36 practice questions with answers for CCNA interviews in Mumbai.
CCNA jobs in Mumbai
Mumbai is India's financial capital, so banks, fintechs, insurers, media and consulting firms drive much of the hiring. Data and QA interviews often include domain questions on payments, risk, trading or customer analytics.
Below are 36 questions that match the mix of service, product and domain employers hiring network support engineers in Mumbai.
Solved for MumbaiStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
After adding a new VLAN, users on one access switch cannot use it but others can. Why?
The most likely cause is the trunk to that switch does not allow the new VLAN, because someone configured an explicit allowed list. Check show interfaces trunk and add it with switchport trunk allowed vlan add 50, not without add, which would replace the list. Also confirm the VLAN exists on that switch with show vlan brief, especially if VTP is transparent.
02
What is a Layer 3 switch and how is it different from a router?
A Layer 3 switch forwards packets between VLANs in hardware using SVIs or routed ports, giving very high throughput with many Ethernet ports. A router usually has fewer ports but richer WAN features such as NAT, VPN, deep QoS, varied WAN interfaces and large routing tables. In campuses, Layer 3 switches handle inter-VLAN routing while routers or firewalls handle the edge.
03
A PC can ping its default gateway but cannot open any website. How would you troubleshoot?
Gateway reachability proves Layers 1 to 3 locally, so I move upward. I ping a public IP address; if that works but names fail, DNS is the problem, so I check the configured DNS server with ipconfig /all and test with nslookup. If the public IP also fails, I check the router's default route, NAT and upstream link. Finally I check proxy settings and any firewall blocking ports 80 and 443.
Multiple Spanning Tree (802.1s) maps many VLANs to a small number of STP instances, so a switch does not run one instance per VLAN as PVST does. Switches in the same MST region must share the name, revision and VLAN-to-instance mapping. It suits large networks with hundreds of VLANs and multi-vendor environments, and supports load sharing by making different instances root on different switches.
05
Your company is adding a new branch with 40 users. What network components would you propose?
A branch router or SD-WAN edge for the WAN link and internet, one or two 48-port PoE access switches for PCs, phones and access points, and wireless access points managed by a controller or the cloud. I would add a firewall function, DHCP and DNS settings, VLANs for data, voice, guest and management, and a backup 4G or broadband link for resilience.
Variable Length Subnet Masking means using different prefix lengths inside one address block, so each subnet is sized to its need. You allocate the largest subnets first, then smaller ones, to avoid overlaps. For example, from 10.1.1.0/24 you could give a 100-user LAN a /25, a 50-user LAN a /26, and point-to-point WAN links /30 or /31. It saves address space compared with fixed-length subnetting.
I would split users into VLANs by function or floor, each with a /24 or smaller, put voice, wireless, printers, servers and management in their own VLANs, and route between them on a Layer 3 core with SVIs. DHCP scopes and helper addresses would be added per VLAN. I would migrate in phases with a rollback plan and move VLAN 1 out of use for both users and the native VLAN.
09
How do you configure IPv4 static and default routes?
Use a next-hop IP, an exit interface, or both.
ip route 10.2.0.0 255.255.0.0 192.168.12.2
ip route 0.0.0.0 0.0.0.0 203.0.113.1
! floating backup with AD 200
ip route 0.0.0.0 0.0.0.0 198.51.100.1 200
! IPv6
ipv6 route ::/0 2001:db8:12::2
show ip route static
Set a router ID, enable OSPF on interfaces and make user ports passive.
router ospf 1
router-id 1.1.1.1
auto-cost reference-bandwidth 100000
passive-interface GigabitEthernet0/1
network 10.0.12.0 0.0.0.3 area 0
network 192.168.1.0 0.0.0.255 area 0
default-information originate
Or per interface: ip ospf 1 area 0
Situation: in college I set up the hostel Wi-Fi and LAN for 120 students. Task: fix constant drop-outs. Action: I learned VLANs, channel planning and DHCP, then practiced every CCNA topic in Packet Tracer and GNS3. Result: complaints dropped sharply, and I realised I enjoy solving real problems that affect many people. Networking underpins cloud, security and automation, so it gives me a long and growing career path.
12
How do you configure AAA with TACACS+ and a local fallback?
Define the server, then method lists with local as backup.
aaa new-model
tacacs server ISE1
address ipv4 10.0.0.60
key Tac@csKey1
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting commands 15 default start-stop group tacacs+
username breakglass privilege 15 secret L0calOnly!
13
How does a router choose the best route to a destination?
First it uses longest prefix match: the most specific matching prefix wins, so 10.1.1.0/24 beats 10.1.0.0/16. If the same prefix comes from different sources, the lowest administrative distance wins. If the same protocol offers several paths, the lowest metric wins, and equal metrics can be load-balanced with ECMP. Only the winners are installed in the routing table.
WPA2 uses AES-CCMP; WPA2-Personal uses a pre-shared key that is vulnerable to offline dictionary attacks, and WPA2-Enterprise uses 802.1X with RADIUS. WPA3-Personal replaces PSK with SAE, which resists offline guessing and gives forward secrecy. WPA3-Enterprise offers a 192-bit mode. WPA3 requires protected management frames. Open networks can use OWE for encryption without passwords.
15
An internal web server must be reachable from the internet on a public IP. How do you set it up?
Use static NAT or port forwarding so the public IP maps to the server's private IP, for example ip nat inside source static tcp 192.168.1.20 443 203.0.113.10 443. Add an ACL or firewall rule allowing only port 443 inbound, put the server in a DMZ VLAN, and create a public DNS record. Ideally place a firewall or reverse proxy in front instead of exposing the server directly.
16
How do you check interface status and errors on an IOS device?
show ip interface brief gives status and IP of all interfaces, and show interfaces gives counters and duplex.
Router# show ip interface brief
Router# show interfaces GigabitEthernet0/1
Router# show interfaces status
Router# clear counters GigabitEthernet0/1
Status up/down means Layer 1 is up but Layer 2 keepalives fail; administratively down means the interface is shut.
17
A trunk between two switches is not forming. What would you check?
I check show interfaces trunk and show interfaces switchport on both sides. Common causes are mismatched modes (both dynamic auto), one side hard-coded as access, encapsulation not set on older switches, or the port being err-disabled. Native VLAN mismatch and allowed list differences do not stop the trunk but break traffic. Best fix is switchport mode trunk on both ends with nonegotiate.
18
What is the difference between site-to-site and remote-access VPNs?
A site-to-site VPN connects whole networks, usually two routers or firewalls, using an always-on IPsec tunnel, so users do not need any client. A remote-access VPN connects individual users from laptops or phones to the company network using a client with TLS or IPsec, and authenticates each user. Both encrypt traffic over the internet to provide confidentiality and integrity.
Control and Provisioning of Wireless Access Points is the protocol between lightweight APs and the WLC. It builds two tunnels: a control tunnel on UDP 5246, encrypted with DTLS, and a data tunnel on UDP 5247 that carries client traffic in central switching mode. In FlexConnect or local switching mode, client data is switched locally at the AP instead of being tunnelled.
20
Your company is running out of IP addresses on a /24 user subnet. What options do you have?
Options: expand to a /23 if the adjacent block is free and update the router and DHCP scope; create a new VLAN and subnet for some users, which also limits broadcast size; shorten DHCP lease times if many guest devices hold leases; and move printers, phones and IoT devices to their own subnets. Long term, plan an addressing scheme with growth headroom and consider dual-stack IPv6.
21
A PC in VLAN 20 cannot reach a PC in VLAN 30. What do you check?
First I check each PC has the correct IP, mask and gateway for its VLAN. Then I confirm the switch ports are in the right VLANs with show vlan brief, and that the trunk to the Layer 3 device allows both VLANs using show interfaces trunk. On the Layer 3 device I check the SVIs or subinterfaces are up and have the right IPs, and that no ACL blocks the traffic.
22
Traffic is not load balancing across two equal links even though both are in OSPF. What do you check?
Both paths must have equal total cost to be installed as ECMP. I check show ip route for two next hops. If only one shows, I compare interface costs, which differ if bandwidth or the reference bandwidth differs. I also check maximum-paths. Even with ECMP, load sharing is per flow using CEF, so a single large flow uses one link only.
23
How do you mentor junior engineers who struggle with subnetting and troubleshooting?
I start with the block-size method instead of binary tables, because it is fast and easy to remember. I give them daily five-minute subnetting drills, then real tickets where I let them lead while I watch and ask questions. For example, one junior engineer kept guessing during outages, so I taught him a fixed bottom-up checklist. Within two months he was closing Layer 2 and Layer 3 tickets on his own and teaching the next new joiner.
24
Tell me about a time you took initiative beyond your assigned work.
Situation: our team got many Wi-Fi complaints but had no data. Task: nobody had asked, but I wanted to find the cause. Action: I did a walk-through survey with a free tool, mapped channels and signal, and found three APs on the same 2.4 GHz channel and one dead AP. I shared a short report with fixes. Result: after the changes, Wi-Fi tickets dropped by about 60 percent in a month.
25
How do you use CDP and LLDP to discover neighbours?
CDP is a proprietary Layer 2 discovery protocol enabled by default on IOS; LLDP is the open IEEE 802.1AB standard.
show cdp neighbors
show cdp neighbors detail
configure terminal
lldp run
show lldp neighbors detail
Detail output shows the neighbour's IP, platform and port. Disable CDP on internet-facing ports with no cdp enable.
Allow web traffic from one subnet to a server and block the rest of that subnet.
ip access-list extended WEB-ONLY
10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.80 eq 443
20 deny ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255
30 permit ip any any
interface vlan 10
ip access-group WEB-ONLY in
show access-lists WEB-ONLY
Single-mode fiber has a small core (about 9 microns) and uses a laser, so it carries light over long distances, often 10 km or more. Multimode fiber has a larger core (50 or 62.5 microns), uses cheaper LED or VCSEL optics and suits shorter runs inside a building or data center, usually up to a few hundred metres at 10 Gbps. SFP modules must match the fiber type.
Cost equals reference bandwidth divided by interface bandwidth. The default reference is 100 Mbps, so FastEthernet, Gigabit and 10 Gigabit all get cost 1, which hides the faster links. Change it with auto-cost reference-bandwidth 100000 on every router so 1G becomes 100 and 10G becomes 10. You can also set ip ospf cost directly on an interface. Path cost is the sum of outgoing interface costs.
Mark interfaces, match inside hosts with an ACL and overload the outside interface.
interface GigabitEthernet0/1
ip nat inside
interface GigabitEthernet0/0
ip nat outside
access-list 1 permit 192.168.0.0 0.0.255.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
show ip nat translations
Put members in a channel group with mode active, then configure the port-channel.
interface range GigabitEthernet1/0/47 - 48
channel-group 1 mode active
interface Port-channel1
switchport mode trunk
switchport trunk allowed vlan 10,20,99
port-channel load-balance src-dst-ip
show etherchannel summary
A switch reads the source MAC of each incoming frame and records it with the port in the MAC address table. For forwarding it looks up the destination MAC: a known unicast goes out one port, while unknown unicast, broadcast and most multicast frames are flooded in the VLAN. Entries age out after 300 seconds by default. Check with show mac address-table.
32
Auditors find that network devices use shared admin passwords and Telnet. What is your remediation plan?
Disable Telnet with transport input ssh, enable SSH v2, and move admin login to AAA with TACACS+ so each engineer has a personal account with command authorisation and accounting logs. Keep one local fallback account in a password vault. Restrict VTY access with an ACL to the management subnet. Roll out with automation, test on a pilot, then document it for the audit.
Dynamic Trunking Protocol negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access. Auto plus auto stays access, while desirable with auto or desirable forms a trunk. Attackers can use DTP to form a trunk and reach all VLANs, so best practice is to hard-code access or trunk and use switchport nonegotiate on trunks.
34
How do you restrict SSH access to devices from only the management subnet?
Use a standard ACL on the VTY lines.
ip access-list standard MGMT-ONLY
permit 10.99.0.0 0.0.0.255
deny any log
line vty 0 15
access-class MGMT-ONLY in
transport input ssh
exec-timeout 10 0
login block-for 120 attempts 3 within 60
35
How do you configure a router as a DHCP relay and verify it?
Add the helper address on the client-facing interface.
interface vlan 20
ip helper-address 10.0.0.50
show ip interface vlan 20 | include Helper
debug ip dhcp server packet
The helper also forwards some other UDP broadcasts such as TFTP and DNS by default; use no ip forward-protocol udp to limit them.
LACP (802.3ad, now 802.1AX) is the open standard with modes active and passive; at least one side must be active. PAgP is proprietary with modes desirable and auto; at least one side must be desirable. Mode on forces the channel with no negotiation, which can cause loops if the other side is not configured. LACP is preferred because it works with servers, firewalls and other vendors.
Which companies hire CCNA professionals in Mumbai?
Companies with large offices in Mumbai include TCS, Accenture, Capgemini, Airtel, Jio Platforms, Vodafone Idea, LTIMindtree, HDFC Bank. Use their company pages below to practise employer-specific sets.
Are CCNA interviews in Mumbai different from other cities?
The questions depend more on the company than the city. Mumbai's mix of employers decides the style: Data and QA interviews often include domain questions on payments, risk, trading or customer analytics
How do I find CCNA jobs in Mumbai?
Shortlist companies with Mumbai offices, keep your CV focused on CCNA projects, apply on company career pages and job portals with the Mumbai filter, and practise the questions on this page before each interview.