36 practice questions with answers for CCNA interviews in Nagpur.
CCNA jobs in Nagpur
Nagpur's MIHAN SEZ hosts IT-services and BFSI delivery centres, giving central India a steady market for data and QA roles. Interviews are usually service-company style, with aptitude, technical and HR rounds.
Below are 36 questions that match the mix of service, product and domain employers hiring network support engineers in Nagpur.
Solved for NagpurStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
The TCP/IP model has four or five layers. Its Application layer covers OSI layers 5 to 7, Transport maps to Layer 4, Internet maps to Layer 3, and Network Access (or Link plus Physical) covers layers 1 and 2. CCNA uses the five-layer version. Real protocols such as HTTP, TCP and IP are defined by the TCP/IP suite, so it is the practical model.
02
What is a wildcard mask and how is it used in ACLs?
A wildcard mask tells the router which bits must match: 0 means must match and 1 means ignore. It is often the inverse of the subnet mask, so 192.168.1.0 0.0.0.255 matches the whole /24. host 10.1.1.1 equals 0.0.0.0 and any equals 255.255.255.255. Wildcards are also used in OSPF network statements. Calculate it by subtracting the mask from 255.255.255.255.
Cost equals reference bandwidth divided by interface bandwidth. The default reference is 100 Mbps, so FastEthernet, Gigabit and 10 Gigabit all get cost 1, which hides the faster links. Change it with auto-cost reference-bandwidth 100000 on every router so 1G becomes 100 and 10G becomes 10. You can also set ip ospf cost directly on an interface. Path cost is the sum of outgoing interface costs.
04
Compare distance vector and link state routing protocols.
Distance vector protocols like RIP share their routing table with neighbours and trust what they hear, so they converge slowly and need loop prevention such as split horizon. Link state protocols like OSPF and IS-IS flood link state advertisements so each router builds a full topology map and runs Dijkstra's SPF algorithm. Link state converges faster and scales better but uses more memory and CPU.
A voice VLAN lets an IP phone and a PC share one switch port while keeping their traffic separate. The port is an access port in the data VLAN, and the switch tells the phone through CDP or LLDP-MED to tag voice frames with the voice VLAN. This allows QoS priority for voice and separate addressing. Configure it with switchport voice vlan.
06
A new lightweight AP does not join the controller. How do you troubleshoot?
I check the AP gets a DHCP address and can reach the WLC management IP. It discovers the controller through DHCP option 43, the standard CAPWAP controller DNS name, broadcast or a primed controller IP, so I verify one of these. Then I check UDP 5246 and 5247 are not blocked, the AP's clock and certificate are valid, the country code matches, and the WLC has AP licences available.
07
Tell me about a time you worked with a difficult end user during a ticket.
Situation: a senior manager was angry that his laptop lost network access before a client call. Task: fix it fast and calm him down. Action: I listened, gave a clear time estimate, found the port had been moved to a wrong VLAN in a recent change, corrected it and confirmed the call worked. Result: he was back online in ten minutes, and I added a port description check to our change process.
Routers send hellos to 224.0.0.5. They become neighbours if area ID, subnet and mask, hello and dead timers, authentication and stub flags match, and the router IDs are unique. States go Down, Init, 2-Way, ExStart, Exchange, Loading and Full. In ExStart and Exchange they agree master and slave and swap database descriptions, which is where an MTU mismatch causes a stuck adjacency.
09
Traffic is not load balancing across two equal links even though both are in OSPF. What do you check?
Both paths must have equal total cost to be installed as ECMP. I check show ip route for two next hops. If only one shows, I compare interface costs, which differ if bandwidth or the reference bandwidth differs. I also check maximum-paths. Even with ECMP, load sharing is per flow using CEF, so a single large flow uses one link only.
10
What are the data plane, control plane and management plane?
The data plane forwards packets, using tables such as the FIB and MAC table, ideally in hardware. The control plane builds those tables using protocols like OSPF, STP and ARP. The management plane is how admins and tools interact with the device, through SSH, SNMP, syslog and APIs. Separating them helps understanding of SDN, where the control plane can be centralised.
11
Two hosts are in the same VLAN but one has mask /24 and the other /25. What problems may occur?
Each host decides local or remote using its own mask. With 192.168.1.10/24 and 192.168.1.200/25, the first thinks .200 is local and ARPs directly, but the second sees .10 as remote and sends replies to its gateway. Traffic can become one-way or asymmetric and may break completely if the gateway does not route it back. Fix the mask so both match the design.
12
How do you configure a router as a DHCP relay and verify it?
Add the helper address on the client-facing interface.
interface vlan 20
ip helper-address 10.0.0.50
show ip interface vlan 20 | include Helper
debug ip dhcp server packet
The helper also forwards some other UDP broadcasts such as TFTP and DNS by default; use no ip forward-protocol udp to limit them.
13
After adding a second internet router, some sessions break at the stateful firewall because return traffic uses the other exit. How do you fix it?
This is asymmetric routing: the firewall sees only one direction of the flow and drops it. Make the path symmetric by using one active exit per prefix, for example HSRP or a higher OSPF default-route cost on the backup, and advertise inbound routes consistently with the same preference. If both links must be active, pair the firewalls with state sharing or use NAT per exit so return traffic comes back to the router that sent it.
Member interfaces must have the same speed and duplex, the same mode (access or trunk), the same access VLAN or the same native and allowed VLAN list on trunks, and compatible negotiation modes. Mismatched settings put members into suspended state. Configure settings on the port-channel interface so they are pushed to members, and verify with show etherchannel summary.
Global unicast (2000::/3) is publicly routable. Unique local (fc00::/7, in practice fd00::/8) is like private IPv4. Link-local (fe80::/10) is auto-created on every IPv6 interface and used for neighbour discovery and routing next hops. Multicast is ff00::/8, for example ff02::1 all nodes and ff02::2 all routers. Anycast is a unicast address shared by several devices. IPv6 has no broadcast.
16
What is AAA and the difference between TACACS+ and RADIUS?
AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.
Areas limit how far detailed LSAs flood, so SPF runs on a smaller database and changes in one area do not force recalculation everywhere. Area 0 is the backbone and every other area must connect to it, directly or through a virtual link. Routers connecting areas are ABRs and can summarize routes between areas. Single-area OSPF is the focus of CCNA.
DAI checks ARP packets on untrusted ports against the DHCP snooping binding table and drops ARP replies whose IP-to-MAC mapping does not match. This stops ARP spoofing and man-in-the-middle attacks where an attacker claims to be the default gateway. Static hosts need ARP ACLs. It requires DHCP snooping enabled in the same VLAN and trusted uplink ports.
19
A Python script gets 401 errors when calling a controller REST API. What do you check?
401 Unauthorized means authentication failed. I check the username and password or API key, whether a token must first be requested from an auth endpoint and sent in a header like X-Auth-Token, whether the token expired, and the exact header name and format. I test the same call with curl or an API client to separate script bugs from credential issues.
20
Two OSPF routers are directly connected but show no neighbour at all. How do you troubleshoot?
I check that the interfaces are up and in the same subnet, then show ip ospf interface to compare area, hello and dead timers, network type and authentication. I make sure the interface is not passive and that the network statement or ip ospf area command covers it. Finally I check that no ACL blocks protocol 89 or multicast 224.0.0.5, and use debug ip ospf adj if needed.
21
How do you make an access switch port a routed port on a Layer 3 switch?
A routed port behaves like a router interface and does not belong to any VLAN.
interface GigabitEthernet1/0/1
no switchport
ip address 10.0.0.1 255.255.255.252
no shutdown
Routed uplinks between distribution and core avoid spanning tree on those links and allow fast routing convergence with ECMP.
Put members in a channel group with mode active, then configure the port-channel.
interface range GigabitEthernet1/0/47 - 48
channel-group 1 mode active
interface Port-channel1
switchport mode trunk
switchport trunk allowed vlan 10,20,99
port-channel load-balance src-dst-ip
show etherchannel summary
23
How would you influence which port becomes the root port on a switch?
The root port is chosen by lowest cost, then sender bridge ID, then sender port ID. To prefer a link I lower its cost.
interface GigabitEthernet1/0/49
spanning-tree vlan 10 cost 2
On the upstream switch you can change port priority instead.
interface GigabitEthernet1/0/1
spanning-tree vlan 10 port-priority 64
Set priorities on the intended primary and secondary roots, then verify.
spanning-tree mode rapid-pvst
spanning-tree vlan 10,20 root primary
! on the backup switch
spanning-tree vlan 10,20 root secondary
show spanning-tree vlan 10
show spanning-tree root
show spanning-tree summary
25
How does controller-based networking differ from traditional networking?
Traditionally each device has its own control plane and is configured box by box. In controller-based or software-defined networking, a central controller holds the policy and pushes it to devices through southbound APIs such as NETCONF or OpenFlow, while applications talk to the controller through northbound REST APIs. This gives consistent configuration, automation and network-wide visibility.
26
A new VLAN's users do not get DHCP addresses, but other VLANs work. What do you check?
I check that the SVI for the new VLAN is up and has ip helper-address pointing to the DHCP server, that the server has a scope for that subnet with the right gateway, and that the scope is activated. I confirm the VLAN is allowed on trunks. If DHCP snooping is enabled, I check the uplink is trusted, otherwise offers from the server are dropped.
IPsec uses IKE (v1 or v2) to authenticate peers and negotiate keys, ESP to encrypt and authenticate data, and optionally AH for authentication only, which breaks with NAT. Algorithms include AES for encryption, SHA-256 for integrity and Diffie-Hellman groups for key exchange. Tunnel mode encrypts the whole original packet and is used for site-to-site VPNs.
28
Tell me about a time you found a security issue and reported it.
Situation: during a routine audit I noticed SNMP v2c with the default community public on several access switches. Task: close the gap without disrupting monitoring. Action: I reported it to my lead with evidence, proposed SNMPv3 with an ACL, tested with the monitoring team and rolled out in two batches. Result: the risk was closed in a week and SNMP checks were added to our device baseline.
NDP uses ICMPv6 messages. A host sends a Neighbor Solicitation to the target's solicited-node multicast address (ff02::1:ffXX:XXXX) and gets a Neighbor Advertisement with the MAC. Router Solicitation and Router Advertisement messages provide prefix and gateway. Duplicate Address Detection uses NS to check that an address is unique. Using multicast instead of broadcast reduces load on other hosts.
Quality of Service gives different treatment to traffic types when links are congested. Voice needs low delay (under 150 ms one way), low jitter (under 30 ms) and low loss (under 1 percent), while bulk file transfer can wait. QoS tools classify and mark traffic, queue it with priority queues for voice, and police or shape rates. Without congestion QoS has no effect.
When a host needs the MAC for an IP on its subnet, it broadcasts an ARP request and the owner replies with a unicast ARP reply; the result is cached. For remote destinations the host ARPs for its default gateway. A gratuitous ARP is an unsolicited announcement of a host's own IP-to-MAC mapping, used after failover, for example by HSRP, to update switch and host tables.
32
Tell me about a time you took initiative beyond your assigned work.
Situation: our team got many Wi-Fi complaints but had no data. Task: nobody had asked, but I wanted to find the cause. Action: I did a walk-through survey with a free tool, mapped channels and signal, and found three APs on the same 2.4 GHz channel and one dead AP. I shared a short report with fixes. Result: after the changes, Wi-Fi tickets dropped by about 60 percent in a month.
33
Your manager wants to stop configuring 200 switches manually. What would you propose?
I would start with a source of truth for devices and variables, then use Ansible playbooks with Jinja2 templates to generate and push standard configs over SSH, keeping them in Git with peer review. A controller such as Catalyst Center could handle day-0 provisioning and compliance. I would start with read-only tasks like backups and audits, then move to small, tested change automation.
34
What is the difference between site-to-site and remote-access VPNs?
A site-to-site VPN connects whole networks, usually two routers or firewalls, using an always-on IPsec tunnel, so users do not need any client. A remote-access VPN connects individual users from laptops or phones to the company network using a client with TLS or IPsec, and authenticates each user. Both encrypt traffic over the internet to provide confidentiality and integrity.
35
Users complain Wi-Fi is slow in a conference room with 60 people. What do you check and fix?
This is usually a capacity, not a coverage, issue. I check client count per AP and channel utilisation on the controller. Fixes include adding APs with lower transmit power, steering clients to 5 or 6 GHz with band steering, disabling low data rates such as 1, 2 and 5.5 Mbps, using 20 or 40 MHz channels in dense areas, and limiting per-client bandwidth on the SSID.
36
How do you approach working in a 24x7 network operations shift?
Situation: I joined a NOC that ran rotating shifts. Task: stay effective and keep handovers clean. Action: I followed runbooks, kept a shift log of every alert and action, raised early escalations for anything outside my scope and used quiet hours to lab new topics. Result: I handled shift incidents within SLA, earned positive feedback for clear handovers and was moved to the L2 team in a year.
Few big employers listed in Nagpur?
Many Nagpur candidates also apply to teams in Pune and to remote or hybrid roles. Practise the Pune set as well.
Which companies hire CCNA professionals in Nagpur?
Companies with large offices in Nagpur include many IT services and product firms. Use their company pages below to practise employer-specific sets.
Are CCNA interviews in Nagpur different from other cities?
The questions depend more on the company than the city. Nagpur's mix of employers decides the style: Interviews are usually service-company style, with aptitude, technical and HR rounds
How do I find CCNA jobs in Nagpur?
Shortlist companies with Nagpur offices, keep your CV focused on CCNA projects, apply on company career pages and job portals with the Nagpur filter, and practise the questions on this page before each interview.