40 questions with answers for candidates with 3 years of experience — 4 easy, 27 medium, 9 hard.
What interviewers expect: 3 years experience
Three-year interviews move to design and root cause analysis. Expect STP root placement, OSPF areas and cost tuning, VLSM plans for new sites, QoS for voice and secure management access. You should explain past outages, what caused them and what you changed so they did not repeat. Basic Python or Ansible exposure is a plus.
This set is weighted towards Routing and OSPF (8), IP Services (7), Wireless and Automation (6), IP Addressing and Subnetting (6).
Campus and branch design OSPF tuning QoS basics Root cause analysis
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Rapid PVST+ runs 802.1w per VLAN. It uses a proposal and agreement handshake on point-to-point links so ports move to forwarding in under a second, instead of waiting on timers. It has port roles root, designated, alternate and backup, and states discarding, learning and forwarding. Alternate ports provide an instant backup root port. It is the default on most modern IOS switches.
A floating static route is a backup static route with a higher administrative distance than the primary route, so it stays out of the routing table until the primary disappears. For example, if OSPF (AD 110) learns the main path, ip route 0.0.0.0 0.0.0.0 203.0.113.1 200 installs only when OSPF loses the route. It is common for backup internet or 4G links.
VLAN Trunking Protocol shares VLAN definitions from a server switch to clients in the same VTP domain. Modes are server, client, transparent and off. The risk is that a switch with a higher configuration revision number can overwrite and wipe VLANs across the domain. Many networks use transparent mode or VTP version 3 with a primary server to avoid this.
04
Describe a time you disagreed with a senior engineer about a network design. How did you handle it?
Situation: a senior engineer wanted static routes for twelve new branches. Task: I believed OSPF would scale better. Action: instead of arguing in the meeting, I built both options in a lab, measured failover time and listed the change effort for each. I shared the results privately first. Result: we agreed on OSPF with summarization at the hub, and he asked me to write the standard. I learned that data persuades better than opinions.
Enable per VLAN, trust uplinks and rate-limit user ports.
ip dhcp snooping
ip dhcp snooping vlan 10,20
no ip dhcp snooping information option
ip arp inspection vlan 10,20
interface GigabitEthernet1/0/48
ip dhcp snooping trust
ip arp inspection trust
interface range Gi1/0/1 - 46
ip dhcp snooping limit rate 15
show ip dhcp snooping binding
DAI checks ARP packets on untrusted ports against the DHCP snooping binding table and drops ARP replies whose IP-to-MAC mapping does not match. This stops ARP spoofing and man-in-the-middle attacks where an attacker claims to be the default gateway. Static hosts need ARP ACLs. It requires DHCP snooping enabled in the same VLAN and trusted uplink ports.
07
How do you configure IPv4 static and default routes?
Use a next-hop IP, an exit interface, or both.
ip route 10.2.0.0 255.255.0.0 192.168.12.2
ip route 0.0.0.0 0.0.0.0 203.0.113.1
! floating backup with AD 200
ip route 0.0.0.0 0.0.0.0 198.51.100.1 200
! IPv6
ipv6 route ::/0 2001:db8:12::2
show ip route static
08
Tell me about a time you automated or simplified a repetitive task.
Situation: our team manually backed up 80 router configs each week. Task: save time and avoid missed backups. Action: I enabled the archive feature with time-period on each device and later wrote a small Python script with Netmiko to pull and store configs in Git. Result: weekly effort dropped from four hours to zero, and we could see config differences after every change.
09
Voice calls are choppy during office hours when the WAN link is busy. How do you fix it?
Choppy voice under load means congestion on the WAN. I make sure phones mark RTP as EF and the access switches trust phone markings, then on the WAN router create a policy with a low latency priority queue for EF limited to the needed bandwidth, CBWFQ for other classes, and shaping to the real carrier rate so queuing happens on my router, not the provider's.
10
Two OSPF routers on the same link are stuck in EXSTART state. What is the cause and fix?
EXSTART or EXCHANGE stuck usually means an MTU mismatch, because database description packets larger than the neighbour's MTU are dropped. I compare MTU with show interfaces and set ip mtu to match on both sides. As a temporary workaround, ip ospf mtu-ignore can be used, but fixing the MTU is better. Duplicate router IDs can also cause odd adjacency behaviour, so I check those too.
11
Which QoS classes would you build for a typical branch WAN?
A simple five-class model works for most branches.
Voice (EF) priority queue, about 10 percent
Video (AF41) guaranteed 20-25 percent
Signalling (CS3) 5 percent
Business apps (AF21) 25-30 percent
Default (BE) remaining, with fair queuing
Scavenger (CS1) small share for backups and updates
802.11n (Wi-Fi 4) works on 2.4 and 5 GHz with MIMO. 802.11ac (Wi-Fi 5) is 5 GHz only with wider channels and MU-MIMO downlink. 802.11ax (Wi-Fi 6 and 6E) adds OFDMA, BSS colouring and target wake time, and 6E adds the 6 GHz band. 802.11be (Wi-Fi 7) adds 320 MHz channels and multi-link operation. India opened part of the 6 GHz band for indoor use.
13
How does controller-based networking differ from traditional networking?
Traditionally each device has its own control plane and is configured box by box. In controller-based or software-defined networking, a central controller holds the policy and pushes it to devices through southbound APIs such as NETCONF or OpenFlow, while applications talk to the controller through northbound REST APIs. This gives consistent configuration, automation and network-wide visibility.
14
How do you configure inter-VLAN routing on a Layer 3 switch with SVIs?
Enable routing and create an SVI per VLAN as the gateway.
ip routing
interface vlan 10
ip address 192.168.10.1 255.255.255.0
ip helper-address 10.0.0.50
no shutdown
interface vlan 20
ip address 192.168.20.1 255.255.255.0
no shutdown
show ip route connected
15
Tell me about a time you had to learn a new technology quickly.
Situation: our team moved from PVST to MST for a data center with 600 VLANs, and I had not used MST. Task: be ready for the migration in two weeks. Action: I read the configuration guides, built the design in a GNS3 lab, broke it deliberately and wrote a step-by-step checklist. Result: the migration ran in one window without outage, and I ran a short knowledge session for the team.
Quality of Service gives different treatment to traffic types when links are congested. Voice needs low delay (under 150 ms one way), low jitter (under 30 ms) and low loss (under 1 percent), while bulk file transfer can wait. QoS tools classify and mark traffic, queue it with priority queues for voice, and police or shape rates. Without congestion QoS has no effect.
17
A Python script gets 401 errors when calling a controller REST API. What do you check?
401 Unauthorized means authentication failed. I check the username and password or API key, whether a token must first be requested from an auth endpoint and sent in a header like X-Auth-Token, whether the token expired, and the exact header name and format. I test the same call with curl or an API client to separate script bugs from credential issues.
Configure the same group and virtual IP on both switches, with higher priority on the active one.
interface vlan 10
ip address 192.168.10.2 255.255.255.0
standby version 2
standby 10 ip 192.168.10.1
standby 10 priority 110
standby 10 preempt
show standby brief
Hosts use 192.168.10.1 as their gateway.
RFC 3021 allows /31 on point-to-point links because there is no need for network and broadcast addresses when only two devices exist. A /31 gives exactly two usable addresses, saving half the space of a /30. It is common on ISP and data center fabric links. Both ends must support it; on IOS you simply configure ip address 10.0.0.0 255.255.255.254.
20
Your manager wants to stop configuring 200 switches manually. What would you propose?
I would start with a source of truth for devices and variables, then use Ansible playbooks with Jinja2 templates to generate and push standard configs over SSH, keeping them in Git with peer review. A controller such as Catalyst Center could handle day-0 provisioning and compliance. I would start with read-only tasks like backups and audits, then move to small, tested change automation.
Variable Length Subnet Masking means using different prefix lengths inside one address block, so each subnet is sized to its need. You allocate the largest subnets first, then smaller ones, to avoid overlaps. For example, from 10.1.1.0/24 you could give a 100-user LAN a /25, a 50-user LAN a /26, and point-to-point WAN links /30 or /31. It saves address space compared with fixed-length subnetting.
22
Two hosts are in the same VLAN but one has mask /24 and the other /25. What problems may occur?
Each host decides local or remote using its own mask. With 192.168.1.10/24 and 192.168.1.200/25, the first thinks .200 is local and ARPs directly, but the second sees .10 as remote and sends replies to its gateway. Traffic can become one-way or asymmetric and may break completely if the gateway does not route it back. Fix the mask so both match the design.
The router ID is a 32-bit value chosen in this order: manually configured router-id, then the highest IP on an up loopback interface, then the highest IP on an up physical interface. It is chosen when the OSPF process starts, so changes need clear ip ospf process. Best practice is to set it manually so it is stable and easy to recognise in the database.
Control and Provisioning of Wireless Access Points is the protocol between lightweight APs and the WLC. It builds two tunnels: a control tunnel on UDP 5246, encrypted with DTLS, and a data tunnel on UDP 5247 that carries client traffic in central switching mode. In FlexConnect or local switching mode, client data is switched locally at the AP instead of being tunnelled.
25
Compare distance vector and link state routing protocols.
Distance vector protocols like RIP share their routing table with neighbours and trust what they hear, so they converge slowly and need loop prevention such as split horizon. Link state protocols like OSPF and IS-IS flood link state advertisements so each router builds a full topology map and runs Dijkstra's SPF algorithm. Link state converges faster and scales better but uses more memory and CPU.
Put members in a channel group with mode active, then configure the port-channel.
interface range GigabitEthernet1/0/47 - 48
channel-group 1 mode active
interface Port-channel1
switchport mode trunk
switchport trunk allowed vlan 10,20,99
port-channel load-balance src-dst-ip
show etherchannel summary
Set interface priority; higher wins and 0 never becomes DR.
interface GigabitEthernet0/0
ip ospf priority 255
! on a router that should never be DR
interface GigabitEthernet0/0
ip ospf priority 0
clear ip ospf process
Because election is non-preemptive, reset the process or the neighbours for the change to take effect.
28
Guest Wi-Fi users must reach only the internet, not internal networks. How do you enforce it?
Put guests in their own VLAN and subnet, ideally terminating on a firewall or a separate VRF. Apply an inbound extended ACL on the guest SVI that permits DHCP and DNS to the allowed servers, denies all RFC 1918 destinations, and then permits any to the internet. Enable client isolation on the wireless side and rate limit the guest SSID so it cannot consume the WAN.
29
What is EUI-64 and how is the interface ID generated?
EUI-64 builds a 64-bit interface ID from a 48-bit MAC. Split the MAC in half, insert FFFE in the middle and flip the seventh bit of the first byte. For MAC 0050.56AB.CDEF the ID becomes 0250:56FF:FEAB:CDEF. Routers can use ipv6 address 2001:db8:1::/64 eui-64. Hosts often prefer random privacy addresses instead, to avoid exposing the MAC.
30
After adding a new VLAN, users on one access switch cannot use it but others can. Why?
The most likely cause is the trunk to that switch does not allow the new VLAN, because someone configured an explicit allowed list. Check show interfaces trunk and add it with switchport trunk allowed vlan add 50, not without add, which would replace the list. Also confirm the VLAN exists on that switch with show vlan brief, especially if VTP is transparent.
31
Syslog timestamps from different devices do not match during an incident review. What do you fix?
Clocks are not synchronised. I configure all devices to use the same internal NTP servers with ntp server, set the timezone with clock timezone IST 5 30, add service timestamps log datetime msec localtime, and enable NTP authentication. Then I check show ntp associations and show ntp status to confirm synchronisation. This makes future incident timelines reliable.
Dynamic Trunking Protocol negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access. Auto plus auto stays access, while desirable with auto or desirable forms a trunk. Attackers can use DTP to form a trunk and reach all VLANs, so best practice is to hard-code access or trunk and use switchport nonegotiate on trunks.
33
Explain the NAT terms inside local, inside global, outside local and outside global.
Inside local is the private address of an inside host, for example 192.168.1.10. Inside global is the public address that represents it outside, for example 203.0.113.5. Outside global is the real address of the remote host. Outside local is how the remote host appears to inside users, usually the same as outside global unless destination NAT is used. show ip nat translations displays these columns.
34
How do you keep your subnetting skills sharp for interviews and work?
Situation: in my first job, subnetting questions slowed me down during tickets. Task: get fast and accurate. Action: I practised ten random subnetting problems daily on a timer, memorised block sizes, and built my own spreadsheet for VLSM checks. I also reviewed real routing tables at work. Result: I solve most problems in under 30 seconds and now help juniors with IP planning during change reviews.
35
A user complains the network is slow and the switch port shows many late collisions and CRC errors. What do you check?
Late collisions usually mean a duplex mismatch, and CRC errors point to bad cabling or interference. I would run show interfaces on the port to see duplex, speed and error counters, check the PC NIC settings, and set both sides to auto or hard-code both identically. Then I would replace the patch cable, clear counters and watch whether errors still increase.
36
Traffic is taking a slow path because an old access switch became root bridge. How do you fix it?
The old switch has the lowest MAC with default priority, so it won the election. I set the core or distribution switch as root with spanning-tree vlan 1-4094 priority 4096, or root primary, and the secondary with 8192. I add Root Guard on distribution downlinks so access switches can never become root again. Then I verify with show spanning-tree root.
37
Your company is running out of IP addresses on a /24 user subnet. What options do you have?
Options: expand to a /23 if the adjacent block is free and update the router and DHCP scope; create a new VLAN and subnet for some users, which also limits broadcast size; shorten DHCP lease times if many guest devices hold leases; and move printers, phones and IoT devices to their own subnets. Long term, plan an addressing scheme with growth headroom and consider dual-stack IPv6.
Physical ports include service ports for out-of-band management, distribution system ports that connect to the switch as trunks, and redundancy ports for HA. Logical interfaces include the management interface used for CAPWAP and admin access, dynamic interfaces that map WLANs to VLANs, and a virtual interface used for web auth and DHCP relay. A LAG bundles distribution ports.
39
Your company is adding a new branch with 40 users. What network components would you propose?
A branch router or SD-WAN edge for the WAN link and internet, one or two 48-port PoE access switches for PCs, phones and access points, and wireless access points managed by a controller or the cloud. I would add a firewall function, DHCP and DNS settings, VLANs for data, voice, guest and management, and a backup 4G or broadband link for resilience.
40
An internal web server must be reachable from the internet on a public IP. How do you set it up?
Use static NAT or port forwarding so the public IP maps to the server's private IP, for example ip nat inside source static tcp 192.168.1.20 443 203.0.113.10 443. Add an ACL or firewall rule allowing only port 443 inbound, put the server in a DMZ VLAN, and create a public DNS record. Ideally place a firewall or reverse proxy in front instead of exposing the server directly.
Frequently asked questions
What is asked in CCNA interviews for 3 years of experience?
Three-year interviews move to design and root cause analysis. Expect STP root placement, OSPF areas and cost tuning, VLSM plans for new sites, QoS for voice and secure management access. You should explain past outages, what caused them and what you changed so they did not repeat. Basic Python or Ansible exposure is a plus.
How many questions should I practise before a CCNA interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 3 years of experience?
Focus first on Campus and branch design, OSPF tuning, QoS basics, Root cause analysis.