36 practice questions with answers for CCNA interviews in Bhubaneswar.
CCNA jobs in Bhubaneswar
Bhubaneswar is eastern India's emerging IT hub, with campuses of large IT-services companies in Infocity and Info Valley. Freshers make up a big share of hiring, so fundamentals and aptitude rounds matter most.
Below are 36 questions that match the mix of service, product and domain employers hiring network support engineers in Bhubaneswar.
Solved for BhubaneswarStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you write a simple Python script to fetch interface data from a device?
Netmiko handles SSH sessions; keep credentials in a file or vault, not the script.
import yaml
from netmiko import ConnectHandler
# r1.yml holds device_type, host, username, password
with open('r1.yml') as f:
device = yaml.safe_load(f)
with ConnectHandler(**device) as conn:
output = conn.send_command('show ip interface brief')
print(output)
02
Traffic is taking a slow path because an old access switch became root bridge. How do you fix it?
The old switch has the lowest MAC with default priority, so it won the election. I set the core or distribution switch as root with spanning-tree vlan 1-4094 priority 4096, or root primary, and the secondary with 8192. I add Root Guard on distribution downlinks so access switches can never become root again. Then I verify with show spanning-tree root.
Dynamic Trunking Protocol negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access. Auto plus auto stays access, while desirable with auto or desirable forms a trunk. Attackers can use DTP to form a trunk and reach all VLANs, so best practice is to hard-code access or trunk and use switchport nonegotiate on trunks.
04
How does controller-based networking differ from traditional networking?
Traditionally each device has its own control plane and is configured box by box. In controller-based or software-defined networking, a central controller holds the policy and pushes it to devices through southbound APIs such as NETCONF or OpenFlow, while applications talk to the controller through northbound REST APIs. This gives consistent configuration, automation and network-wide visibility.
Global unicast (2000::/3) is publicly routable. Unique local (fc00::/7, in practice fd00::/8) is like private IPv4. Link-local (fe80::/10) is auto-created on every IPv6 interface and used for neighbour discovery and routing next hops. Multicast is ff00::/8, for example ff02::1 all nodes and ff02::2 all routers. Anycast is a unicast address shared by several devices. IPv6 has no broadcast.
06
What is the native VLAN and what problems can a mismatch cause?
The native VLAN is the VLAN whose frames cross a trunk untagged, VLAN 1 by default. Both ends must use the same native VLAN; if they differ, frames leak between VLANs and CDP logs a native VLAN mismatch. For security, set the native VLAN to an unused ID, do not put users in it, and optionally tag it with vlan dot1q tag native to prevent VLAN hopping.
07
How do you verify IP settings and test from a Windows and Linux host?
Windows and Linux both have a small core toolkit.
ipconfig /all (IP, mask, gateway, DNS, DHCP server)
ipconfig /release && ipconfig /renew
arp -a
ip addr ; ip route ; ip neigh
resolvectl status
nslookup example.com
Add ping and tracert or traceroute to test the path.
08
Which commands would you use to test end-to-end reachability and find where packets stop?
ping tests reachability and round-trip time, and traceroute shows each Layer 3 hop.
R1# ping 10.2.2.2 source Loopback0
R1# traceroute 10.2.2.2
PC> tracert 10.2.2.2
An extended ping lets you set source, size and the DF bit to test MTU. Where traceroute shows asterisks, that hop is dropping or filtering ICMP.
RFC 3021 allows /31 on point-to-point links because there is no need for network and broadcast addresses when only two devices exist. A /31 gives exactly two usable addresses, saving half the space of a /30. It is common on ISP and data center fabric links. Both ends must support it; on IOS you simply configure ip address 10.0.0.0 255.255.255.254.
10
How do you use CDP and LLDP to discover neighbours?
CDP is a proprietary Layer 2 discovery protocol enabled by default on IOS; LLDP is the open IEEE 802.1AB standard.
show cdp neighbors
show cdp neighbors detail
configure terminal
lldp run
show lldp neighbors detail
Detail output shows the neighbour's IP, platform and port. Disable CDP on internet-facing ports with no cdp enable.
11
A user's port keeps going into err-disabled state. How do you investigate?
I run show interfaces status err-disabled and show errdisable recovery to see the cause, such as psecure-violation, bpduguard or link-flap. If it is port security, the user may have plugged in a small switch or a docking station with an extra MAC, so I check show port-security interface. I fix the cause, then shut and no shut the port, or set the max MAC count appropriately.
12
What are the basic steps to configure a WLAN with WPA2 or WPA3 on a controller GUI?
Steps on a typical WLC GUI: create a dynamic interface with VLAN, IP and DHCP server; go to WLANs and create a new WLAN with profile name and SSID; map it to the dynamic interface; under Security choose WPA2 or WPA3 with PSK or 802.1X and add the RADIUS server for enterprise; set QoS profile; enable the WLAN and apply it to AP groups.
Set interface priority; higher wins and 0 never becomes DR.
interface GigabitEthernet0/0
ip ospf priority 255
! on a router that should never be DR
interface GigabitEthernet0/0
ip ospf priority 0
clear ip ospf process
Because election is non-preemptive, reset the process or the neighbours for the change to take effect.
Mark interfaces, match inside hosts with an ACL and overload the outside interface.
interface GigabitEthernet0/1
ip nat inside
interface GigabitEthernet0/0
ip nat outside
access-list 1 permit 192.168.0.0 0.0.255.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
show ip nat translations
15
A trunk between two switches is not forming. What would you check?
I check show interfaces trunk and show interfaces switchport on both sides. Common causes are mismatched modes (both dynamic auto), one side hard-coded as access, encapsulation not set on older switches, or the port being err-disabled. Native VLAN mismatch and allowed list differences do not stop the trunk but break traffic. Best fix is switchport mode trunk on both ends with nonegotiate.
16
Tell me about a time you solved a difficult network outage.
Situation: a branch lost access to the data center during month-end close. Task: restore service fast. Action: I worked bottom-up, found the WAN link up but OSPF stuck in EXSTART, and traced it to an MTU change by the provider. I set ip ospf mtu-ignore as a temporary fix and raised a ticket for the MTU. Result: service was back in 25 minutes and I documented the check in our runbook.
Set a router ID, enable OSPF on interfaces and make user ports passive.
router ospf 1
router-id 1.1.1.1
auto-cost reference-bandwidth 100000
passive-interface GigabitEthernet0/1
network 10.0.12.0 0.0.0.3 area 0
network 192.168.1.0 0.0.0.255 area 0
default-information originate
Or per interface: ip ospf 1 area 0
18
What is a Layer 3 switch and how is it different from a router?
A Layer 3 switch forwards packets between VLANs in hardware using SVIs or routed ports, giving very high throughput with many Ethernet ports. A router usually has fewer ports but richer WAN features such as NAT, VPN, deep QoS, varied WAN interfaces and large routing tables. In campuses, Layer 3 switches handle inter-VLAN routing while routers or firewalls handle the edge.
19
Tell me about a time a change you approved caused an outage. What did you do and what changed afterwards?
Situation: I approved a change that set a new root bridge priority, but the engineer applied it on the wrong switch and the campus reconverged during business hours. Task: restore service and find the gap. Action: we rolled back in ten minutes, informed users and ran a blameless review. Result: we added device name checks to the change template, peer review of exact commands and a maintenance window rule for any STP change. There was no repeat incident that year.
20
Tell me about a time you automated or simplified a repetitive task.
Situation: our team manually backed up 80 router configs each week. Task: save time and avoid missed backups. Action: I enabled the archive feature with time-period on each device and later wrote a small Python script with Netmiko to pull and store configs in Git. Result: weekly effort dropped from four hours to zero, and we could see config differences after every change.
DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.
22
An EtherChannel shows members in suspended state. What do you check?
Suspended (s) usually means a configuration mismatch between members or with the far end. I compare speed, duplex, trunk mode, native VLAN and allowed VLANs on each member and the port-channel with show run interface, check LACP modes on both sides, and look at logs. I fix the config on the port-channel, then shut and no shut members so they rejoin. show etherchannel summary should show P flags.
23
An automation job pushed a wrong configuration to 50 switches and broke their uplinks. How do you recover and stop it happening again?
First stop the job, then recover through out-of-band console or a management network, using configuration archive rollback or a saved backup. In future, run changes with commit confirmed or reload in as a safety timer, test in a lab, use a dry run or check mode, deploy to one canary switch, then in small batches with automatic post-checks. Store templates in Git with peer review so every change is visible and reversible.
24
How does a router choose the best route to a destination?
First it uses longest prefix match: the most specific matching prefix wins, so 10.1.1.0/24 beats 10.1.0.0/16. If the same prefix comes from different sources, the lowest administrative distance wins. If the same protocol offers several paths, the lowest metric wins, and equal metrics can be load-balanced with ECMP. Only the winners are installed in the routing table.
802.1Q inserts a 4-byte tag after the source MAC in the Ethernet frame. The tag holds a 12-bit VLAN ID (1 to 4094 usable), 3 priority bits used by CoS for QoS, and a DEI bit. The tag is added when a frame leaves a trunk and removed at an access port. Older ISL encapsulation is obsolete; modern switches support only 802.1Q.
26
Tell me about a time you took initiative beyond your assigned work.
Situation: our team got many Wi-Fi complaints but had no data. Task: nobody had asked, but I wanted to find the cause. Action: I did a walk-through survey with a free tool, mapped channels and signal, and found three APs on the same 2.4 GHz channel and one dead AP. I shared a short report with fixes. Result: after the changes, Wi-Fi tickets dropped by about 60 percent in a month.
27
What are the data plane, control plane and management plane?
The data plane forwards packets, using tables such as the FIB and MAC table, ideally in hardware. The control plane builds those tables using protocols like OSPF, STP and ARP. The management plane is how admins and tools interact with the device, through SSH, SNMP, syslog and APIs. Separating them helps understanding of SDN, where the control plane can be centralised.
28
What is the difference between running-config and startup-config?
running-config lives in RAM and holds the active configuration, so every change applies immediately but is lost on reload. startup-config is stored in NVRAM and is loaded at boot. You save with copy running-config startup-config or write memory. To roll back unsaved changes you can reload without saving, which is why many engineers use reload in 10 before risky remote changes.
29
What are DR and BDR in OSPF and why are they needed?
On multi-access networks such as Ethernet, a full mesh of adjacencies would create too many LSAs. OSPF elects a Designated Router and Backup DR; other routers (DROTHERs) form full adjacency only with them and stay 2-Way with each other. The highest interface priority wins, then highest router ID; priority 0 means never DR. Election is non-preemptive, so a new better router does not take over.
30
You have 192.168.10.0/24 and need subnets for 100, 50, 20 hosts and two point-to-point links. Design it with VLSM.
Connected 0, static 1, EIGRP summary 5, eBGP 20, internal EIGRP 90, OSPF 110, IS-IS 115, RIP 120, external EIGRP 170 and iBGP 200. A value of 255 means the route is never used. AD compares trust between sources, so a static route with AD 1 beats OSPF for the same prefix unless you configure a floating static with a higher AD.
32
Explain the NAT terms inside local, inside global, outside local and outside global.
Inside local is the private address of an inside host, for example 192.168.1.10. Inside global is the public address that represents it outside, for example 203.0.113.5. Outside global is the real address of the remote host. Outside local is how the remote host appears to inside users, usually the same as outside global unless destination NAT is used. show ip nat translations displays these columns.
33
What is the difference between site-to-site and remote-access VPNs?
A site-to-site VPN connects whole networks, usually two routers or firewalls, using an always-on IPsec tunnel, so users do not need any client. A remote-access VPN connects individual users from laptops or phones to the company network using a client with TLS or IPsec, and authenticates each user. Both encrypt traffic over the internet to provide confidentiality and integrity.
Variable Length Subnet Masking means using different prefix lengths inside one address block, so each subnet is sized to its need. You allocate the largest subnets first, then smaller ones, to avoid overlaps. For example, from 10.1.1.0/24 you could give a 100-user LAN a /25, a 50-user LAN a /26, and point-to-point WAN links /30 or /31. It saves address space compared with fixed-length subnetting.
Member interfaces must have the same speed and duplex, the same mode (access or trunk), the same access VLAN or the same native and allowed VLAN list on trunks, and compatible negotiation modes. Mismatched settings put members into suspended state. Configure settings on the port-channel interface so they are pushed to members, and verify with show etherchannel summary.
In 2.4 GHz each channel is about 22 MHz wide but channels are only 5 MHz apart, so most adjacent channels overlap and interfere. Channels 1, 6 and 11 are the only three non-overlapping channels, so neighbouring access points should alternate between them. The 5 GHz band has many more non-overlapping 20 MHz channels, which is why it is preferred for capacity.
Few big employers listed in Bhubaneswar?
Many Bhubaneswar candidates also apply to teams in Kolkata and to remote or hybrid roles. Practise the Kolkata set as well.
Which companies hire CCNA professionals in Bhubaneswar?
Companies with large offices in Bhubaneswar include many IT services and product firms. Use their company pages below to practise employer-specific sets.
Are CCNA interviews in Bhubaneswar different from other cities?
The questions depend more on the company than the city. Bhubaneswar's mix of employers decides the style: Freshers make up a big share of hiring, so fundamentals and aptitude rounds matter most
How do I find CCNA jobs in Bhubaneswar?
Shortlist companies with Bhubaneswar offices, keep your CV focused on CCNA projects, apply on company career pages and job portals with the Bhubaneswar filter, and practise the questions on this page before each interview.