40 questions with answers for candidates with 7 years of experience — 20 medium, 20 hard.
What interviewers expect: 7 years experience
With seven years, roles are usually senior network engineer or team lead, and interviews go beyond CCNA into CCNP-level topics. Expect architecture questions on multi-site routing, data center spine-leaf, segmentation, migrations and standards. Behavioural questions cover vendor management, change governance, budgeting effort and mentoring a team through difficult and risky projects.
This set is weighted towards IP Services (8), Routing and OSPF (7), Network Security (6), STP and EtherChannel (6).
Network architecture Migration planning Standards and governance Mentoring and stakeholder management
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Set a router ID, enable OSPF on interfaces and make user ports passive.
router ospf 1
router-id 1.1.1.1
auto-cost reference-bandwidth 100000
passive-interface GigabitEthernet0/1
network 10.0.12.0 0.0.0.3 area 0
network 192.168.1.0 0.0.0.255 area 0
default-information originate
Or per interface: ip ospf 1 area 0
02
After adding a new VLAN, users on one access switch cannot use it but others can. Why?
The most likely cause is the trunk to that switch does not allow the new VLAN, because someone configured an explicit allowed list. Check show interfaces trunk and add it with switchport trunk allowed vlan add 50, not without add, which would replace the list. Also confirm the VLAN exists on that switch with show vlan brief, especially if VTP is transparent.
Global unicast (2000::/3) is publicly routable. Unique local (fc00::/7, in practice fd00::/8) is like private IPv4. Link-local (fe80::/10) is auto-created on every IPv6 interface and used for neighbour discovery and routing next hops. Multicast is ff00::/8, for example ff02::1 all nodes and ff02::2 all routers. Anycast is a unicast address shared by several devices. IPv6 has no broadcast.
04
How would you plan an IP addressing scheme for a company with 10 branches?
I would reserve a large block, for example 10.0.0.0/16, and give each branch a summarizable /20 such as 10.0.16.0/20, 10.0.32.0/20 and so on. Inside each, assign fixed ranges per role: users, voice, wireless, servers, management and WAN links. This lets each branch be summarized as one route, keeps firewall rules simple, and leaves room to grow. I keep it in an IPAM tool.
05
Two OSPF routers are directly connected but show no neighbour at all. How do you troubleshoot?
I check that the interfaces are up and in the same subnet, then show ip ospf interface to compare area, hello and dead timers, network type and authentication. I make sure the interface is not passive and that the network statement or ip ospf area command covers it. Finally I check that no ACL blocks protocol 89 or multicast 224.0.0.5, and use debug ip ospf adj if needed.
06
Syslog timestamps from different devices do not match during an incident review. What do you fix?
Clocks are not synchronised. I configure all devices to use the same internal NTP servers with ntp server, set the timezone with clock timezone IST 5 30, add service timestamps log datetime msec localtime, and enable NTP authentication. Then I check show ntp associations and show ntp status to confirm synchronisation. This makes future incident timelines reliable.
07
After a core switch replacement, ping works across the campus but large file transfers and some VPN sessions hang. What do you suspect?
Suspect an MTU mismatch. Small pings fit in one frame, but full-size packets are dropped when one link or the new switch uses a smaller MTU, or when ICMP is blocked so Path MTU Discovery fails. Test with ping using a size of 1472 and the do-not-fragment bit, compare interface MTU on both ends, and check jumbo frame settings. Fix by matching MTU end to end or adjusting TCP MSS on tunnel interfaces.
08
What are the first hop redundancy protocols and how does HSRP work?
FHRPs give hosts a virtual gateway IP shared by two or more routers. HSRP is proprietary: routers elect an active router by highest priority (default 100), and the standby takes over the virtual IP and MAC if hellos stop. Preempt lets a higher priority router reclaim the role. VRRP is the open standard, and GLBP adds load sharing across several routers.
09
What is the difference between policing and shaping?
Policing drops or re-marks traffic that exceeds a rate immediately, with no buffering, so it causes TCP retransmissions; it is used inbound or by ISPs. Shaping buffers excess traffic and sends it later, smoothing bursts to a configured rate at the cost of delay; it is used outbound, for example to match a 100 Mbps subscription on a 1 Gbps port.
10
Write a simple Ansible playbook that configures NTP on IOS devices.
Run OSPF over MPLS for the primary path. For the backup, use a floating static default route via the broadband link with AD higher than OSPF, for example 250, or run an IPsec tunnel with OSPF at a higher cost. Track the primary with IP SLA if the provider does not drop the link on failure, so the backup activates even when the interface stays up.
A floating static route is a backup static route with a higher administrative distance than the primary route, so it stays out of the routing table until the primary disappears. For example, if OSPF (AD 110) learns the main path, ip route 0.0.0.0 0.0.0.0 203.0.113.1 200 installs only when OSPF loses the route. It is common for backup internet or 4G links.
13
An internal web server must be reachable from the internet on a public IP. How do you set it up?
Use static NAT or port forwarding so the public IP maps to the server's private IP, for example ip nat inside source static tcp 192.168.1.20 443 203.0.113.10 443. Add an ACL or firewall rule allowing only port 443 inbound, put the server in a DMZ VLAN, and create a public DNS record. Ideally place a firewall or reverse proxy in front instead of exposing the server directly.
14
A route you expect from OSPF is in the OSPF database but not in the routing table. Why?
Another source with a lower AD may be providing the same prefix, such as a static route, so the OSPF route is not installed. Or a more specific route wins by longest match. The next hop may also be unreachable, or a distribute-list may filter it. I check show ip route for the prefix, show ip ospf database, and compare administrative distances.
15
How do you configure NTP, syslog and SNMPv3 on a device?
In spine-leaf, every leaf switch connects to every spine switch, and servers connect only to leaves. Any server is therefore at most two hops from another, giving predictable latency and good east-west bandwidth. Capacity is added by adding spines or leaves. It usually runs Layer 3 with ECMP to use all links, instead of relying on spanning tree.
17
How do you mentor junior engineers who struggle with subnetting and troubleshooting?
I start with the block-size method instead of binary tables, because it is fast and easy to remember. I give them daily five-minute subnetting drills, then real tickets where I let them lead while I watch and ask questions. For example, one junior engineer kept guessing during outages, so I taught him a fixed bottom-up checklist. Within two months he was closing Layer 2 and Layer 3 tickets on his own and teaching the next new joiner.
Mark interfaces, match inside hosts with an ACL and overload the outside interface.
interface GigabitEthernet0/1
ip nat inside
interface GigabitEthernet0/0
ip nat outside
access-list 1 permit 192.168.0.0 0.0.255.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
show ip nat translations
19
Auditors find that network devices use shared admin passwords and Telnet. What is your remediation plan?
Disable Telnet with transport input ssh, enable SSH v2, and move admin login to AAA with TACACS+ so each engineer has a personal account with command authorisation and accounting logs. Keep one local fallback account in a password vault. Restrict VTY access with an ACL to the management subnet. Roll out with automation, test on a pilot, then document it for the audit.
Variable Length Subnet Masking means using different prefix lengths inside one address block, so each subnet is sized to its need. You allocate the largest subnets first, then smaller ones, to avoid overlaps. For example, from 10.1.1.0/24 you could give a 100-user LAN a /25, a 50-user LAN a /26, and point-to-point WAN links /30 or /31. It saves address space compared with fixed-length subnetting.
IPsec uses IKE (v1 or v2) to authenticate peers and negotiate keys, ESP to encrypt and authenticate data, and optionally AH for authentication only, which breaks with NAT. Algorithms include AES for encryption, SHA-256 for integrity and Diffie-Hellman groups for key exchange. Tunnel mode encrypts the whole original packet and is used for site-to-site VPNs.
22
What is AAA and the difference between TACACS+ and RADIUS?
AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.
23
A new lightweight AP does not join the controller. How do you troubleshoot?
I check the AP gets a DHCP address and can reach the WLC management IP. It discovers the controller through DHCP option 43, the standard CAPWAP controller DNS name, broadcast or a primed controller IP, so I verify one of these. Then I check UDP 5246 and 5247 are not blocked, the AP's clock and certificate are valid, the country code matches, and the WLC has AP licences available.
24
Which QoS classes would you build for a typical branch WAN?
A simple five-class model works for most branches.
Voice (EF) priority queue, about 10 percent
Video (AF41) guaranteed 20-25 percent
Signalling (CS3) 5 percent
Business apps (AF21) 25-30 percent
Default (BE) remaining, with fair queuing
Scavenger (CS1) small share for backups and updates
LACP (802.3ad, now 802.1AX) is the open standard with modes active and passive; at least one side must be active. PAgP is proprietary with modes desirable and auto; at least one side must be desirable. Mode on forces the channel with no negotiation, which can cause loops if the other side is not configured. LACP is preferred because it works with servers, firewalls and other vendors.
26
A trunk between two switches is not forming. What would you check?
I check show interfaces trunk and show interfaces switchport on both sides. Common causes are mismatched modes (both dynamic auto), one side hard-coded as access, encapsulation not set on older switches, or the port being err-disabled. Native VLAN mismatch and allowed list differences do not stop the trunk but break traffic. Best fix is switchport mode trunk on both ends with nonegotiate.
27
Your manager wants to stop configuring 200 switches manually. What would you propose?
I would start with a source of truth for devices and variables, then use Ansible playbooks with Jinja2 templates to generate and push standard configs over SSH, keeping them in Git with peer review. A controller such as Catalyst Center could handle day-0 provisioning and compliance. I would start with read-only tasks like backups and audits, then move to small, tested change automation.
28
A server team reports that a link between two switches is up but traffic is dropping intermittently. What do you check?
I check show interfaces on both ends for input errors, CRC, runts, giants, output drops and resets. Output drops suggest congestion, so I look at utilisation and QoS. CRC errors suggest a bad cable, dirty fiber or faulty SFP, so I check optical levels with show interfaces transceiver. I also confirm both sides agree on speed and duplex and that the MTU matches.
29
What is UDLD and why is it important on fiber links?
UniDirectional Link Detection sends probes to confirm a neighbour receives traffic in both directions. On fiber, one strand can fail so a port receives but cannot send, which may make STP unblock a port and create a loop. UDLD normal mode logs and marks the port, while aggressive mode err-disables it. It is commonly enabled on fiber uplinks together with Loop Guard.
30
How do you back up and restore a device configuration?
Copy the config to a server and back.
copy running-config tftp://10.0.0.40/R1-backup.cfg
copy running-config scp://admin@10.0.0.40/R1.cfg
copy tftp://10.0.0.40/R1-backup.cfg running-config
configure replace flash:R1-good.cfg
archive
path flash:R1-archive
write-memory
configure replace gives a clean rollback instead of merging.
Enable per VLAN, trust uplinks and rate-limit user ports.
ip dhcp snooping
ip dhcp snooping vlan 10,20
no ip dhcp snooping information option
ip arp inspection vlan 10,20
interface GigabitEthernet1/0/48
ip dhcp snooping trust
ip arp inspection trust
interface range Gi1/0/1 - 46
ip dhcp snooping limit rate 15
show ip dhcp snooping binding
32
A 4 x 1G EtherChannel to a server shows one link at 95 percent and others nearly idle. Why?
Load balancing is per flow based on a hash. If the method is src-mac and most traffic comes from one router MAC, all flows hash to one link. I change port-channel load-balance to src-dst-ip or src-dst-mixed-ip-port so many flows spread across members. If the traffic is a single large flow, it can never exceed one member, so faster links would be needed.
33
Tell me about a time a change you approved caused an outage. What did you do and what changed afterwards?
Situation: I approved a change that set a new root bridge priority, but the engineer applied it on the wrong switch and the campus reconverged during business hours. Task: restore service and find the gap. Action: we rolled back in ten minutes, informed users and ran a blameless review. Result: we added device name checks to the change template, peer review of exact commands and a maintenance window rule for any STP change. There was no repeat incident that year.
Configure the same group and virtual IP on both switches, with higher priority on the active one.
interface vlan 10
ip address 192.168.10.2 255.255.255.0
standby version 2
standby 10 ip 192.168.10.1
standby 10 priority 110
standby 10 preempt
show standby brief
Hosts use 192.168.10.1 as their gateway.
35
A server team says an ACL you applied blocked all traffic, including allowed services. What happened?
Most likely the ACL lacks a permit for normal traffic, so the implicit deny dropped everything, or the order put a broad deny above the specific permits. It may also be applied in the wrong direction or on the wrong interface. I check show access-lists for hit counts, fix the sequence by inserting lines, and add a final permit or the needed entries. I always test ACLs with a rollback timer.
Make members routed ports first, then put the IP on the port-channel.
interface range TenGigabitEthernet1/1/1 - 2
no switchport
channel-group 10 mode active
interface Port-channel10
no switchport
ip address 10.0.0.1 255.255.255.252
show etherchannel 10 summary
show ip interface brief
37
A security scan shows that switch and router management interfaces are reachable from user VLANs. How do you lock down management access?
Move management to a dedicated VLAN or out-of-band network, ideally in a management VRF. Apply an access-class ACL on VTY lines allowing only the jump host subnet, disable Telnet and HTTP, keep SSH version 2 and HTTPS only if needed, and use AAA with TACACS+ for per-user login and logging. Add control plane policing, block management subnets at the user VLAN gateways and rescan to confirm the fix.
Root Guard on a designated port puts it into root-inconsistent state if a superior BPDU arrives, protecting the planned root bridge, so it is used on distribution ports facing access switches. Loop Guard stops a non-designated port from becoming designated when BPDUs stop arriving, such as with a unidirectional fiber fault. UDLD complements Loop Guard by detecting one-way links.
39
After moving DHCP to a new central server, remote PCs get addresses but IP phones fail to download their configuration. What do you check?
The phones need extra DHCP options that were probably not copied, such as option 150 or option 66 for the TFTP or call server and sometimes a voice VLAN option. Check the scope options on the new server, confirm the relay on each SVI points to it, and capture the DHCP offer to see which options arrive. Also verify the voice VLAN scope exists and that ACLs allow TFTP from the phone subnets to the call server.
40
How do you call a REST API from Python and parse the JSON?
Use the requests library and convert the reply to a dictionary.
import requests
url = 'https://controller.example.local/api/v1/network-device'
headers = {'X-Auth-Token': token, 'Accept': 'application/json'}
r = requests.get(url, headers=headers, timeout=10)
r.raise_for_status()
for dev in r.json()['response']:
print(dev['hostname'], dev['managementIpAddress'])
Frequently asked questions
What is asked in CCNA interviews for 7 years of experience?
With seven years, roles are usually senior network engineer or team lead, and interviews go beyond CCNA into CCNP-level topics. Expect architecture questions on multi-site routing, data center spine-leaf, segmentation, migrations and standards. Behavioural questions cover vendor management, change governance, budgeting effort and mentoring a team through difficult and risky projects.
How many questions should I practise before a CCNA interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 7 years of experience?
Focus first on Network architecture, Migration planning, Standards and governance, Mentoring and stakeholder management.