Skip to content
CCNA
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Network Administrator Interview Questions & Answers

40 questions for Network Administrator interviews — 3 easy, 32 medium, 5 hard.

About the Network Administrator role

A network administrator manages the day-to-day running of an office or campus network. They add VLANs, configure switch ports and trunks, maintain DHCP, NAT and ACLs, apply firmware upgrades, take configuration backups and keep documentation up to date. They also work with security and server teams on access requests. Engineers with one to three years of experience and strong switching, IP services and security basics fit this role well.

Switch and router configuration ACLs and NAT Configuration backup Firmware upgrades Network documentation
Solved for this roleStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

How do you configure an 802.1Q trunk securely?

Switching and VLANsMedium
Save to ▾
Show answer
Hard-code the trunk, disable negotiation, change the native VLAN and prune VLANs. interface GigabitEthernet1/0/48 switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate switchport trunk native vlan 999 switchport trunk allowed vlan 10,20,30,99 show interfaces trunk
02

What is port security and what are its violation modes?

Network SecurityMedium
Save to ▾
Show answer
Port security limits the MAC addresses allowed on an access port, either statically or by sticky learning. If an extra MAC appears, the violation mode acts: shutdown (default) err-disables the port, restrict drops the frames, logs and increments a counter, and protect silently drops frames. It stops MAC flooding and unauthorised devices on user ports.
03

What is the difference between standard and extended ACLs?

Network SecurityEasy
Save to ▾
Show answer
Standard ACLs (1 to 99 and 1300 to 1999) match only the source IP, so they should be placed close to the destination. Extended ACLs (100 to 199 and 2000 to 2699) match protocol, source, destination and ports, so they can be placed close to the source to drop unwanted traffic early. Named ACLs work for both and allow editing individual lines by sequence number.
04

What is NAT and what are its types?

IP ServicesEasy
Save to ▾
Show answer
Network Address Translation rewrites IP addresses as packets cross a router, usually private inside addresses to public outside ones. Static NAT maps one inside address to one public address, often for servers. Dynamic NAT maps from a pool. PAT, or NAT overload, maps many inside hosts to one public IP using unique source ports, and is what almost every office and home router uses.
05

What is the MAC address table and what happens when it is full?

Switching and VLANsHard
Save to ▾
Show answer
The MAC address table, stored in CAM, maps MAC addresses to ports and VLANs. When it fills, as in a MAC flooding attack, new addresses cannot be learned and the switch floods unknown unicast frames out of all ports in the VLAN, which lets an attacker sniff traffic. Port security limiting MACs per port prevents this.
06

What is AAA and the difference between TACACS+ and RADIUS?

Network SecurityMedium
Save to ▾
Show answer
AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.
07

Users behind a router can reach local servers but not the internet after a firewall change. NAT is configured. What do you check?

IP ServicesMedium
Save to ▾
Show answer
I check show ip nat translations to see whether translations appear when users browse. If none, I verify ip nat inside and ip nat outside on the correct interfaces, that the ACL used by NAT matches the user subnets, and that the overload interface has an IP. I also check the default route and run show ip nat statistics for hits and misses.
08

After adding a new VLAN, users on one access switch cannot use it but others can. Why?

Switching and VLANsMedium
Save to ▾
Show answer
The most likely cause is the trunk to that switch does not allow the new VLAN, because someone configured an explicit allowed list. Check show interfaces trunk and add it with switchport trunk allowed vlan add 50, not without add, which would replace the list. Also confirm the VLAN exists on that switch with show vlan brief, especially if VTP is transparent.
09

How do you restrict SSH access to devices from only the management subnet?

Network SecurityMedium
Save to ▾
Show answer
Use a standard ACL on the VTY lines. ip access-list standard MGMT-ONLY permit 10.99.0.0 0.0.0.255 deny any log line vty 0 15 access-class MGMT-ONLY in transport input ssh exec-timeout 10 0 login block-for 120 attempts 3 within 60
10

What is the difference between site-to-site and remote-access VPNs?

Network SecurityMedium
Save to ▾
Show answer
A site-to-site VPN connects whole networks, usually two routers or firewalls, using an always-on IPsec tunnel, so users do not need any client. A remote-access VPN connects individual users from laptops or phones to the company network using a client with TLS or IPsec, and authenticates each user. Both encrypt traffic over the internet to provide confidentiality and integrity.
11

How do you configure PAT (NAT overload)?

IP ServicesMedium
Save to ▾
Show answer
Mark interfaces, match inside hosts with an ACL and overload the outside interface. interface GigabitEthernet0/1 ip nat inside interface GigabitEthernet0/0 ip nat outside access-list 1 permit 192.168.0.0 0.0.255.255 ip nat inside source list 1 interface GigabitEthernet0/0 overload show ip nat translations
12

How does DNS resolution work?

IP ServicesMedium
Save to ▾
Show answer
A client asks its configured resolver, for example for www.example.com. If it is not cached, the resolver queries a root server, which refers it to the .com TLD server, which refers it to the authoritative server for example.com, which returns the A or AAAA record. The answer is cached for its TTL. DNS uses UDP 53 for most queries and TCP 53 for zone transfers and large replies.
13

Compare distance vector and link state routing protocols.

Routing and OSPFMedium
Save to ▾
Show answer
Distance vector protocols like RIP share their routing table with neighbours and trust what they hear, so they converge slowly and need loop prevention such as split horizon. Link state protocols like OSPF and IS-IS flood link state advertisements so each router builds a full topology map and runs Dijkstra's SPF algorithm. Link state converges faster and scales better but uses more memory and CPU.
14

Explain the main IPv6 address types.

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Global unicast (2000::/3) is publicly routable. Unique local (fc00::/7, in practice fd00::/8) is like private IPv4. Link-local (fe80::/10) is auto-created on every IPv6 interface and used for neighbour discovery and routing next hops. Multicast is ff00::/8, for example ff02::1 all nodes and ff02::2 all routers. Anycast is a unicast address shared by several devices. IPv6 has no broadcast.
15

Guest Wi-Fi users must reach only the internet, not internal networks. How do you enforce it?

Network SecurityMedium
Save to ▾
Show answer
Put guests in their own VLAN and subnet, ideally terminating on a firewall or a separate VRF. Apply an inbound extended ACL on the guest SVI that permits DHCP and DNS to the allowed servers, denies all RFC 1918 destinations, and then permits any to the internet. Enable client isolation on the wireless side and rate limit the guest SSID so it cannot consume the WAN.
16

How do you back up and restore a device configuration?

IP ServicesMedium
Save to ▾
Show answer
Copy the config to a server and back. copy running-config tftp://10.0.0.40/R1-backup.cfg copy running-config scp://admin@10.0.0.40/R1.cfg copy tftp://10.0.0.40/R1-backup.cfg running-config configure replace flash:R1-good.cfg archive path flash:R1-archive write-memory configure replace gives a clean rollback instead of merging.
17

How do you configure router-on-a-stick?

Switching and VLANsMedium
Save to ▾
Show answer
Use one trunk link and a subinterface per VLAN with 802.1Q encapsulation. interface GigabitEthernet0/0 no shutdown interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 interface GigabitEthernet0/0.20 encapsulation dot1Q 20 ip address 192.168.20.1 255.255.255.0 The switch port facing the router must be a trunk.
18

How do you configure a router as a DHCP relay and verify it?

IP ServicesMedium
Save to ▾
Show answer
Add the helper address on the client-facing interface. interface vlan 20 ip helper-address 10.0.0.50 show ip interface vlan 20 | include Helper debug ip dhcp server packet The helper also forwards some other UDP broadcasts such as TFTP and DNS by default; use no ip forward-protocol udp to limit them.
19

An internal web server must be reachable from the internet on a public IP. How do you set it up?

IP ServicesMedium
Save to ▾
Show answer
Use static NAT or port forwarding so the public IP maps to the server's private IP, for example ip nat inside source static tcp 192.168.1.20 443 203.0.113.10 443. Add an ACL or firewall rule allowing only port 443 inbound, put the server in a DMZ VLAN, and create a public DNS record. Ideally place a firewall or reverse proxy in front instead of exposing the server directly.
20

How do you handle a change that must be done during a night window?

Switching and VLANsMedium
Save to ▾
Show answer
Situation: we had to migrate 30 access ports to new VLANs overnight. Task: finish with zero business impact. Action: I prepared configs in advance, got peer review, scheduled a rollback, informed the helpdesk and tested each floor with a laptop after changes. Result: the migration finished an hour early, morning tickets were zero, and the plan became our template for later VLAN changes.
21

How do you write and apply an extended named ACL?

Network SecurityMedium
Save to ▾
Show answer
Allow web traffic from one subnet to a server and block the rest of that subnet. ip access-list extended WEB-ONLY 10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.80 eq 443 20 deny ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255 30 permit ip any any interface vlan 10 ip access-group WEB-ONLY in show access-lists WEB-ONLY
22

What is a Layer 3 switch and how is it different from a router?

Switching and VLANsMedium
Save to ▾
Show answer
A Layer 3 switch forwards packets between VLANs in hardware using SVIs or routed ports, giving very high throughput with many Ethernet ports. A router usually has fewer ports but richer WAN features such as NAT, VPN, deep QoS, varied WAN interfaces and large routing tables. In campuses, Layer 3 switches handle inter-VLAN routing while routers or firewalls handle the edge.
23

A user complains the network is slow and the switch port shows many late collisions and CRC errors. What do you check?

Network FundamentalsMedium
Save to ▾
Show answer
Late collisions usually mean a duplex mismatch, and CRC errors point to bad cabling or interference. I would run show interfaces on the port to see duplex, speed and error counters, check the PC NIC settings, and set both sides to auto or hard-code both identically. Then I would replace the patch cable, clear counters and watch whether errors still increase.
24

How does DHCP snooping protect the network?

Network SecurityMedium
Save to ▾
Show answer
DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.
25

Why are /31 subnets used on point-to-point links?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
RFC 3021 allows /31 on point-to-point links because there is no need for network and broadcast addresses when only two devices exist. A /31 gives exactly two usable addresses, saving half the space of a /30. It is common on ISP and data center fabric links. Both ends must support it; on IOS you simply configure ip address 10.0.0.0 255.255.255.254.
26

What is a voice VLAN and how does it work?

Switching and VLANsMedium
Save to ▾
Show answer
A voice VLAN lets an IP phone and a PC share one switch port while keeping their traffic separate. The port is an access port in the data VLAN, and the switch tells the phone through CDP or LLDP-MED to tag voice frames with the voice VLAN. This allows QoS priority for voice and separate addressing. Configure it with switchport voice vlan.
27

Tell me about a time you automated or simplified a repetitive task.

IP ServicesMedium
Save to ▾
Show answer
Situation: our team manually backed up 80 router configs each week. Task: save time and avoid missed backups. Action: I enabled the archive feature with time-period on each device and later wrote a small Python script with Netmiko to pull and store configs in Git. Result: weekly effort dropped from four hours to zero, and we could see config differences after every change.
28

After moving DHCP to a new central server, remote PCs get addresses but IP phones fail to download their configuration. What do you check?

IP ServicesMedium
Save to ▾
Show answer
The phones need extra DHCP options that were probably not copied, such as option 150 or option 66 for the TFTP or call server and sometimes a voice VLAN option. Check the scope options on the new server, confirm the relay on each SVI points to it, and capture the DHCP offer to see which options arrive. Also verify the voice VLAN scope exists and that ACLs allow TFTP from the phone subnets to the call server.
29

Explain the NAT terms inside local, inside global, outside local and outside global.

IP ServicesMedium
Save to ▾
Show answer
Inside local is the private address of an inside host, for example 192.168.1.10. Inside global is the public address that represents it outside, for example 203.0.113.5. Outside global is the real address of the remote host. Outside local is how the remote host appears to inside users, usually the same as outside global unless destination NAT is used. show ip nat translations displays these columns.
30

What is 802.1Q tagging?

Switching and VLANsEasy
Save to ▾
Show answer
802.1Q inserts a 4-byte tag after the source MAC in the Ethernet frame. The tag holds a 12-bit VLAN ID (1 to 4094 usable), 3 priority bits used by CoS for QoS, and a DEI bit. The tag is added when a frame leaves a trunk and removed at an access port. Older ISL encapsulation is obsolete; modern switches support only 802.1Q.
31

A trunk between two switches is not forming. What would you check?

Switching and VLANsMedium
Save to ▾
Show answer
I check show interfaces trunk and show interfaces switchport on both sides. Common causes are mismatched modes (both dynamic auto), one side hard-coded as access, encapsulation not set on older switches, or the port being err-disabled. Native VLAN mismatch and allowed list differences do not stop the trunk but break traffic. Best fix is switchport mode trunk on both ends with nonegotiate.
32

What is SNMP and the differences between v2c and v3?

IP ServicesMedium
Save to ▾
Show answer
SNMP lets a manager poll devices for counters and receive traps or informs about events, using a MIB with OIDs. Polling uses UDP 161 and traps UDP 162. SNMPv2c uses a plain-text community string with no encryption. SNMPv3 adds user-based authentication and encryption with authPriv mode, so it is the version to use in production, especially on networks reachable from many teams.
33

Voice calls are choppy during office hours when the WAN link is busy. How do you fix it?

IP ServicesHard
Save to ▾
Show answer
Choppy voice under load means congestion on the WAN. I make sure phones mark RTP as EF and the access switches trust phone markings, then on the WAN router create a policy with a low latency priority queue for EF limited to the needed bandwidth, CBWFQ for other classes, and shaping to the real carrier rate so queuing happens on my router, not the provider's.
34

What is a wildcard mask and how is it used in ACLs?

Network SecurityMedium
Save to ▾
Show answer
A wildcard mask tells the router which bits must match: 0 means must match and 1 means ignore. It is often the inverse of the subnet mask, so 192.168.1.0 0.0.0.255 matches the whole /24. host 10.1.1.1 equals 0.0.0.0 and any equals 255.255.255.255. Wildcards are also used in OSPF network statements. Calculate it by subtracting the mask from 255.255.255.255.
35

A server team says an ACL you applied blocked all traffic, including allowed services. What happened?

Network SecurityMedium
Save to ▾
Show answer
Most likely the ACL lacks a permit for normal traffic, so the implicit deny dropped everything, or the order put a broad deny above the specific permits. It may also be applied in the wrong direction or on the wrong interface. I check show access-lists for hit counts, fix the sequence by inserting lines, and add a final permit or the needed entries. I always test ACLs with a rollback timer.
36

What is MST and when would you use it?

STP and EtherChannelHard
Save to ▾
Show answer
Multiple Spanning Tree (802.1s) maps many VLANs to a small number of STP instances, so a switch does not run one instance per VLAN as PVST does. Switches in the same MST region must share the name, revision and VLAN-to-instance mapping. It suits large networks with hundreds of VLANs and multi-vendor environments, and supports load sharing by making different instances root on different switches.
37

What is QoS and why is it needed?

IP ServicesMedium
Save to ▾
Show answer
Quality of Service gives different treatment to traffic types when links are congested. Voice needs low delay (under 150 ms one way), low jitter (under 30 ms) and low loss (under 1 percent), while bulk file transfer can wait. QoS tools classify and mark traffic, queue it with priority queues for voice, and police or shape rates. Without congestion QoS has no effect.
38

What are DSCP and CoS markings?

IP ServicesHard
Save to ▾
Show answer
CoS is a 3-bit priority field in the 802.1Q tag, values 0 to 7, used only on Layer 2 trunks. DSCP is a 6-bit field in the IP header, values 0 to 63, which survives across routed hops. Common values: EF (46) for voice, AF41 (34) for video, CS3 (24) for call signalling and default (0) for best effort. Mark close to the source and trust markings only at controlled boundaries.
39

What is VTP and what are its risks?

Switching and VLANsMedium
Save to ▾
Show answer
VLAN Trunking Protocol shares VLAN definitions from a server switch to clients in the same VTP domain. Modes are server, client, transparent and off. The risk is that a switch with a higher configuration revision number can overwrite and wipe VLANs across the domain. Many networks use transparent mode or VTP version 3 with a primary server to avoid this.
40

How do you make an access switch port a routed port on a Layer 3 switch?

Switching and VLANsHard
Save to ▾
Show answer
A routed port behaves like a router interface and does not belong to any VLAN. interface GigabitEthernet1/0/1 no switchport ip address 10.0.0.1 255.255.255.252 no shutdown Routed uplinks between distribution and core avoid spanning tree on those links and allow fast routing convergence with ECMP.

Frequently asked questions

What does a Network Administrator do?

A network administrator manages the day-to-day running of an office or campus network. They add VLANs, configure switch ports and trunks, maintain DHCP, NAT and ACLs, apply firmware upgrades, take configuration backups and keep documentation up to date. They also work with security and server teams on access requests. Engineers with one to three years of experience and strong switching, IP services and security basics fit this role well.

Which skills are tested in a Network Administrator interview?

Expect questions on Switch and router configuration, ACLs and NAT, Configuration backup, Firmware upgrades, Network documentation. Most rounds also ask you to explain a project and solve one practical problem live.

How do I prepare for a Network Administrator interview?

Revise Switching and VLANs, IP Services, Network Security first using the topic sheets, practise the questions on this page aloud, then do one full mock interview to practise timing.

Topic sheets for this role

Switching and VLANs questionsIP Services questionsNetwork Security questions

Other roles

Network Support EngineerNOC EngineerNetwork EngineerWireless Network EngineerNetwork Automation Engineer

More ways to practise

Company-wise CCNA questionsExperience-wise CCNA questionsRole-wise CCNA questionsCity-wise CCNA questionsMost asked CCNA questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCCNA mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCCNA topic sheets