Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About HDFC Bank hiring for CCNA roles
HDFC Bank is one of India's largest private sector banks, offering retail banking, loans, cards, wholesale banking and digital banking. Its analytics, risk and technology teams work on credit decisions, customer analytics, fraud detection and digital channels. It hires for data analysts, credit and risk analysts, testers and technology roles.
For CCNA roles, this HDFC Bank practice set focuses most on IP Services (6), STP and EtherChannel (5), Routing and OSPF (4), Wireless and Automation (4). It has 4 easy, 20 medium, 6 hard questions, so you can start easy and work up to the harder ones.
Company type
Banking & finance
Headquarters
Mumbai, India
Main India offices
Mumbai, Chennai, Bengaluru
HDFC Bank CCNA interview process
Online assessment (aptitude + domain)
Technical or functional interview
Managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for HDFC BankStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you back up and restore a device configuration?
Copy the config to a server and back.
copy running-config tftp://10.0.0.40/R1-backup.cfg
copy running-config scp://admin@10.0.0.40/R1.cfg
copy tftp://10.0.0.40/R1-backup.cfg running-config
configure replace flash:R1-good.cfg
archive
path flash:R1-archive
write-memory
configure replace gives a clean rollback instead of merging.
VLAN Trunking Protocol shares VLAN definitions from a server switch to clients in the same VTP domain. Modes are server, client, transparent and off. The risk is that a switch with a higher configuration revision number can overwrite and wipe VLANs across the domain. Many networks use transparent mode or VTP version 3 with a primary server to avoid this.
03
Guest Wi-Fi users must reach only the internet, not internal networks. How do you enforce it?
Put guests in their own VLAN and subnet, ideally terminating on a firewall or a separate VRF. Apply an inbound extended ACL on the guest SVI that permits DHCP and DNS to the allowed servers, denies all RFC 1918 destinations, and then permits any to the internet. Enable client isolation on the wireless side and rate limit the guest SSID so it cannot consume the WAN.
04
Traffic is not load balancing across two equal links even though both are in OSPF. What do you check?
Both paths must have equal total cost to be installed as ECMP. I check show ip route for two next hops. If only one shows, I compare interface costs, which differ if bandwidth or the reference bandwidth differs. I also check maximum-paths. Even with ECMP, load sharing is per flow using CEF, so a single large flow uses one link only.
Physical ports include service ports for out-of-band management, distribution system ports that connect to the switch as trunks, and redundancy ports for HA. Logical interfaces include the management interface used for CAPWAP and admin access, dynamic interfaces that map WLANs to VLANs, and a virtual interface used for web auth and DHCP relay. A LAG bundles distribution ports.
06
Explain the NAT terms inside local, inside global, outside local and outside global.
Inside local is the private address of an inside host, for example 192.168.1.10. Inside global is the public address that represents it outside, for example 203.0.113.5. Outside global is the real address of the remote host. Outside local is how the remote host appears to inside users, usually the same as outside global unless destination NAT is used. show ip nat translations displays these columns.
07
Users behind a router can reach local servers but not the internet after a firewall change. NAT is configured. What do you check?
I check show ip nat translations to see whether translations appear when users browse. If none, I verify ip nat inside and ip nat outside on the correct interfaces, that the ACL used by NAT matches the user subnets, and that the overload interface has an IP. I also check the default route and run show ip nat statistics for hits and misses.
Make members routed ports first, then put the IP on the port-channel.
interface range TenGigabitEthernet1/1/1 - 2
no switchport
channel-group 10 mode active
interface Port-channel10
no switchport
ip address 10.0.0.1 255.255.255.252
show etherchannel 10 summary
show ip interface brief
Use static NAT or port forwarding so the public IP maps to the server's private IP, for example ip nat inside source static tcp 192.168.1.20 443 203.0.113.10 443. Add an ACL or firewall rule allowing only port 443 inbound, put the server in a DMZ VLAN, and create a public DNS record. Ideally place a firewall or reverse proxy in front instead of exposing the server directly.
11
A new lightweight AP does not join the controller. How do you troubleshoot?
I check the AP gets a DHCP address and can reach the WLC management IP. It discovers the controller through DHCP option 43, the standard CAPWAP controller DNS name, broadcast or a primed controller IP, so I verify one of these. Then I check UDP 5246 and 5247 are not blocked, the AP's clock and certificate are valid, the country code matches, and the WLC has AP licences available.
Network Address Translation rewrites IP addresses as packets cross a router, usually private inside addresses to public outside ones. Static NAT maps one inside address to one public address, often for servers. Dynamic NAT maps from a pool. PAT, or NAT overload, maps many inside hosts to one public IP using unique source ports, and is what almost every office and home router uses.
13
Tell me about a time you found a security issue and reported it.
Situation: during a routine audit I noticed SNMP v2c with the default community public on several access switches. Task: close the gap without disrupting monitoring. Action: I reported it to my lead with evidence, proposed SNMPv3 with an ACL, tested with the monitoring team and rolled out in two batches. Result: the risk was closed in a week and SNMP checks were added to our device baseline.
Rapid PVST+ runs 802.1w per VLAN. It uses a proposal and agreement handshake on point-to-point links so ports move to forwarding in under a second, instead of waiting on timers. It has port roles root, designated, alternate and backup, and states discarding, learning and forwarding. Alternate ports provide an instant backup root port. It is the default on most modern IOS switches.
15
A 4 x 1G EtherChannel to a server shows one link at 95 percent and others nearly idle. Why?
Load balancing is per flow based on a hash. If the method is src-mac and most traffic comes from one router MAC, all flows hash to one link. I change port-channel load-balance to src-dst-ip or src-dst-mixed-ip-port so many flows spread across members. If the traffic is a single large flow, it can never exceed one member, so faster links would be needed.
Routers send hellos to 224.0.0.5. They become neighbours if area ID, subnet and mask, hello and dead timers, authentication and stub flags match, and the router IDs are unique. States go Down, Init, 2-Way, ExStart, Exchange, Loading and Full. In ExStart and Exchange they agree master and slave and swap database descriptions, which is where an MTU mismatch causes a stuck adjacency.
17
How do you verify VLANs, trunks and MAC learning on a switch?
These show commands cover most VLAN troubleshooting.
show vlan brief
show interfaces trunk
show interfaces Gi1/0/5 switchport
show mac address-table vlan 20
show mac address-table address 0050.56ab.cdef
show interfaces status
They show VLAN membership, allowed and active VLANs on trunks, native VLAN and where each MAC was learned.
Cost equals reference bandwidth divided by interface bandwidth. The default reference is 100 Mbps, so FastEthernet, Gigabit and 10 Gigabit all get cost 1, which hides the faster links. Change it with auto-cost reference-bandwidth 100000 on every router so 1G becomes 100 and 10G becomes 10. You can also set ip ospf cost directly on an interface. Path cost is the sum of outgoing interface costs.
Control and Provisioning of Wireless Access Points is the protocol between lightweight APs and the WLC. It builds two tunnels: a control tunnel on UDP 5246, encrypted with DTLS, and a data tunnel on UDP 5247 that carries client traffic in central switching mode. In FlexConnect or local switching mode, client data is switched locally at the AP instead of being tunnelled.
Allow web traffic from one subnet to a server and block the rest of that subnet.
ip access-list extended WEB-ONLY
10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.80 eq 443
20 deny ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255
30 permit ip any any
interface vlan 10
ip access-group WEB-ONLY in
show access-lists WEB-ONLY
21
How do you write a simple Python script to fetch interface data from a device?
Netmiko handles SSH sessions; keep credentials in a file or vault, not the script.
import yaml
from netmiko import ConnectHandler
# r1.yml holds device_type, host, username, password
with open('r1.yml') as f:
device = yaml.safe_load(f)
with ConnectHandler(**device) as conn:
output = conn.send_command('show ip interface brief')
print(output)
22
What is SLAAC and how is it different from DHCPv6?
With SLAAC a host learns the /64 prefix from a router advertisement and builds its own interface ID, without a server. Stateless DHCPv6 adds extra options such as DNS while the address still comes from SLAAC. Stateful DHCPv6 assigns the address itself and keeps bindings, similar to DHCPv4. RA flags M (managed) and O (other config) tell hosts which method to use.
23
Users on a new floor report no network connectivity at all and the switch port LEDs are off. What is your approach?
No link light means a Layer 1 problem. I verify the switch has power and the ports are not administratively shut down with show ip interface brief. I test the cable with a tester, check the patch panel mapping and confirm the NIC is enabled. If the switch uses PoE for phones or access points, I also check the power budget with show power inline.
LACP (802.3ad, now 802.1AX) is the open standard with modes active and passive; at least one side must be active. PAgP is proprietary with modes desirable and auto; at least one side must be desirable. Mode on forces the channel with no negotiation, which can cause loops if the other side is not configured. LACP is preferred because it works with servers, firewalls and other vendors.
25
After a core switch replacement, ping works across the campus but large file transfers and some VPN sessions hang. What do you suspect?
Suspect an MTU mismatch. Small pings fit in one frame, but full-size packets are dropped when one link or the new switch uses a smaller MTU, or when ICMP is blocked so Path MTU Discovery fails. Test with ping using a size of 1472 and the do-not-fragment bit, compare interface MTU on both ends, and check jumbo frame settings. Fix by matching MTU end to end or adjusting TCP MSS on tunnel interfaces.
EtherChannel bundles 2 to 8 physical links into one logical port-channel. STP sees it as one link, so all members forward instead of one being blocked. It adds bandwidth and redundancy, as one member failing does not drop the channel. Traffic is load-balanced per flow using a hash of MAC, IP or port fields, so a single flow still uses only one member link.
27
What is SNMP and the differences between v2c and v3?
SNMP lets a manager poll devices for counters and receive traps or informs about events, using a MIB with OIDs. Polling uses UDP 161 and traps UDP 162. SNMPv2c uses a plain-text community string with no encryption. SNMPv3 adds user-based authentication and encryption with authPriv mode, so it is the version to use in production, especially on networks reachable from many teams.
Areas limit how far detailed LSAs flood, so SPF runs on a smaller database and changes in one area do not force recalculation everywhere. Area 0 is the backbone and every other area must connect to it, directly or through a virtual link. Routers connecting areas are ABRs and can summarize routes between areas. Single-area OSPF is the focus of CCNA.
29
You have 192.168.10.0/24 and need subnets for 100, 50, 20 hosts and two point-to-point links. Design it with VLSM.
Single-mode fiber has a small core (about 9 microns) and uses a laser, so it carries light over long distances, often 10 km or more. Multimode fiber has a larger core (50 or 62.5 microns), uses cheaper LED or VCSEL optics and suits shorter runs inside a building or data center, usually up to a few hundred metres at 10 Gbps. SFP modules must match the fiber type.
Tips to crack the HDFC Bank CCNA interview
Learn Indian banking basics like CASA, NPAs, credit scores, KYC and RBI regulations for domain questions.
Revise SQL, Excel and basic statistics for analytics and risk roles with banking examples.
Understand UPI, net banking and mobile banking flows if applying for digital channel testing roles.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; HDFC Bank interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the HDFC Bank CCNA interview?
Candidates usually go through 4 stages: Online assessment (aptitude + domain); Technical or functional interview; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the HDFC Bank CCNA interview?
This practice set leans on IP Services (6), STP and EtherChannel (5), Routing and OSPF (4), Wireless and Automation (4). Revise those first, then practise explaining one or two of your own projects end to end, because most HDFC Bank interviewers ask you to walk through real work.
Are these the exact questions asked at HDFC Bank?
No. These are curated practice questions that match the skills and difficulty usually tested in banking & finance interviews like HDFC Bank's. They are not a leaked or verified list of past questions.
Where does HDFC Bank hire CCNA professionals in India?
HDFC Bank has large teams in Mumbai, Chennai, Bengaluru. Openings and locations change often, so check the HDFC Bank careers page and filter by city and experience.