Network Automation Engineer Interview Questions &amp; Answers

Show answer

Use a standard ACL on the VTY lines. ip access-list standard MGMT-ONLY permit 10.99.0.0 0.0.0.255 deny any log line vty 0 15 access-class MGMT-ONLY in transport input ssh exec-timeout 10 0 login block-for 120 attempts 3 within 60

How do you configure HSRP for a VLAN gateway?

Show answer

Configure the same group and virtual IP on both switches, with higher priority on the active one. interface vlan 10 ip address 192.168.10.2 255.255.255.0 standby version 2 standby 10 ip 192.168.10.1 standby 10 priority 110 standby 10 preempt show standby brief Hosts use 192.168.10.1 as their gateway.

What are the first hop redundancy protocols and how does HSRP work?

Show answer

FHRPs give hosts a virtual gateway IP shared by two or more routers. HSRP is proprietary: routers elect an active router by highest priority (default 100), and the standby takes over the virtual IP and MAC if hellos stop. Preempt lets a higher priority router reclaim the role. VRRP is the open standard, and GLBP adds load sharing across several routers.

What are the WLC port and interface types?

Show answer

Physical ports include service ports for out-of-band management, distribution system ports that connect to the switch as trunks, and redundancy ports for HA. Logical interfaces include the management interface used for CAPWAP and admin access, dynamic interfaces that map WLANs to VLANs, and a virtual interface used for web auth and DHCP relay. A LAG bundles distribution ports.

Why does OSPF use areas and what is area 0?

Show answer

Areas limit how far detailed LSAs flood, so SPF runs on a smaller database and changes in one area do not force recalculation everywhere. Area 0 is the backbone and every other area must connect to it, directly or through a virtual link. Routers connecting areas are ABRs and can summarize routes between areas. Single-area OSPF is the focus of CCNA.

How do you configure single-area OSPFv2?

Show answer

Set a router ID, enable OSPF on interfaces and make user ports passive. router ospf 1 router-id 1.1.1.1 auto-cost reference-bandwidth 100000 passive-interface GigabitEthernet0/1 network 10.0.12.0 0.0.0.3 area 0 network 192.168.1.0 0.0.0.255 area 0 default-information originate Or per interface: ip ospf 1 area 0

Write a simple Ansible playbook that configures NTP on IOS devices.

Show answer

Ansible uses YAML and the ios_config module. - name: Configure NTP hosts: ios_switches gather_facts: no connection: network_cli tasks: - name: Set NTP server ios_config: lines: - ntp server 10.0.0.10 save_when: modified

How do you handle a change that must be done during a night window?

Switching and VLANsMedium

Show answer

Situation: we had to migrate 30 access ports to new VLANs overnight. Task: finish with zero business impact. Action: I prepared configs in advance, got peer review, scheduled a rollback, informed the helpdesk and tested each floor with a laptop after changes. Result: the migration finished an hour early, morning tickets were zero, and the plan became our template for later VLAN changes.

Compare WPA2 and WPA3 security.

Show answer

WPA2 uses AES-CCMP; WPA2-Personal uses a pre-shared key that is vulnerable to offline dictionary attacks, and WPA2-Enterprise uses 802.1X with RADIUS. WPA3-Personal replaces PSK with SAE, which resists offline guessing and gives forward secrecy. WPA3-Enterprise offers a 192-bit mode. WPA3 requires protected management frames. Open networks can use OWE for encryption without passwords.

What is an underlay and an overlay network?

Show answer

The underlay is the physical IP network of switches and routers that provides basic reachability, for example OSPF or IS-IS on routed links. The overlay is a virtual network built on top using tunnels such as VXLAN, so logical segments can stretch across the fabric independent of physical topology. SD-Access and SD-WAN use this model, with a fabric controlling the overlay.

An automation job pushed a wrong configuration to 50 switches and broke their uplinks. How do you recover and stop it happening again?

Show answer

First stop the job, then recover through out-of-band console or a management network, using configuration archive rollback or a saved backup. In future, run changes with commit confirmed or reload in as a safety timer, test in a lab, use a dry run or check mode, deploy to one canary switch, then in small batches with automatic post-checks. Store templates in Git with peer review so every change is visible and reversible.

Your manager wants to stop configuring 200 switches manually. What would you propose?

Show answer

I would start with a source of truth for devices and variables, then use Ansible playbooks with Jinja2 templates to generate and push standard configs over SSH, keeping them in Git with peer review. A controller such as Catalyst Center could handle day-0 provisioning and compliance. I would start with read-only tasks like backups and audits, then move to small, tested change automation.

What is port security and what are its violation modes?

Show answer

Port security limits the MAC addresses allowed on an access port, either statically or by sticky learning. If an extra MAC appears, the violation mode acts: shutdown (default) err-disables the port, restrict drops the frames, logs and increments a counter, and protect silently drops frames. It stops MAC flooding and unauthorised devices on user ports.

How do you enable DHCP snooping and DAI?

Show answer

Enable per VLAN, trust uplinks and rate-limit user ports. ip dhcp snooping ip dhcp snooping vlan 10,20 no ip dhcp snooping information option ip arp inspection vlan 10,20 interface GigabitEthernet1/0/48 ip dhcp snooping trust ip arp inspection trust interface range Gi1/0/1 - 46 ip dhcp snooping limit rate 15 show ip dhcp snooping binding

Users behind a router can reach local servers but not the internet after a firewall change. NAT is configured. What do you check?

IP ServicesMedium

Show answer

I check show ip nat translations to see whether translations appear when users browse. If none, I verify ip nat inside and ip nat outside on the correct interfaces, that the ACL used by NAT matches the user subnets, and that the overload interface has an IP. I also check the default route and run show ip nat statistics for hits and misses.

How do you change OSPF DR election on a segment?

Show answer

Set interface priority; higher wins and 0 never becomes DR. interface GigabitEthernet0/0 ip ospf priority 255 ! on a router that should never be DR interface GigabitEthernet0/0 ip ospf priority 0 clear ip ospf process Because election is non-preemptive, reset the process or the neighbours for the change to take effect.

A route you expect from OSPF is in the OSPF database but not in the routing table. Why?

Show answer

Another source with a lower AD may be providing the same prefix, such as a static route, so the OSPF route is not installed. Or a more specific route wins by longest match. The next hop may also be unreachable, or a distribute-list may filter it. I check show ip route for the prefix, show ip ospf database, and compare administrative distances.

What is a floating static route?

Show answer

A floating static route is a backup static route with a higher administrative distance than the primary route, so it stays out of the routing table until the primary disappears. For example, if OSPF (AD 110) learns the main path, ip route 0.0.0.0 0.0.0.0 203.0.113.1 200 installs only when OSPF loses the route. It is common for backup internet or 4G links.

How do you mentor junior engineers who struggle with subnetting and troubleshooting?

IP Addressing and SubnettingMedium

Show answer

I start with the block-size method instead of binary tables, because it is fast and easy to remember. I give them daily five-minute subnetting drills, then real tickets where I let them lead while I watch and ask questions. For example, one junior engineer kept guessing during outages, so I taught him a fixed bottom-up checklist. Within two months he was closing Layer 2 and Layer 3 tickets on his own and teaching the next new joiner.

A branch has a primary MPLS link with OSPF and a backup broadband link. How do you design failover?

Show answer

Run OSPF over MPLS for the primary path. For the backup, use a floating static default route via the broadband link with AD higher than OSPF, for example 250, or run an IPsec tunnel with OSPF at a higher cost. Track the primary with IP SLA if the provider does not drop the link on failure, so the backup activates even when the interface stays up.

What is UDLD and why is it important on fiber links?

STP and EtherChannelHard

Show answer

UniDirectional Link Detection sends probes to confirm a neighbour receives traffic in both directions. On fiber, one strand can fail so a port receives but cannot send, which may make STP unblock a port and create a loop. UDLD normal mode logs and marks the port, while aggressive mode err-disables it. It is commonly enabled on fiber uplinks together with Loop Guard.

What is Dynamic ARP Inspection?

Show answer

DAI checks ARP packets on untrusted ports against the DHCP snooping binding table and drops ARP replies whose IP-to-MAC mapping does not match. This stops ARP spoofing and man-in-the-middle attacks where an attacker claims to be the default gateway. Static hosts need ARP ACLs. It requires DHCP snooping enabled in the same VLAN and trusted uplink ports.

Two OSPF routers on the same link are stuck in EXSTART state. What is the cause and fix?

Show answer

EXSTART or EXCHANGE stuck usually means an MTU mismatch, because database description packets larger than the neighbour's MTU are dropped. I compare MTU with show interfaces and set ip mtu to match on both sides. As a temporary workaround, ip ospf mtu-ignore can be used, but fixing the MTU is better. Duplicate router IDs can also cause odd adjacency behaviour, so I check those too.

How do you configure AAA with TACACS+ and a local fallback?

Show answer

Define the server, then method lists with local as backup. aaa new-model tacacs server ISE1 address ipv4 10.0.0.60 key Tac@csKey1 aaa authentication login default group tacacs+ local aaa authorization exec default group tacacs+ local aaa accounting commands 15 default start-stop group tacacs+ username breakglass privilege 15 secret L0calOnly!

A new lightweight AP does not join the controller. How do you troubleshoot?

Show answer

I check the AP gets a DHCP address and can reach the WLC management IP. It discovers the controller through DHCP option 43, the standard CAPWAP controller DNS name, broadcast or a primed controller IP, so I verify one of these. Then I check UDP 5246 and 5247 are not blocked, the AP's clock and certificate are valid, the country code matches, and the WLC has AP licences available.

What is 802.1X port-based authentication?

Show answer

802.1X lets a switch or access point block a port until the user or device authenticates. The supplicant is the client, the authenticator is the switch or AP, and the authentication server is a RADIUS server. EAP messages are carried over the LAN as EAPoL and then inside RADIUS. On success the RADIUS server can assign a VLAN or ACL. MAB is a fallback for devices without supplicants.

What is the difference between autonomous APs, controller-based APs and cloud-managed APs?

Show answer

Autonomous APs are configured one by one and suit very small sites. Lightweight APs are managed by a Wireless LAN Controller using CAPWAP tunnels, which centralises configuration, RF management and roaming, and suits campuses. Cloud-managed APs are configured from a cloud dashboard, ideal for many branches. Split-MAC means real-time functions stay on the AP while management sits on the controller.

Traffic is not load balancing across two equal links even though both are in OSPF. What do you check?

Show answer

Both paths must have equal total cost to be installed as ECMP. I check show ip route for two next hops. If only one shows, I compare interface costs, which differ if bandwidth or the reference bandwidth differs. I also check maximum-paths. Even with ECMP, load sharing is per flow using CEF, so a single large flow uses one link only.

What is the difference between site-to-site and remote-access VPNs?

Show answer

A site-to-site VPN connects whole networks, usually two routers or firewalls, using an always-on IPsec tunnel, so users do not need any client. A remote-access VPN connects individual users from laptops or phones to the company network using a client with TLS or IPsec, and authenticates each user. Both encrypt traffic over the internet to provide confidentiality and integrity.

Tell me about a time a change you approved caused an outage. What did you do and what changed afterwards?

STP and EtherChannelHard

Show answer

Situation: I approved a change that set a new root bridge priority, but the engineer applied it on the wrong switch and the campus reconverged during business hours. Task: restore service and find the gap. Action: we rolled back in ten minutes, informed users and ran a blameless review. Result: we added device name checks to the change template, peer review of exact commands and a maintenance window rule for any STP change. There was no repeat incident that year.

A server team reports that a link between two switches is up but traffic is dropping intermittently. What do you check?

Network FundamentalsHard

Show answer

I check show interfaces on both ends for input errors, CRC, runts, giants, output drops and resets. Output drops suggest congestion, so I look at utilisation and QoS. CRC errors suggest a bad cable, dirty fiber or faulty SFP, so I check optical levels with show interfaces transceiver. I also confirm both sides agree on speed and duplex and that the MTU matches.

After adding a second internet router, some sessions break at the stateful firewall because return traffic uses the other exit. How do you fix it?

Show answer

This is asymmetric routing: the firewall sees only one direction of the flow and drops it. Make the path symmetric by using one active exit per prefix, for example HSRP or a higher OSPF default-route cost on the backup, and advertise inbound routes consistently with the same preference. If both links must be active, pair the firewalls with state sharing or use NAT per exit so return traffic comes back to the router that sent it.

How do you configure an 802.1Q trunk securely?

Switching and VLANsMedium

Show answer

Hard-code the trunk, disable negotiation, change the native VLAN and prune VLANs. interface GigabitEthernet1/0/48 switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate switchport trunk native vlan 999 switchport trunk allowed vlan 10,20,30,99 show interfaces trunk

Tell me about a time you led a network migration or a major change.

Network FundamentalsHard

Show answer

Situation: our office had to move 300 users from old access switches to a new stack in one weekend. Task: I owned the plan. Action: I documented every port, pre-built configs, ran a pilot on one floor, wrote a rollback plan and kept a call bridge open with the desktop team. Result: we finished two hours early with only three port issues, fixed on Monday morning. I learned that a tested rollback plan gives the whole team confidence.

Compare distance vector and link state routing protocols.

Show answer

Distance vector protocols like RIP share their routing table with neighbours and trust what they hear, so they converge slowly and need loop prevention such as split horizon. Link state protocols like OSPF and IS-IS flood link state advertisements so each router builds a full topology map and runs Dijkstra's SPF algorithm. Link state converges faster and scales better but uses more memory and CPU.

A security scan shows that switch and router management interfaces are reachable from user VLANs. How do you lock down management access?

Show answer

Move management to a dedicated VLAN or out-of-band network, ideally in a management VRF. Apply an access-class ACL on VTY lines allowing only the jump host subnet, disable Telnet and HTTP, keep SSH version 2 and HTTPS only if needed, and use AAA with TACACS+ for per-user login and logging. Add control plane policing, block management subnets at the user VLAN gateways and rescan to confirm the fix.

How do you write and apply an extended named ACL?

Show answer

Allow web traffic from one subnet to a server and block the rest of that subnet. ip access-list extended WEB-ONLY 10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.80 eq 443 20 deny ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255 30 permit ip any any interface vlan 10 ip access-group WEB-ONLY in show access-lists WEB-ONLY

Auditors find that network devices use shared admin passwords and Telnet. What is your remediation plan?

Show answer

Disable Telnet with transport input ssh, enable SSH v2, and move admin login to AAA with TACACS+ so each engineer has a personal account with command authorisation and accounting logs. Keep one local fallback account in a password vault. Restrict VTY access with an ACL to the management subnet. Roll out with automation, test on a pilot, then document it for the audit.

How do you write a simple Python script to fetch interface data from a device?