the block size is 64, so 192.168.5.64 is the network address of the subnet .64 to .127 and cannot be assigned to a host or interface. IOS reports a bad mask or overlap error. Use a usable address such as 192.168.5.65 instead. Similarly .127 would be the broadcast. Always calculate the subnet boundary before configuring addresses.

Situation: in my first job, subnetting questions slowed me down during tickets. Task: get fast and accurate. Action: I practised ten random subnetting problems daily on a timer, memorised block sizes, and built my own spreadsheet for VLSM checks. I also reviewed real routing tables at work. Result: I solve most problems in under 30 seconds and now help juniors with IP planning during change reviews.

A VLAN is a logical Layer 2 broadcast domain created on a switch, independent of physical location. VLANs separate users, voice, guests and servers, reduce broadcast traffic, and improve security because traffic between VLANs must pass through a router or Layer 3 switch where it can be filtered. For example, finance and guest Wi-Fi users can share switches but stay isolated.

An access port belongs to one VLAN and carries untagged frames, typically to PCs, printers or servers. A trunk port carries traffic for many VLANs between switches, routers or hypervisors, adding an 802.1Q tag to identify each frame's VLAN, except the native VLAN which is sent untagged. Access ports can also carry a separate voice VLAN for IP phones.

802.1Q inserts a 4-byte tag after the source MAC in the Ethernet frame. The tag holds a 12-bit VLAN ID (1 to 4094 usable), 3 priority bits used by CoS for QoS, and a DEI bit. The tag is added when a frame leaves a trunk and removed at an access port. Older ISL encapsulation is obsolete; modern switches support only 802.1Q.

Hosts in different VLANs need a Layer 3 device to communicate. Options are: a router with one physical interface per VLAN (legacy), router-on-a-stick using one trunk with subinterfaces, or a Layer 3 switch with switched virtual interfaces (SVIs). SVIs are the most common in campuses because routing happens in hardware at line rate, with no single trunk bottleneck.

Situation: a senior manager was angry that his laptop lost network access before a client call. Task: fix it fast and calm him down. Action: I listened, gave a clear time estimate, found the port had been moved to a wrong VLAN in a recent change, corrected it and confirmed the call worked. Result: he was back online in ten minutes, and I added a port description check to our change process.

Redundant Layer 2 links create loops, and Ethernet frames have no TTL, so broadcasts circulate forever, causing broadcast storms, MAC table instability and duplicate frames. STP (802.1D) blocks redundant paths so there is one loop-free path to every switch, and unblocks a backup link if the active one fails. Without it, a single loop can take down a whole campus within seconds.

Switches exchange BPDUs and the one with the lowest bridge ID becomes root. The bridge ID is the priority (default 32768 plus the VLAN number in PVST) followed by the MAC address, so if priorities tie, the lowest MAC wins. Because the oldest switch often has the lowest MAC, you should set priority manually, for example spanning-tree vlan 10 root primary on the core.

EtherChannel bundles 2 to 8 physical links into one logical port-channel. STP sees it as one link, so all members forward instead of one being blocked. It adds bandwidth and redundancy, as one member failing does not drop the channel. Traffic is load-balanced per flow using a hash of MAC, IP or port fields, so a single flow still uses only one member link.

Situation: on a night shift I got a core link down alert, two user tickets and a printer issue at once. Task: handle everything with minimum impact. Action: I prioritised by business impact, confirmed redundancy had taken over for the core link, raised a priority ticket with the carrier, then fixed the user tickets and logged the printer for morning. Result: no SLA was breached and the handover was clear.

First it uses longest prefix match: the most specific matching prefix wins, so 10.1.1.0/24 beats 10.1.0.0/16. If the same prefix comes from different sources, the lowest administrative distance wins. If the same protocol offers several paths, the lowest metric wins, and equal metrics can be load-balanced with ECMP. Only the winners are installed in the routing table.

Connected 0, static 1, EIGRP summary 5, eBGP 20, internal EIGRP 90, OSPF 110, IS-IS 115, RIP 120, external EIGRP 170 and iBGP 200. A value of 255 means the route is never used. AD compares trust between sources, so a static route with AD 1 beats OSPF for the same prefix unless you configure a floating static with a higher AD.

The router ID is a 32-bit value chosen in this order: manually configured router-id, then the highest IP on an up loopback interface, then the highest IP on an up physical interface. It is chosen when the OSPF process starts, so changes need clear ip ospf process. Best practice is to set it manually so it is stable and easy to recognise in the database.

Situation: I joined a NOC that ran rotating shifts. Task: stay effective and keep handovers clean. Action: I followed runbooks, kept a shift log of every alert and action, raised early escalations for anything outside my scope and used quiet hours to lab new topics. Result: I handled shift incidents within SLA, earned positive feedback for clear handovers and was moved to the L2 team in a year.

DHCP uses the DORA process: the client broadcasts Discover, the server answers with an Offer, the client broadcasts a Request for that offer, and the server confirms with an Acknowledgement. The lease includes IP, mask, gateway, DNS servers and lease time. Clients renew at 50 percent of the lease. DHCP uses UDP ports 67 for the server and 68 for the client.

DHCP Discover is a broadcast, and routers do not forward broadcasts, so a central DHCP server cannot hear clients on other subnets. A relay agent, configured with ip helper-address on the gateway interface, converts the broadcast into a unicast to the server and adds the gateway IP so the server picks the right scope. This lets one server serve many VLANs.

Network Address Translation rewrites IP addresses as packets cross a router, usually private inside addresses to public outside ones. Static NAT maps one inside address to one public address, often for servers. Dynamic NAT maps from a pool. PAT, or NAT overload, maps many inside hosts to one public IP using unique source ports, and is what almost every office and home router uses.

NTP synchronises clocks over UDP 123 using a hierarchy of strata, where stratum 1 servers connect to an atomic or GPS clock. Correct time matters because syslog and incident timelines must line up across devices, certificates and authentication protocols check time, and logs are legal evidence. Devices can be NTP clients, servers or peers, and NTP authentication protects against fake time sources.

Syslog has eight levels from 0 to 7: emergency, alert, critical, error, warning, notification, informational and debugging. A useful memory line is Every Awesome Computer Engineer Will Need Ice cream Daily. Setting logging trap 6 sends levels 0 to 6 to the server. Syslog uses UDP 514 by default, and logs should carry timestamps with service timestamps log datetime msec.

Situation: DHCP failed for 300 users at 9 a.m. on a Monday. Task: restore service while keeping managers updated. Action: I stayed calm, followed the bottom-up method, found the DHCP server's scope was full after a lease time change, extended the scope and shortened leases. I sent updates every 15 minutes. Result: users were back in 30 minutes, and we added scope utilisation alerts to monitoring.

A security program combines user awareness training, physical access control, and technical controls such as strong authentication, firewalls, IPS, VPNs and patching. It is built around the CIA triad: confidentiality, integrity and availability. Policies define what is allowed, and logging and monitoring detect problems. CCNA focuses on device hardening, ACLs, Layer 2 security, AAA, VPNs and wireless security.

Standard ACLs (1 to 99 and 1300 to 1999) match only the source IP, so they should be placed close to the destination. Extended ACLs (100 to 199 and 2000 to 2699) match protocol, source, destination and ports, so they can be placed close to the source to drop unwanted traffic early. Named ACLs work for both and allow editing individual lines by sequence number.

ACL entries are checked top-down and the first match decides permit or deny; later lines are ignored. Every ACL ends with an invisible deny any, so traffic that matches no line is dropped. Therefore specific entries must come before general ones, and an ACL with only deny statements blocks everything. Always add a permit for allowed traffic and test after applying.

Use enable secret, not enable password, so the hash is strong (type 8 or 9 on modern IOS). Create local users with secret, enforce minimum length with security passwords min-length, and use AAA with TACACS+ for central control. Disable Telnet, use SSH v2, set exec-timeout on lines, and add login block-for to slow brute force. Avoid type 7 passwords, which are easily reversed.

I run show interfaces status err-disabled and show errdisable recovery to see the cause, such as psecure-violation, bpduguard or link-flap. If it is port security, the user may have plugged in a small switch or a docking station with an extra MAC, so I check show port-security interface. I fix the cause, then shut and no shut the port, or set the max MAC count appropriately.

Situation: as a fresher I realised many interview questions asked about recent attacks. Task: build a habit of learning. Action: I follow vendor security advisories, CERT-In alerts and a few security newsletters, practise in a home lab with packet captures, and read the release notes of devices we use. Result: I can explain current threats in interviews and suggested patching a vulnerable IOS version in my internship.

802.11n (Wi-Fi 4) works on 2.4 and 5 GHz with MIMO. 802.11ac (Wi-Fi 5) is 5 GHz only with wider channels and MU-MIMO downlink. 802.11ax (Wi-Fi 6 and 6E) adds OFDMA, BSS colouring and target wake time, and 6E adds the 6 GHz band. 802.11be (Wi-Fi 7) adds 320 MHz channels and multi-link operation. India opened part of the 6 GHz band for indoor use.

In 2.4 GHz each channel is about 22 MHz wide but channels are only 5 MHz apart, so most adjacent channels overlap and interfere. Channels 1, 6 and 11 are the only three non-overlapping channels, so neighbouring access points should alternate between them. The 5 GHz band has many more non-overlapping 20 MHz channels, which is why it is preferred for capacity.

The SSID is the network name users see. The BSSID is the MAC address of the access point radio serving a BSS, the basic service set of one AP and its clients. An ESS is multiple BSSs sharing the same SSID connected by a wired distribution system, so clients can roam between APs. Each AP can broadcast several SSIDs, each with its own BSSID.

The data plane forwards packets, using tables such as the FIB and MAC table, ideally in hardware. The control plane builds those tables using protocols like OSPF, STP and ARP. The management plane is how admins and tools interact with the device, through SSH, SNMP, syslog and APIs. Separating them helps understanding of SDN, where the control plane can be centralised.

A REST API exposes resources at URLs and is stateless, usually with JSON payloads over HTTPS. CRUD maps to HTTP verbs: POST creates, GET reads, PUT replaces or PATCH partly updates, and DELETE removes. Responses use status codes such as 200 OK, 201 Created, 401 Unauthorized, 404 Not Found and 500 Server Error. Controllers expose northbound REST APIs for automation.

Situation: I started with CCNA and a support role. Task: build a clear path. Action: I plan to master routing, switching and wireless in the next two years, pass CCNP Enterprise, and build automation skills in Python and Ansible alongside cloud networking. Result I aim for: a network engineer or architect role leading campus and SD-WAN projects, mentoring juniors and owning designs end to end.