40 questions with answers for candidates with 2 years of experience — 11 easy, 26 medium, 3 hard.
What interviewers expect: 2 years experience
At two years, you are expected to handle changes, not only tickets. Expect questions on configuring trunks, EtherChannel, HSRP, ACLs, NAT and port security, planning maintenance windows and writing rollback steps. Interviewers also ask about monitoring with SNMP and syslog and how you work with telecom providers on WAN circuits.
This set is weighted towards Network Fundamentals (9), Routing and OSPF (6), IP Addressing and Subnetting (6), STP and EtherChannel (5).
Change planning and rollback EtherChannel and HSRP ACLs and NAT Monitoring and logging
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
A PC can ping its default gateway but cannot open any website. How would you troubleshoot?
Gateway reachability proves Layers 1 to 3 locally, so I move upward. I ping a public IP address; if that works but names fail, DNS is the problem, so I check the configured DNS server with ipconfig /all and test with nslookup. If the public IP also fails, I check the router's default route, NAT and upstream link. Finally I check proxy settings and any firewall blocking ports 80 and 443.
02
Traffic is taking a slow path because an old access switch became root bridge. How do you fix it?
The old switch has the lowest MAC with default priority, so it won the election. I set the core or distribution switch as root with spanning-tree vlan 1-4094 priority 4096, or root primary, and the secondary with 8192. I add Root Guard on distribution downlinks so access switches can never become root again. Then I verify with show spanning-tree root.
03
Compare distance vector and link state routing protocols.
Distance vector protocols like RIP share their routing table with neighbours and trust what they hear, so they converge slowly and need loop prevention such as split horizon. Link state protocols like OSPF and IS-IS flood link state advertisements so each router builds a full topology map and runs Dijkstra's SPF algorithm. Link state converges faster and scales better but uses more memory and CPU.
04
Describe a situation where you had to explain a technical issue to a non-technical manager.
Situation: a routing loop during a carrier change caused a two-hour outage and the operations head wanted an explanation. Task: explain cause and prevention simply. Action: I used a road map analogy, explained that two routers kept sending traffic to each other, showed the timeline and our fix, and listed three prevention steps with dates. Result: management approved a proper change review board, and trust in our team improved.
05
What is the difference between a hub, a switch and a router?
A hub is a Layer 1 repeater: it floods every bit out of every port, so all ports share one collision domain. A switch is Layer 2: it learns MAC addresses and forwards frames only to the correct port, giving each port its own collision domain. A router is Layer 3: it forwards packets between IP networks and separates broadcast domains.
06
A 4 x 1G EtherChannel to a server shows one link at 95 percent and others nearly idle. Why?
Load balancing is per flow based on a hash. If the method is src-mac and most traffic comes from one router MAC, all flows hash to one link. I change port-channel load-balance to src-dst-ip or src-dst-mixed-ip-port so many flows spread across members. If the traffic is a single large flow, it can never exceed one member, so faster links would be needed.
07
How do you use CDP and LLDP to discover neighbours?
CDP is a proprietary Layer 2 discovery protocol enabled by default on IOS; LLDP is the open IEEE 802.1AB standard.
show cdp neighbors
show cdp neighbors detail
configure terminal
lldp run
show lldp neighbors detail
Detail output shows the neighbour's IP, platform and port. Disable CDP on internet-facing ports with no cdp enable.
RFC 3021 allows /31 on point-to-point links because there is no need for network and broadcast addresses when only two devices exist. A /31 gives exactly two usable addresses, saving half the space of a /30. It is common on ISP and data center fabric links. Both ends must support it; on IOS you simply configure ip address 10.0.0.0 255.255.255.254.
The router ID is a 32-bit value chosen in this order: manually configured router-id, then the highest IP on an up loopback interface, then the highest IP on an up physical interface. It is chosen when the OSPF process starts, so changes need clear ip ospf process. Best practice is to set it manually so it is stable and easy to recognise in the database.
10
Tell me about a time you solved a difficult network outage.
Situation: a branch lost access to the data center during month-end close. Task: restore service fast. Action: I worked bottom-up, found the WAN link up but OSPF stuck in EXSTART, and traced it to an MTU change by the provider. I set ip ospf mtu-ignore as a temporary fix and raised a ticket for the MTU. Result: service was back in 25 minutes and I documented the check in our runbook.
11
What is the difference between a two-tier and a three-tier campus design?
A three-tier design has access, distribution and core layers: access connects users, distribution aggregates access switches and applies policy, and the core provides fast transport between distribution blocks. A two-tier or collapsed-core design merges core and distribution, which suits small and medium campuses with fewer buildings. Three-tier scales better when there are many distribution blocks.
Mark interfaces, match inside hosts with an ACL and overload the outside interface.
interface GigabitEthernet0/1
ip nat inside
interface GigabitEthernet0/0
ip nat outside
access-list 1 permit 192.168.0.0 0.0.255.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
show ip nat translations
13
What is the difference between autonomous APs, controller-based APs and cloud-managed APs?
Autonomous APs are configured one by one and suit very small sites. Lightweight APs are managed by a Wireless LAN Controller using CAPWAP tunnels, which centralises configuration, RF management and roaming, and suits campuses. Cloud-managed APs are configured from a cloud dashboard, ideal for many branches. Split-MAC means real-time functions stay on the AP while management sits on the controller.
14
What is UDLD and why is it important on fiber links?
UniDirectional Link Detection sends probes to confirm a neighbour receives traffic in both directions. On fiber, one strand can fail so a port receives but cannot send, which may make STP unblock a port and create a loop. UDLD normal mode logs and marks the port, while aggressive mode err-disables it. It is commonly enabled on fiber uplinks together with Loop Guard.
15
How do you keep your subnetting skills sharp for interviews and work?
Situation: in my first job, subnetting questions slowed me down during tickets. Task: get fast and accurate. Action: I practised ten random subnetting problems daily on a timer, memorised block sizes, and built my own spreadsheet for VLSM checks. I also reviewed real routing tables at work. Result: I solve most problems in under 30 seconds and now help juniors with IP planning during change reviews.
16
What is inter-VLAN routing and what are the ways to do it?
Hosts in different VLANs need a Layer 3 device to communicate. Options are: a router with one physical interface per VLAN (legacy), router-on-a-stick using one trunk with subinterfaces, or a Layer 3 switch with switched virtual interfaces (SVIs). SVIs are the most common in campuses because routing happens in hardware at line rate, with no single trunk bottleneck.
Physical ports include service ports for out-of-band management, distribution system ports that connect to the switch as trunks, and redundancy ports for HA. Logical interfaces include the management interface used for CAPWAP and admin access, dynamic interfaces that map WLANs to VLANs, and a virtual interface used for web auth and DHCP relay. A LAG bundles distribution ports.
Configure the same group and virtual IP on both switches, with higher priority on the active one.
interface vlan 10
ip address 192.168.10.2 255.255.255.0
standby version 2
standby 10 ip 192.168.10.1
standby 10 priority 110
standby 10 preempt
show standby brief
Hosts use 192.168.10.1 as their gateway.
Set a router ID, enable OSPF on interfaces and make user ports passive.
router ospf 1
router-id 1.1.1.1
auto-cost reference-bandwidth 100000
passive-interface GigabitEthernet0/1
network 10.0.12.0 0.0.0.3 area 0
network 192.168.1.0 0.0.0.255 area 0
default-information originate
Or per interface: ip ospf 1 area 0
20
What is SLAAC and how is it different from DHCPv6?
With SLAAC a host learns the /64 prefix from a router advertisement and builds its own interface ID, without a server. Stateless DHCPv6 adds extra options such as DNS while the address still comes from SLAAC. Stateful DHCPv6 assigns the address itself and keeps bindings, similar to DHCPv4. RA flags M (managed) and O (other config) tell hosts which method to use.
21
What is port security and what are its violation modes?
Port security limits the MAC addresses allowed on an access port, either statically or by sticky learning. If an extra MAC appears, the violation mode acts: shutdown (default) err-disables the port, restrict drops the frames, logs and increments a counter, and protect silently drops frames. It stops MAC flooding and unauthorised devices on user ports.
Control and Provisioning of Wireless Access Points is the protocol between lightweight APs and the WLC. It builds two tunnels: a control tunnel on UDP 5246, encrypted with DTLS, and a data tunnel on UDP 5247 that carries client traffic in central switching mode. In FlexConnect or local switching mode, client data is switched locally at the AP instead of being tunnelled.
23
A user complains the network is slow and the switch port shows many late collisions and CRC errors. What do you check?
Late collisions usually mean a duplex mismatch, and CRC errors point to bad cabling or interference. I would run show interfaces on the port to see duplex, speed and error counters, check the PC NIC settings, and set both sides to auto or hard-code both identically. Then I would replace the patch cable, clear counters and watch whether errors still increase.
24
How many usable hosts are in a /26 subnet and what is the block size?
A /26 leaves 6 host bits, so 2 to the power 6 is 64 addresses and 62 usable hosts after removing network and broadcast. The mask is 255.255.255.192 and the block size is 256 minus 192, which is 64. So subnets of 192.168.1.0/26 start at .0, .64, .128 and .192. For 192.168.1.70/26 the network is .64 and broadcast .127.
A floating static route is a backup static route with a higher administrative distance than the primary route, so it stays out of the routing table until the primary disappears. For example, if OSPF (AD 110) learns the main path, ip route 0.0.0.0 0.0.0.0 203.0.113.1 200 installs only when OSPF loses the route. It is common for backup internet or 4G links.
The SSID is the network name users see. The BSSID is the MAC address of the access point radio serving a BSS, the basic service set of one AP and its clients. An ESS is multiple BSSs sharing the same SSID connected by a wired distribution system, so clients can roam between APs. Each AP can broadcast several SSIDs, each with its own BSSID.
27
A new VLAN's users do not get DHCP addresses, but other VLANs work. What do you check?
I check that the SVI for the new VLAN is up and has ip helper-address pointing to the DHCP server, that the server has a scope for that subnet with the right gateway, and that the scope is activated. I confirm the VLAN is allowed on trunks. If DHCP snooping is enabled, I check the uplink is trusted, otherwise offers from the server are dropped.
28
What are the IPv4 address classes and private ranges?
Class A is 1 to 126 with a default /8, Class B is 128 to 191 with /16, Class C is 192 to 223 with /24, Class D 224 to 239 is multicast and Class E is reserved. RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 127.0.0.0/8 is loopback and 169.254.0.0/16 is APIPA link-local. Today addressing is classless (CIDR).
Network Address Translation rewrites IP addresses as packets cross a router, usually private inside addresses to public outside ones. Static NAT maps one inside address to one public address, often for servers. Dynamic NAT maps from a pool. PAT, or NAT overload, maps many inside hosts to one public IP using unique source ports, and is what almost every office and home router uses.
30
Your company is adding a new branch with 40 users. What network components would you propose?
A branch router or SD-WAN edge for the WAN link and internet, one or two 48-port PoE access switches for PCs, phones and access points, and wireless access points managed by a controller or the cloud. I would add a firewall function, DHCP and DNS settings, VLANs for data, voice, guest and management, and a backup 4G or broadband link for resilience.
A VLAN is a logical Layer 2 broadcast domain created on a switch, independent of physical location. VLANs separate users, voice, guests and servers, reduce broadcast traffic, and improve security because traffic between VLANs must pass through a router or Layer 3 switch where it can be filtered. For example, finance and guest Wi-Fi users can share switches but stay isolated.
Dynamic Trunking Protocol negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access. Auto plus auto stays access, while desirable with auto or desirable forms a trunk. Attackers can use DTP to form a trunk and reach all VLANs, so best practice is to hard-code access or trunk and use switchport nonegotiate on trunks.
Single-mode fiber has a small core (about 9 microns) and uses a laser, so it carries light over long distances, often 10 km or more. Multimode fiber has a larger core (50 or 62.5 microns), uses cheaper LED or VCSEL optics and suits shorter runs inside a building or data center, usually up to a few hundred metres at 10 Gbps. SFP modules must match the fiber type.
34
What is a REST API and which HTTP methods map to CRUD?
A REST API exposes resources at URLs and is stateless, usually with JSON payloads over HTTPS. CRUD maps to HTTP verbs: POST creates, GET reads, PUT replaces or PATCH partly updates, and DELETE removes. Responses use status codes such as 200 OK, 201 Created, 401 Unauthorized, 404 Not Found and 500 Server Error. Controllers expose northbound REST APIs for automation.
A voice VLAN lets an IP phone and a PC share one switch port while keeping their traffic separate. The port is an access port in the data VLAN, and the switch tells the phone through CDP or LLDP-MED to tag voice frames with the voice VLAN. This allows QoS priority for voice and separate addressing. Configure it with switchport voice vlan.
36
A broadcast storm brought the network down after someone connected a cable between two wall ports. How do you prevent this?
Two wall ports patched to the same switch formed a loop. To stop it now, I find the port with rising broadcast counters and shut it. To prevent repeats, enable PortFast with BPDU Guard on all access ports, keep Rapid PVST+ running everywhere, add storm-control broadcast thresholds on access ports and enable errdisable recovery with a sensible interval.
37
Which commands would you use to test end-to-end reachability and find where packets stop?
ping tests reachability and round-trip time, and traceroute shows each Layer 3 hop.
R1# ping 10.2.2.2 source Loopback0
R1# traceroute 10.2.2.2
PC> tracert 10.2.2.2
An extended ping lets you set source, size and the DF bit to test MTU. Where traceroute shows asterisks, that hop is dropping or filtering ICMP.
38
What is the native VLAN and what problems can a mismatch cause?
The native VLAN is the VLAN whose frames cross a trunk untagged, VLAN 1 by default. Both ends must use the same native VLAN; if they differ, frames leak between VLANs and CDP logs a native VLAN mismatch. For security, set the native VLAN to an unused ID, do not put users in it, and optionally tag it with vlan dot1q tag native to prevent VLAN hopping.
39
An EtherChannel shows members in suspended state. What do you check?
Suspended (s) usually means a configuration mismatch between members or with the far end. I compare speed, duplex, trunk mode, native VLAN and allowed VLANs on each member and the port-channel with show run interface, check LACP modes on both sides, and look at logs. I fix the config on the port-channel, then shut and no shut members so they rejoin. show etherchannel summary should show P flags.
40
A newly configured router interface rejects the IP 192.168.5.64/26. Why?
With a /26 the block size is 64, so 192.168.5.64 is the network address of the subnet .64 to .127 and cannot be assigned to a host or interface. IOS reports a bad mask or overlap error. Use a usable address such as 192.168.5.65 instead. Similarly .127 would be the broadcast. Always calculate the subnet boundary before configuring addresses.
Frequently asked questions
What is asked in CCNA interviews for 2 years of experience?
At two years, you are expected to handle changes, not only tickets. Expect questions on configuring trunks, EtherChannel, HSRP, ACLs, NAT and port security, planning maintenance windows and writing rollback steps. Interviewers also ask about monitoring with SNMP and syslog and how you work with telecom providers on WAN circuits.
How many questions should I practise before a CCNA interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 2 years of experience?
Focus first on Change planning and rollback, EtherChannel and HSRP, ACLs and NAT, Monitoring and logging.