40 questions with answers for candidates with Freshers — 24 easy, 15 medium, 1 hard.
What interviewers expect: freshers
Fresher interviews focus on fundamentals and subnetting. Expect the OSI model, TCP versus UDP, ARP, DHCP, VLANs, trunks, STP basics, static routing and simple OSPF, plus a written subnetting question. Many interviewers ask you to type basic switch commands or explain a Packet Tracer project, so practise configuring and verifying from memory.
This set is weighted towards IP Addressing and Subnetting (9), Switching and VLANs (7), Routing and OSPF (6), Network Fundamentals (5).
Subnetting and VLSM VLANs and trunks Static routing and OSPF basics IOS show commands
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
A new VLAN's users do not get DHCP addresses, but other VLANs work. What do you check?
I check that the SVI for the new VLAN is up and has ip helper-address pointing to the DHCP server, that the server has a scope for that subnet with the right gateway, and that the scope is activated. I confirm the VLAN is allowed on trunks. If DHCP snooping is enabled, I check the uplink is trusted, otherwise offers from the server are dropped.
DHCP Discover is a broadcast, and routers do not forward broadcasts, so a central DHCP server cannot hear clients on other subnets. A relay agent, configured with ip helper-address on the gateway interface, converts the broadcast into a unicast to the server and adds the gateway IP so the server picks the right scope. This lets one server serve many VLANs.
03
Explain root port, designated port and blocked port.
Every non-root switch picks one root port, its best path to the root based on lowest root path cost, then lowest sender bridge ID, then lowest sender port ID. On each segment, the switch with the best path becomes the designated port and forwards. Every remaining port becomes non-designated and blocks. All ports on the root bridge are designated.
04
What are the basic steps to configure a WLAN with WPA2 or WPA3 on a controller GUI?
Steps on a typical WLC GUI: create a dynamic interface with VLAN, IP and DHCP server; go to WLANs and create a new WLAN with profile name and SSID; map it to the dynamic interface; under Security choose WPA2 or WPA3 with PSK or 802.1X and add the RADIUS server for enterprise; set QoS profile; enable the WLAN and apply it to AP groups.
05
How do you keep your subnetting skills sharp for interviews and work?
Situation: in my first job, subnetting questions slowed me down during tickets. Task: get fast and accurate. Action: I practised ten random subnetting problems daily on a timer, memorised block sizes, and built my own spreadsheet for VLSM checks. I also reviewed real routing tables at work. Result: I solve most problems in under 30 seconds and now help juniors with IP planning during change reviews.
06
What is NTP and why does time matter on network devices?
NTP synchronises clocks over UDP 123 using a hierarchy of strata, where stratum 1 servers connect to an atomic or GPS clock. Correct time matters because syslog and incident timelines must line up across devices, certificates and authentication protocols check time, and logs are legal evidence. Devices can be NTP clients, servers or peers, and NTP authentication protects against fake time sources.
07
During a merger both companies use 10.0.0.0/16. How do you allow them to communicate?
Overlapping address space means routing alone cannot work. Short term, use NAT on the interconnect so each side sees the other as a different translated range, for example twice NAT or policy NAT. Long term, renumber one network into a free range, which is cleaner but needs planning for DHCP, DNS, firewall rules and static IPs. I would also document the IP address management plan to prevent repeats.
When a host needs the MAC for an IP on its subnet, it broadcasts an ARP request and the owner replies with a unicast ARP reply; the result is cached. For remote destinations the host ARPs for its default gateway. A gratuitous ARP is an unsolicited announcement of a host's own IP-to-MAC mapping, used after failover, for example by HSRP, to update switch and host tables.
The client sends a SYN with an initial sequence number. The server replies with SYN-ACK, acknowledging the client sequence and sending its own. The client sends an ACK and the session is established. Closing uses FIN and ACK from each side. A firewall that sees repeated SYNs without the final ACK may be looking at a SYN flood attack.
10
Tell me about a time you worked with a difficult end user during a ticket.
Situation: a senior manager was angry that his laptop lost network access before a client call. Task: fix it fast and calm him down. Action: I listened, gave a clear time estimate, found the port had been moved to a wrong VLAN in a recent change, corrected it and confirmed the call worked. Result: he was back online in ten minutes, and I added a port description check to our change process.
VLAN Trunking Protocol shares VLAN definitions from a server switch to clients in the same VTP domain. Modes are server, client, transparent and off. The risk is that a switch with a higher configuration revision number can overwrite and wipe VLANs across the domain. Many networks use transparent mode or VTP version 3 with a primary server to avoid this.
Use one trunk link and a subinterface per VLAN with 802.1Q encapsulation.
interface GigabitEthernet0/0
no shutdown
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
The switch port facing the router must be a trunk.
13
A newly configured router interface rejects the IP 192.168.5.64/26. Why?
With a /26 the block size is 64, so 192.168.5.64 is the network address of the subnet .64 to .127 and cannot be assigned to a host or interface. IOS reports a bad mask or overlap error. Use a usable address such as 192.168.5.65 instead. Similarly .127 would be the broadcast. Always calculate the subnet boundary before configuring addresses.
14
How do you handle pressure when an outage affects many users?
Situation: DHCP failed for 300 users at 9 a.m. on a Monday. Task: restore service while keeping managers updated. Action: I stayed calm, followed the bottom-up method, found the DHCP server's scope was full after a lease time change, extended the scope and shortened leases. I sent updates every 15 minutes. Result: users were back in 30 minutes, and we added scope utilisation alerts to monitoring.
15
A PC can ping its default gateway but cannot open any website. How would you troubleshoot?
Gateway reachability proves Layers 1 to 3 locally, so I move upward. I ping a public IP address; if that works but names fail, DNS is the problem, so I check the configured DNS server with ipconfig /all and test with nslookup. If the public IP also fails, I check the router's default route, NAT and upstream link. Finally I check proxy settings and any firewall blocking ports 80 and 443.
16
How many usable hosts are in a /26 subnet and what is the block size?
A /26 leaves 6 host bits, so 2 to the power 6 is 64 addresses and 62 usable hosts after removing network and broadcast. The mask is 255.255.255.192 and the block size is 256 minus 192, which is 64. So subnets of 192.168.1.0/26 start at .0, .64, .128 and .192. For 192.168.1.70/26 the network is .64 and broadcast .127.
17
A user's port keeps going into err-disabled state. How do you investigate?
I run show interfaces status err-disabled and show errdisable recovery to see the cause, such as psecure-violation, bpduguard or link-flap. If it is port security, the user may have plugged in a small switch or a docking station with an extra MAC, so I check show port-security interface. I fix the cause, then shut and no shut the port, or set the max MAC count appropriately.
Example line:
O 10.2.2.0/24 [110/20] via 10.0.12.2, 00:05:12, GigabitEthernet0/0
O is the source (OSPF), 10.2.2.0/24 the prefix, 110 the administrative distance and 20 the metric, 10.0.12.2 the next hop, then the age and exit interface. C is connected, L local host route, S static, D EIGRP and an asterisk marks the candidate default.
Switches exchange BPDUs and the one with the lowest bridge ID becomes root. The bridge ID is the priority (default 32768 plus the VLAN number in PVST) followed by the MAC address, so if priorities tie, the lowest MAC wins. Because the oldest switch often has the lowest MAC, you should set priority manually, for example spanning-tree vlan 10 root primary on the core.
20
How do you verify VLANs, trunks and MAC learning on a switch?
These show commands cover most VLAN troubleshooting.
show vlan brief
show interfaces trunk
show interfaces Gi1/0/5 switchport
show mac address-table vlan 20
show mac address-table address 0050.56ab.cdef
show interfaces status
They show VLAN membership, allowed and active VLANs on trunks, native VLAN and where each MAC was learned.
21
How do you quickly calculate how many subnets and hosts a mask gives?
Set a router ID, enable OSPF on interfaces and make user ports passive.
router ospf 1
router-id 1.1.1.1
auto-cost reference-bandwidth 100000
passive-interface GigabitEthernet0/1
network 10.0.12.0 0.0.0.3 area 0
network 192.168.1.0 0.0.0.255 area 0
default-information originate
Or per interface: ip ospf 1 area 0
23
After adding a new VLAN, users on one access switch cannot use it but others can. Why?
The most likely cause is the trunk to that switch does not allow the new VLAN, because someone configured an explicit allowed list. Check show interfaces trunk and add it with switchport trunk allowed vlan add 50, not without add, which would replace the list. Also confirm the VLAN exists on that switch with show vlan brief, especially if VTP is transparent.
24
How does a router choose the best route to a destination?
First it uses longest prefix match: the most specific matching prefix wins, so 10.1.1.0/24 beats 10.1.0.0/16. If the same prefix comes from different sources, the lowest administrative distance wins. If the same protocol offers several paths, the lowest metric wins, and equal metrics can be load-balanced with ECMP. Only the winners are installed in the routing table.
25
How do you create a VLAN and assign an access port?
Create the VLAN, name it, and set the port mode and VLAN.
vlan 20
name SALES
interface GigabitEthernet1/0/5
switchport mode access
switchport access vlan 20
switchport voice vlan 150
spanning-tree portfast
show vlan brief
26
What are the default STP path costs for common link speeds?
With short (802.1D revised) costs: 10 Mbps is 100, 100 Mbps is 19, 1 Gbps is 4 and 10 Gbps is 2. With the long pathcost method, 1 Gbps is 20000 and 10 Gbps is 2000, which distinguishes higher speeds. Root path cost is the sum of costs on ports toward the root, and the lowest total wins when choosing root ports.
The SSID is the network name users see. The BSSID is the MAC address of the access point radio serving a BSS, the basic service set of one AP and its clients. An ESS is multiple BSSs sharing the same SSID connected by a wired distribution system, so clients can roam between APs. Each AP can broadcast several SSIDs, each with its own BSSID.
28
How do you configure IPv4 and IPv6 on a router interface?
Enable IPv6 routing globally, then add both addresses to the interface.
ipv6 unicast-routing
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
ipv6 address 2001:db8:1:1::1/64
ipv6 address fe80::1 link-local
no shutdown
Verify with show ip interface brief and show ipv6 interface brief.
29
Find the network, broadcast and usable range for 172.16.45.200/21.
A /21 mask is 255.255.248.0, so the interesting octet is the third with block size 8. 45 falls in the block starting at 40 (40 to 47).
Network: 172.16.40.0
Broadcast: 172.16.47.255
Usable: 172.16.40.1 - 172.16.47.254
Hosts: 2^11 - 2 = 2046
30
What is the difference between an access port and a trunk port?
An access port belongs to one VLAN and carries untagged frames, typically to PCs, printers or servers. A trunk port carries traffic for many VLANs between switches, routers or hypervisors, adding an 802.1Q tag to identify each frame's VLAN, except the native VLAN which is sent untagged. Access ports can also carry a separate voice VLAN for IP phones.
31
What are the default administrative distances you should know?
Connected 0, static 1, EIGRP summary 5, eBGP 20, internal EIGRP 90, OSPF 110, IS-IS 115, RIP 120, external EIGRP 170 and iBGP 200. A value of 255 means the route is never used. AD compares trust between sources, so a static route with AD 1 beats OSPF for the same prefix unless you configure a floating static with a higher AD.
These commands cover neighbours, interfaces, routes and the database.
show ip ospf neighbor
show ip ospf interface brief
show ip ospf interface Gi0/0
show ip route ospf
show ip ospf database
show ip protocols
show ip protocols shows router ID, networks, passive interfaces and the reference bandwidth.
33
What are the key elements of a security program for a network?
A security program combines user awareness training, physical access control, and technical controls such as strong authentication, firewalls, IPS, VPNs and patching. It is built around the CIA triad: confidentiality, integrity and availability. Policies define what is allowed, and logging and monitoring detect problems. CCNA focuses on device hardening, ACLs, Layer 2 security, AAA, VPNs and wireless security.
34
What is a collision domain and a broadcast domain?
A collision domain is a segment where two devices sending at the same time can collide; every switch port is its own collision domain, and with full duplex collisions do not occur. A broadcast domain is the set of devices that receive a Layer 2 broadcast. Routers and VLANs separate broadcast domains, so one VLAN equals one broadcast domain.
35
Write a simple Ansible playbook that configures NTP on IOS devices.
DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.
37
How do you check interface status and errors on an IOS device?
show ip interface brief gives status and IP of all interfaces, and show interfaces gives counters and duplex.
Router# show ip interface brief
Router# show interfaces GigabitEthernet0/1
Router# show interfaces status
Router# clear counters GigabitEthernet0/1
Status up/down means Layer 1 is up but Layer 2 keepalives fail; administratively down means the interface is shut.
38
What are the IPv4 address classes and private ranges?
Class A is 1 to 126 with a default /8, Class B is 128 to 191 with /16, Class C is 192 to 223 with /24, Class D 224 to 239 is multicast and Class E is reserved. RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 127.0.0.0/8 is loopback and 169.254.0.0/16 is APIPA link-local. Today addressing is classless (CIDR).
Cost equals reference bandwidth divided by interface bandwidth. The default reference is 100 Mbps, so FastEthernet, Gigabit and 10 Gigabit all get cost 1, which hides the faster links. Change it with auto-cost reference-bandwidth 100000 on every router so 1G becomes 100 and 10G becomes 10. You can also set ip ospf cost directly on an interface. Path cost is the sum of outgoing interface costs.
40
What is the difference between a hub, a switch and a router?
A hub is a Layer 1 repeater: it floods every bit out of every port, so all ports share one collision domain. A switch is Layer 2: it learns MAC addresses and forwards frames only to the correct port, giving each port its own collision domain. A router is Layer 3: it forwards packets between IP networks and separates broadcast domains.
Frequently asked questions
What is asked in CCNA interviews for Freshers?
Fresher interviews focus on fundamentals and subnetting. Expect the OSI model, TCP versus UDP, ARP, DHCP, VLANs, trunks, STP basics, static routing and simple OSPF, plus a written subnetting question. Many interviewers ask you to type basic switch commands or explain a Packet Tracer project, so practise configuring and verifying from memory.
How many questions should I practise before a CCNA interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for Freshers?
Focus first on Subnetting and VLSM, VLANs and trunks, Static routing and OSPF basics, IOS show commands.