36 practice questions with answers for CCNA interviews in Chandigarh.
CCNA jobs in Chandigarh
Chandigarh, Mohali and Panchkula form the Tricity IT cluster, with IT-services firms, SaaS companies and start-ups in Mohali's IT City and Chandigarh's IT Park. Interviews usually check strong fundamentals and practical tool skills.
Below are 36 questions that match the mix of service, product and domain employers hiring network support engineers in Chandigarh.
Solved for ChandigarhStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
A floating static route is a backup static route with a higher administrative distance than the primary route, so it stays out of the routing table until the primary disappears. For example, if OSPF (AD 110) learns the main path, ip route 0.0.0.0 0.0.0.0 203.0.113.1 200 installs only when OSPF loses the route. It is common for backup internet or 4G links.
DHCP uses the DORA process: the client broadcasts Discover, the server answers with an Offer, the client broadcasts a Request for that offer, and the server confirms with an Acknowledgement. The lease includes IP, mask, gateway, DNS servers and lease time. Clients renew at 50 percent of the lease. DHCP uses UDP ports 67 for the server and 68 for the client.
Routers send hellos to 224.0.0.5. They become neighbours if area ID, subnet and mask, hello and dead timers, authentication and stub flags match, and the router IDs are unique. States go Down, Init, 2-Way, ExStart, Exchange, Loading and Full. In ExStart and Exchange they agree master and slave and swap database descriptions, which is where an MTU mismatch causes a stuck adjacency.
Mark interfaces, match inside hosts with an ACL and overload the outside interface.
interface GigabitEthernet0/1
ip nat inside
interface GigabitEthernet0/0
ip nat outside
access-list 1 permit 192.168.0.0 0.0.255.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
show ip nat translations
05
How do you create a VLAN and assign an access port?
Create the VLAN, name it, and set the port mode and VLAN.
vlan 20
name SALES
interface GigabitEthernet1/0/5
switchport mode access
switchport access vlan 20
switchport voice vlan 150
spanning-tree portfast
show vlan brief
06
A broadcast storm brought the network down after someone connected a cable between two wall ports. How do you prevent this?
Two wall ports patched to the same switch formed a loop. To stop it now, I find the port with rising broadcast counters and shut it. To prevent repeats, enable PortFast with BPDU Guard on all access ports, keep Rapid PVST+ running everywhere, add storm-control broadcast thresholds on access ports and enable errdisable recovery with a sensible interval.
07
What are the default administrative distances you should know?
Connected 0, static 1, EIGRP summary 5, eBGP 20, internal EIGRP 90, OSPF 110, IS-IS 115, RIP 120, external EIGRP 170 and iBGP 200. A value of 255 means the route is never used. AD compares trust between sources, so a static route with AD 1 beats OSPF for the same prefix unless you configure a floating static with a higher AD.
08
Tell me about a time you found a security issue and reported it.
Situation: during a routine audit I noticed SNMP v2c with the default community public on several access switches. Task: close the gap without disrupting monitoring. Action: I reported it to my lead with evidence, proposed SNMPv3 with an ACL, tested with the monitoring team and rolled out in two batches. Result: the risk was closed in a week and SNMP checks were added to our device baseline.
Make members routed ports first, then put the IP on the port-channel.
interface range TenGigabitEthernet1/1/1 - 2
no switchport
channel-group 10 mode active
interface Port-channel10
no switchport
ip address 10.0.0.1 255.255.255.252
show etherchannel 10 summary
show ip interface brief
10
Explain the NAT terms inside local, inside global, outside local and outside global.
Inside local is the private address of an inside host, for example 192.168.1.10. Inside global is the public address that represents it outside, for example 203.0.113.5. Outside global is the real address of the remote host. Outside local is how the remote host appears to inside users, usually the same as outside global unless destination NAT is used. show ip nat translations displays these columns.
11
Your company is adding a new branch with 40 users. What network components would you propose?
A branch router or SD-WAN edge for the WAN link and internet, one or two 48-port PoE access switches for PCs, phones and access points, and wireless access points managed by a controller or the cloud. I would add a firewall function, DHCP and DNS settings, VLANs for data, voice, guest and management, and a backup 4G or broadband link for resilience.
12
Which commands would you use to test end-to-end reachability and find where packets stop?
ping tests reachability and round-trip time, and traceroute shows each Layer 3 hop.
R1# ping 10.2.2.2 source Loopback0
R1# traceroute 10.2.2.2
PC> tracert 10.2.2.2
An extended ping lets you set source, size and the DF bit to test MTU. Where traceroute shows asterisks, that hop is dropping or filtering ICMP.
13
How do you quickly calculate how many subnets and hosts a mask gives?
Enable routing and create an SVI per VLAN as the gateway.
ip routing
interface vlan 10
ip address 192.168.10.1 255.255.255.0
ip helper-address 10.0.0.50
no shutdown
interface vlan 20
ip address 192.168.20.1 255.255.255.0
no shutdown
show ip route connected
Rapid PVST+ runs 802.1w per VLAN. It uses a proposal and agreement handshake on point-to-point links so ports move to forwarding in under a second, instead of waiting on timers. It has port roles root, designated, alternate and backup, and states discarding, learning and forwarding. Alternate ports provide an instant backup root port. It is the default on most modern IOS switches.
A voice VLAN lets an IP phone and a PC share one switch port while keeping their traffic separate. The port is an access port in the data VLAN, and the switch tells the phone through CDP or LLDP-MED to tag voice frames with the voice VLAN. This allows QoS priority for voice and separate addressing. Configure it with switchport voice vlan.
Control and Provisioning of Wireless Access Points is the protocol between lightweight APs and the WLC. It builds two tunnels: a control tunnel on UDP 5246, encrypted with DTLS, and a data tunnel on UDP 5247 that carries client traffic in central switching mode. In FlexConnect or local switching mode, client data is switched locally at the AP instead of being tunnelled.
Allow web traffic from one subnet to a server and block the rest of that subnet.
ip access-list extended WEB-ONLY
10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.80 eq 443
20 deny ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255
30 permit ip any any
interface vlan 10
ip access-group WEB-ONLY in
show access-lists WEB-ONLY
19
An EtherChannel shows members in suspended state. What do you check?
Suspended (s) usually means a configuration mismatch between members or with the far end. I compare speed, duplex, trunk mode, native VLAN and allowed VLANs on each member and the port-channel with show run interface, check LACP modes on both sides, and look at logs. I fix the config on the port-channel, then shut and no shut members so they rejoin. show etherchannel summary should show P flags.
WPA2 uses AES-CCMP; WPA2-Personal uses a pre-shared key that is vulnerable to offline dictionary attacks, and WPA2-Enterprise uses 802.1X with RADIUS. WPA3-Personal replaces PSK with SAE, which resists offline guessing and gives forward secrecy. WPA3-Enterprise offers a 192-bit mode. WPA3 requires protected management frames. Open networks can use OWE for encryption without passwords.
Exclude static addresses first, then define the pool.
ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp pool VLAN10
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8 1.1.1.1
lease 7
show ip dhcp binding
show ip dhcp pool
22
Guest Wi-Fi users must reach only the internet, not internal networks. How do you enforce it?
Put guests in their own VLAN and subnet, ideally terminating on a firewall or a separate VRF. Apply an inbound extended ACL on the guest SVI that permits DHCP and DNS to the allowed servers, denies all RFC 1918 destinations, and then permits any to the internet. Enable client isolation on the wireless side and rate limit the guest SSID so it cannot consume the WAN.
23
You have 192.168.10.0/24 and need subnets for 100, 50, 20 hosts and two point-to-point links. Design it with VLSM.
A three-tier design has access, distribution and core layers: access connects users, distribution aggregates access switches and applies policy, and the core provides fast transport between distribution blocks. A two-tier or collapsed-core design merges core and distribution, which suits small and medium campuses with fewer buildings. Three-tier scales better when there are many distribution blocks.
The SSID is the network name users see. The BSSID is the MAC address of the access point radio serving a BSS, the basic service set of one AP and its clients. An ESS is multiple BSSs sharing the same SSID connected by a wired distribution system, so clients can roam between APs. Each AP can broadcast several SSIDs, each with its own BSSID.
26
What are the STP port states and timers in classic 802.1D?
States are blocking, listening, learning, forwarding and disabled. Timers are hello 2 seconds, forward delay 15 seconds and max age 20 seconds. A port moves from blocking through listening and learning, each 15 seconds, so convergence can take 30 to 50 seconds. That delay is why Rapid STP and PortFast are used in modern networks.
27
Tell me about a time you automated or simplified a repetitive task.
Situation: our team manually backed up 80 router configs each week. Task: save time and avoid missed backups. Action: I enabled the archive feature with time-period on each device and later wrote a small Python script with Netmiko to pull and store configs in Git. Result: weekly effort dropped from four hours to zero, and we could see config differences after every change.
Member interfaces must have the same speed and duplex, the same mode (access or trunk), the same access VLAN or the same native and allowed VLAN list on trunks, and compatible negotiation modes. Mismatched settings put members into suspended state. Configure settings on the port-channel interface so they are pushed to members, and verify with show etherchannel summary.
Set a router ID, enable OSPF on interfaces and make user ports passive.
router ospf 1
router-id 1.1.1.1
auto-cost reference-bandwidth 100000
passive-interface GigabitEthernet0/1
network 10.0.12.0 0.0.0.3 area 0
network 192.168.1.0 0.0.0.255 area 0
default-information originate
Or per interface: ip ospf 1 area 0
30
Two OSPF routers are directly connected but show no neighbour at all. How do you troubleshoot?
I check that the interfaces are up and in the same subnet, then show ip ospf interface to compare area, hello and dead timers, network type and authentication. I make sure the interface is not passive and that the network statement or ip ospf area command covers it. Finally I check that no ACL blocks protocol 89 or multicast 224.0.0.5, and use debug ip ospf adj if needed.
31
What is a collision domain and a broadcast domain?
A collision domain is a segment where two devices sending at the same time can collide; every switch port is its own collision domain, and with full duplex collisions do not occur. A broadcast domain is the set of devices that receive a Layer 2 broadcast. Routers and VLANs separate broadcast domains, so one VLAN equals one broadcast domain.
Put members in a channel group with mode active, then configure the port-channel.
interface range GigabitEthernet1/0/47 - 48
channel-group 1 mode active
interface Port-channel1
switchport mode trunk
switchport trunk allowed vlan 10,20,99
port-channel load-balance src-dst-ip
show etherchannel summary
33
How do you write a simple Python script to fetch interface data from a device?
Netmiko handles SSH sessions; keep credentials in a file or vault, not the script.
import yaml
from netmiko import ConnectHandler
# r1.yml holds device_type, host, username, password
with open('r1.yml') as f:
device = yaml.safe_load(f)
with ConnectHandler(**device) as conn:
output = conn.send_command('show ip interface brief')
print(output)
Example line:
O 10.2.2.0/24 [110/20] via 10.0.12.2, 00:05:12, GigabitEthernet0/0
O is the source (OSPF), 10.2.2.0/24 the prefix, 110 the administrative distance and 20 the metric, 10.0.12.2 the next hop, then the age and exit interface. C is connected, L local host route, S static, D EIGRP and an asterisk marks the candidate default.
35
Traffic is taking a slow path because an old access switch became root bridge. How do you fix it?
The old switch has the lowest MAC with default priority, so it won the election. I set the core or distribution switch as root with spanning-tree vlan 1-4094 priority 4096, or root primary, and the secondary with 8192. I add Root Guard on distribution downlinks so access switches can never become root again. Then I verify with show spanning-tree root.
36
A PC can ping its default gateway but cannot open any website. How would you troubleshoot?
Gateway reachability proves Layers 1 to 3 locally, so I move upward. I ping a public IP address; if that works but names fail, DNS is the problem, so I check the configured DNS server with ipconfig /all and test with nslookup. If the public IP also fails, I check the router's default route, NAT and upstream link. Finally I check proxy settings and any firewall blocking ports 80 and 443.
Few big employers listed in Chandigarh?
Many Chandigarh candidates also apply to teams in Gurgaon and to remote or hybrid roles. Practise the Gurgaon set as well.
Which companies hire CCNA professionals in Chandigarh?
Companies with large offices in Chandigarh include many IT services and product firms. Use their company pages below to practise employer-specific sets.
Are CCNA interviews in Chandigarh different from other cities?
The questions depend more on the company than the city. Chandigarh's mix of employers decides the style: Interviews usually check strong fundamentals and practical tool skills
How do I find CCNA jobs in Chandigarh?
Shortlist companies with Chandigarh offices, keep your CV focused on CCNA projects, apply on company career pages and job portals with the Chandigarh filter, and practise the questions on this page before each interview.