40 questions with answers for candidates with 10+ years of experience — 8 medium, 32 hard.
What interviewers expect: 10 years experience
At ten years, interviews are for architect or network manager roles. Expect discussion of network strategy, SD-WAN and cloud connectivity, security frameworks, automation roadmaps, capacity planning and service levels. You will be judged on how you balance cost, risk and uptime, and how you build and lead teams, more than on individual commands.
This set is weighted towards STP and EtherChannel (10), Wireless and Automation (6), Network Security (6), Switching and VLANs (5).
Network strategy and roadmaps Cloud and SD-WAN connectivity Risk and capacity planning Team building
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
A Python script gets 401 errors when calling a controller REST API. What do you check?
401 Unauthorized means authentication failed. I check the username and password or API key, whether a token must first be requested from an auth endpoint and sent in a header like X-Auth-Token, whether the token expired, and the exact header name and format. I test the same call with curl or an API client to separate script bugs from credential issues.
02
What are the default STP path costs for common link speeds?
With short (802.1D revised) costs: 10 Mbps is 100, 100 Mbps is 19, 1 Gbps is 4 and 10 Gbps is 2. With the long pathcost method, 1 Gbps is 20000 and 10 Gbps is 2000, which distinguishes higher speeds. Root path cost is the sum of costs on ports toward the root, and the lowest total wins when choosing root ports.
WPA2 uses AES-CCMP; WPA2-Personal uses a pre-shared key that is vulnerable to offline dictionary attacks, and WPA2-Enterprise uses 802.1X with RADIUS. WPA3-Personal replaces PSK with SAE, which resists offline guessing and gives forward secrecy. WPA3-Enterprise offers a 192-bit mode. WPA3 requires protected management frames. Open networks can use OWE for encryption without passwords.
802.1X lets a switch or access point block a port until the user or device authenticates. The supplicant is the client, the authenticator is the switch or AP, and the authentication server is a RADIUS server. EAP messages are carried over the LAN as EAPoL and then inside RADIUS. On success the RADIUS server can assign a VLAN or ACL. MAB is a fallback for devices without supplicants.
Make members routed ports first, then put the IP on the port-channel.
interface range TenGigabitEthernet1/1/1 - 2
no switchport
channel-group 10 mode active
interface Port-channel10
no switchport
ip address 10.0.0.1 255.255.255.252
show etherchannel 10 summary
show ip interface brief
06
After adding a second internet router, some sessions break at the stateful firewall because return traffic uses the other exit. How do you fix it?
This is asymmetric routing: the firewall sees only one direction of the flow and drops it. Make the path symmetric by using one active exit per prefix, for example HSRP or a higher OSPF default-route cost on the backup, and advertise inbound routes consistently with the same preference. If both links must be active, pair the firewalls with state sharing or use NAT per exit so return traffic comes back to the router that sent it.
The underlay is the physical IP network of switches and routers that provides basic reachability, for example OSPF or IS-IS on routed links. The overlay is a virtual network built on top using tunnels such as VXLAN, so logical segments can stretch across the fabric independent of physical topology. SD-Access and SD-WAN use this model, with a fabric controlling the overlay.
08
What is UDLD and why is it important on fiber links?
UniDirectional Link Detection sends probes to confirm a neighbour receives traffic in both directions. On fiber, one strand can fail so a port receives but cannot send, which may make STP unblock a port and create a loop. UDLD normal mode logs and marks the port, while aggressive mode err-disables it. It is commonly enabled on fiber uplinks together with Loop Guard.
09
How would you redesign a flat network where 600 users sit in VLAN 1?
I would split users into VLANs by function or floor, each with a /24 or smaller, put voice, wireless, printers, servers and management in their own VLANs, and route between them on a Layer 3 core with SVIs. DHCP scopes and helper addresses would be added per VLAN. I would migrate in phases with a rollback plan and move VLAN 1 out of use for both users and the native VLAN.
10
Users complain Wi-Fi is slow in a conference room with 60 people. What do you check and fix?
This is usually a capacity, not a coverage, issue. I check client count per AP and channel utilisation on the controller. Fixes include adding APs with lower transmit power, steering clients to 5 or 6 GHz with band steering, disabling low data rates such as 1, 2 and 5.5 Mbps, using 20 or 40 MHz channels in dense areas, and limiting per-client bandwidth on the SSID.
11
How do you make an access switch port a routed port on a Layer 3 switch?
A routed port behaves like a router interface and does not belong to any VLAN.
interface GigabitEthernet1/0/1
no switchport
ip address 10.0.0.1 255.255.255.252
no shutdown
Routed uplinks between distribution and core avoid spanning tree on those links and allow fast routing convergence with ECMP.
12
During a merger both companies use 10.0.0.0/16. How do you allow them to communicate?
Overlapping address space means routing alone cannot work. Short term, use NAT on the interconnect so each side sees the other as a different translated range, for example twice NAT or policy NAT. Long term, renumber one network into a free range, which is cleaner but needs planning for DHCP, DNS, firewall rules and static IPs. I would also document the IP address management plan to prevent repeats.
Rapid PVST+ runs 802.1w per VLAN. It uses a proposal and agreement handshake on point-to-point links so ports move to forwarding in under a second, instead of waiting on timers. It has port roles root, designated, alternate and backup, and states discarding, learning and forwarding. Alternate ports provide an instant backup root port. It is the default on most modern IOS switches.
A private VLAN splits one VLAN into a primary VLAN and secondary VLANs. Isolated ports can talk only to promiscuous ports such as the gateway, while community ports can talk to each other and to promiscuous ports. It is used in hosting, DMZs and hotel networks to isolate customers on the same subnet without creating many subnets. It requires VTP transparent mode or VTP v3.
15
How do you configure inter-VLAN routing on a Layer 3 switch with SVIs?
Enable routing and create an SVI per VLAN as the gateway.
ip routing
interface vlan 10
ip address 192.168.10.1 255.255.255.0
ip helper-address 10.0.0.50
no shutdown
interface vlan 20
ip address 192.168.20.1 255.255.255.0
no shutdown
show ip route connected
16
After a core switch replacement, ping works across the campus but large file transfers and some VPN sessions hang. What do you suspect?
Suspect an MTU mismatch. Small pings fit in one frame, but full-size packets are dropped when one link or the new switch uses a smaller MTU, or when ICMP is blocked so Path MTU Discovery fails. Test with ping using a size of 1472 and the do-not-fragment bit, compare interface MTU on both ends, and check jumbo frame settings. Fix by matching MTU end to end or adjusting TCP MSS on tunnel interfaces.
17
Traffic is not load balancing across two equal links even though both are in OSPF. What do you check?
Both paths must have equal total cost to be installed as ECMP. I check show ip route for two next hops. If only one shows, I compare interface costs, which differ if bandwidth or the reference bandwidth differs. I also check maximum-paths. Even with ECMP, load sharing is per flow using CEF, so a single large flow uses one link only.
18
A 4 x 1G EtherChannel to a server shows one link at 95 percent and others nearly idle. Why?
Load balancing is per flow based on a hash. If the method is src-mac and most traffic comes from one router MAC, all flows hash to one link. I change port-channel load-balance to src-dst-ip or src-dst-mixed-ip-port so many flows spread across members. If the traffic is a single large flow, it can never exceed one member, so faster links would be needed.
Set interface priority; higher wins and 0 never becomes DR.
interface GigabitEthernet0/0
ip ospf priority 255
! on a router that should never be DR
interface GigabitEthernet0/0
ip ospf priority 0
clear ip ospf process
Because election is non-preemptive, reset the process or the neighbours for the change to take effect.
20
Your company is adding a new branch with 40 users. What network components would you propose?
A branch router or SD-WAN edge for the WAN link and internet, one or two 48-port PoE access switches for PCs, phones and access points, and wireless access points managed by a controller or the cloud. I would add a firewall function, DHCP and DNS settings, VLANs for data, voice, guest and management, and a backup 4G or broadband link for resilience.
21
Voice calls are choppy during office hours when the WAN link is busy. How do you fix it?
Choppy voice under load means congestion on the WAN. I make sure phones mark RTP as EF and the access switches trust phone markings, then on the WAN router create a policy with a low latency priority queue for EF limited to the needed bandwidth, CBWFQ for other classes, and shaping to the real carrier rate so queuing happens on my router, not the provider's.
22
A security scan shows that switch and router management interfaces are reachable from user VLANs. How do you lock down management access?
Move management to a dedicated VLAN or out-of-band network, ideally in a management VRF. Apply an access-class ACL on VTY lines allowing only the jump host subnet, disable Telnet and HTTP, keep SSH version 2 and HTTPS only if needed, and use AAA with TACACS+ for per-user login and logging. Add control plane policing, block management subnets at the user VLAN gateways and rescan to confirm the fix.
23
Users report short outages every few minutes and logs show topology changes. How do you troubleshoot?
Frequent TCNs flush MAC tables and cause flooding. I run show spanning-tree detail to find the port and switch originating topology changes, then follow it hop by hop. Common causes are a flapping link, a host port without PortFast that changes state each time a PC reboots, or a failing NIC. I fix the link and enable PortFast on edge ports so they do not generate TCNs.
IPsec uses IKE (v1 or v2) to authenticate peers and negotiate keys, ESP to encrypt and authenticate data, and optionally AH for authentication only, which breaks with NAT. Algorithms include AES for encryption, SHA-256 for integrity and Diffie-Hellman groups for key exchange. Tunnel mode encrypts the whole original packet and is used for site-to-site VPNs.
25
Tell me about a time a change you approved caused an outage. What did you do and what changed afterwards?
Situation: I approved a change that set a new root bridge priority, but the engineer applied it on the wrong switch and the campus reconverged during business hours. Task: restore service and find the gap. Action: we rolled back in ten minutes, informed users and ran a blameless review. Result: we added device name checks to the change template, peer review of exact commands and a maintenance window rule for any STP change. There was no repeat incident that year.
26
How do you configure NTP, syslog and SNMPv3 on a device?
First stop the job, then recover through out-of-band console or a management network, using configuration archive rollback or a saved backup. In future, run changes with commit confirmed or reload in as a safety timer, test in a lab, use a dry run or check mode, deploy to one canary switch, then in small batches with automatic post-checks. Store templates in Git with peer review so every change is visible and reversible.
28
Your manager wants to stop configuring 200 switches manually. What would you propose?
I would start with a source of truth for devices and variables, then use Ansible playbooks with Jinja2 templates to generate and push standard configs over SSH, keeping them in Git with peer review. A controller such as Catalyst Center could handle day-0 provisioning and compliance. I would start with read-only tasks like backups and audits, then move to small, tested change automation.
Root Guard on a designated port puts it into root-inconsistent state if a superior BPDU arrives, protecting the planned root bridge, so it is used on distribution ports facing access switches. Loop Guard stops a non-designated port from becoming designated when BPDUs stop arriving, such as with a unidirectional fiber fault. UDLD complements Loop Guard by detecting one-way links.
Multiple Spanning Tree (802.1s) maps many VLANs to a small number of STP instances, so a switch does not run one instance per VLAN as PVST does. Switches in the same MST region must share the name, revision and VLAN-to-instance mapping. It suits large networks with hundreds of VLANs and multi-vendor environments, and supports load sharing by making different instances root on different switches.
NDP uses ICMPv6 messages. A host sends a Neighbor Solicitation to the target's solicited-node multicast address (ff02::1:ffXX:XXXX) and gets a Neighbor Advertisement with the MAC. Router Solicitation and Router Advertisement messages provide prefix and gateway. Duplicate Address Detection uses NS to check that an address is unique. Using multicast instead of broadcast reduces load on other hosts.
Enable per VLAN, trust uplinks and rate-limit user ports.
ip dhcp snooping
ip dhcp snooping vlan 10,20
no ip dhcp snooping information option
ip arp inspection vlan 10,20
interface GigabitEthernet1/0/48
ip dhcp snooping trust
ip arp inspection trust
interface range Gi1/0/1 - 46
ip dhcp snooping limit rate 15
show ip dhcp snooping binding
33
What is the MAC address table and what happens when it is full?
The MAC address table, stored in CAM, maps MAC addresses to ports and VLANs. When it fills, as in a MAC flooding attack, new addresses cannot be learned and the switch floods unknown unicast frames out of all ports in the VLAN, which lets an attacker sniff traffic. Port security limiting MACs per port prevents this.
34
Tell me about a time you had to learn a new technology quickly.
Situation: our team moved from PVST to MST for a data center with 600 VLANs, and I had not used MST. Task: be ready for the migration in two weeks. Action: I read the configuration guides, built the design in a GNS3 lab, broke it deliberately and wrote a step-by-step checklist. Result: the migration ran in one window without outage, and I ran a short knowledge session for the team.
35
How do you configure AAA with TACACS+ and a local fallback?
Define the server, then method lists with local as backup.
aaa new-model
tacacs server ISE1
address ipv4 10.0.0.60
key Tac@csKey1
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting commands 15 default start-stop group tacacs+
username breakglass privilege 15 secret L0calOnly!
36
Tell me about a time you led a network migration or a major change.
Situation: our office had to move 300 users from old access switches to a new stack in one weekend. Task: I owned the plan. Action: I documented every port, pre-built configs, ran a pilot on one floor, wrote a rollback plan and kept a call bridge open with the desktop team. Result: we finished two hours early with only three port issues, fixed on Monday morning. I learned that a tested rollback plan gives the whole team confidence.
37
How would you plan an IP addressing scheme for a company with 10 branches?
I would reserve a large block, for example 10.0.0.0/16, and give each branch a summarizable /20 such as 10.0.16.0/20, 10.0.32.0/20 and so on. Inside each, assign fixed ranges per role: users, voice, wireless, servers, management and WAN links. This lets each branch be summarized as one route, keeps firewall rules simple, and leaves room to grow. I keep it in an IPAM tool.
38
What is the difference between policing and shaping?
Policing drops or re-marks traffic that exceeds a rate immediately, with no buffering, so it causes TCP retransmissions; it is used inbound or by ISPs. Shaping buffers excess traffic and sends it later, smoothing bursts to a configured rate at the cost of delay; it is used outbound, for example to match a 100 Mbps subscription on a 1 Gbps port.
39
Auditors find that network devices use shared admin passwords and Telnet. What is your remediation plan?
Disable Telnet with transport input ssh, enable SSH v2, and move admin login to AAA with TACACS+ so each engineer has a personal account with command authorisation and accounting logs. Keep one local fallback account in a password vault. Restrict VTY access with an ACL to the management subnet. Roll out with automation, test on a pilot, then document it for the audit.
40
A route you expect from OSPF is in the OSPF database but not in the routing table. Why?
Another source with a lower AD may be providing the same prefix, such as a static route, so the OSPF route is not installed. Or a more specific route wins by longest match. The next hop may also be unreachable, or a distribute-list may filter it. I check show ip route for the prefix, show ip ospf database, and compare administrative distances.
Frequently asked questions
What is asked in CCNA interviews for 10+ years of experience?
At ten years, interviews are for architect or network manager roles. Expect discussion of network strategy, SD-WAN and cloud connectivity, security frameworks, automation roadmaps, capacity planning and service levels. You will be judged on how you balance cost, risk and uptime, and how you build and lead teams, more than on individual commands.
How many questions should I practise before a CCNA interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 10+ years of experience?
Focus first on Network strategy and roadmaps, Cloud and SD-WAN connectivity, Risk and capacity planning, Team building.