Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About LTIMindtree hiring for CCNA roles
LTIMindtree is an Indian IT services and consulting company formed by the merger of Larsen and Toubro Infotech and Mindtree, and part of the L&T Group. It provides cloud, data, ERP, testing and digital engineering services for global clients. It hires for software engineers, test engineers, data analysts, data engineers and ERP consultants.
For CCNA roles, this LTIMindtree practice set focuses most on Network Security (6), STP and EtherChannel (5), Network Fundamentals (5), IP Addressing and Subnetting (5). It has 16 easy, 11 medium, 3 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Mumbai, India
Main India offices
Mumbai, Pune, Bengaluru, Chennai, Hyderabad
LTIMindtree CCNA interview process
Online assessment (aptitude + reasoning)
Coding test
Technical interview
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for LTIMindtreeStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Traffic is taking a slow path because an old access switch became root bridge. How do you fix it?
The old switch has the lowest MAC with default priority, so it won the election. I set the core or distribution switch as root with spanning-tree vlan 1-4094 priority 4096, or root primary, and the secondary with 8192. I add Root Guard on distribution downlinks so access switches can never become root again. Then I verify with show spanning-tree root.
02
What is the difference between standard and extended ACLs?
Standard ACLs (1 to 99 and 1300 to 1999) match only the source IP, so they should be placed close to the destination. Extended ACLs (100 to 199 and 2000 to 2699) match protocol, source, destination and ports, so they can be placed close to the source to drop unwanted traffic early. Named ACLs work for both and allow editing individual lines by sequence number.
TCP is connection-oriented: it uses a three-way handshake, sequence numbers, acknowledgements, retransmission, windowing and flow control, so delivery is reliable and ordered. UDP is connectionless with an 8-byte header and no retransmission, so it is faster and lighter. HTTPS, SSH and SMTP use TCP; DNS queries, DHCP, SNMP, TFTP and voice or video RTP streams use UDP.
04
How do you make an access switch port a routed port on a Layer 3 switch?
A routed port behaves like a router interface and does not belong to any VLAN.
interface GigabitEthernet1/0/1
no switchport
ip address 10.0.0.1 255.255.255.252
no shutdown
Routed uplinks between distribution and core avoid spanning tree on those links and allow fast routing convergence with ECMP.
05
What is the difference between a two-tier and a three-tier campus design?
A three-tier design has access, distribution and core layers: access connects users, distribution aggregates access switches and applies policy, and the core provides fast transport between distribution blocks. A two-tier or collapsed-core design merges core and distribution, which suits small and medium campuses with fewer buildings. Three-tier scales better when there are many distribution blocks.
06
What is the difference between a hub, a switch and a router?
A hub is a Layer 1 repeater: it floods every bit out of every port, so all ports share one collision domain. A switch is Layer 2: it learns MAC addresses and forwards frames only to the correct port, giving each port its own collision domain. A router is Layer 3: it forwards packets between IP networks and separates broadcast domains.
A VLAN is a logical Layer 2 broadcast domain created on a switch, independent of physical location. VLANs separate users, voice, guests and servers, reduce broadcast traffic, and improve security because traffic between VLANs must pass through a router or Layer 3 switch where it can be filtered. For example, finance and guest Wi-Fi users can share switches but stay isolated.
The router ID is a 32-bit value chosen in this order: manually configured router-id, then the highest IP on an up loopback interface, then the highest IP on an up physical interface. It is chosen when the OSPF process starts, so changes need clear ip ospf process. Best practice is to set it manually so it is stable and easy to recognise in the database.
09
How does a router choose the best route to a destination?
First it uses longest prefix match: the most specific matching prefix wins, so 10.1.1.0/24 beats 10.1.0.0/16. If the same prefix comes from different sources, the lowest administrative distance wins. If the same protocol offers several paths, the lowest metric wins, and equal metrics can be load-balanced with ECMP. Only the winners are installed in the routing table.
10
What is the difference between site-to-site and remote-access VPNs?
A site-to-site VPN connects whole networks, usually two routers or firewalls, using an always-on IPsec tunnel, so users do not need any client. A remote-access VPN connects individual users from laptops or phones to the company network using a client with TLS or IPsec, and authenticates each user. Both encrypt traffic over the internet to provide confidentiality and integrity.
Areas limit how far detailed LSAs flood, so SPF runs on a smaller database and changes in one area do not force recalculation everywhere. Area 0 is the backbone and every other area must connect to it, directly or through a virtual link. Routers connecting areas are ABRs and can summarize routes between areas. Single-area OSPF is the focus of CCNA.
12
How do you check interface status and errors on an IOS device?
show ip interface brief gives status and IP of all interfaces, and show interfaces gives counters and duplex.
Router# show ip interface brief
Router# show interfaces GigabitEthernet0/1
Router# show interfaces status
Router# clear counters GigabitEthernet0/1
Status up/down means Layer 1 is up but Layer 2 keepalives fail; administratively down means the interface is shut.
13
What are the key elements of a security program for a network?
A security program combines user awareness training, physical access control, and technical controls such as strong authentication, firewalls, IPS, VPNs and patching. It is built around the CIA triad: confidentiality, integrity and availability. Policies define what is allowed, and logging and monitoring detect problems. CCNA focuses on device hardening, ACLs, Layer 2 security, AAA, VPNs and wireless security.
WPA2 uses AES-CCMP; WPA2-Personal uses a pre-shared key that is vulnerable to offline dictionary attacks, and WPA2-Enterprise uses 802.1X with RADIUS. WPA3-Personal replaces PSK with SAE, which resists offline guessing and gives forward secrecy. WPA3-Enterprise offers a 192-bit mode. WPA3 requires protected management frames. Open networks can use OWE for encryption without passwords.
Switches exchange BPDUs and the one with the lowest bridge ID becomes root. The bridge ID is the priority (default 32768 plus the VLAN number in PVST) followed by the MAC address, so if priorities tie, the lowest MAC wins. Because the oldest switch often has the lowest MAC, you should set priority manually, for example spanning-tree vlan 10 root primary on the core.
16
What is a REST API and which HTTP methods map to CRUD?
A REST API exposes resources at URLs and is stateless, usually with JSON payloads over HTTPS. CRUD maps to HTTP verbs: POST creates, GET reads, PUT replaces or PATCH partly updates, and DELETE removes. Responses use status codes such as 200 OK, 201 Created, 401 Unauthorized, 404 Not Found and 500 Server Error. Controllers expose northbound REST APIs for automation.
17
What is AAA and the difference between TACACS+ and RADIUS?
AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.
When a host needs the MAC for an IP on its subnet, it broadcasts an ARP request and the owner replies with a unicast ARP reply; the result is cached. For remote destinations the host ARPs for its default gateway. A gratuitous ARP is an unsolicited announcement of a host's own IP-to-MAC mapping, used after failover, for example by HSRP, to update switch and host tables.
19
How do you prioritise when several tickets arrive at the same time?
Situation: on a night shift I got a core link down alert, two user tickets and a printer issue at once. Task: handle everything with minimum impact. Action: I prioritised by business impact, confirmed redundancy had taken over for the core link, raised a priority ticket with the carrier, then fixed the user tickets and logged the printer for morning. Result: no SLA was breached and the handover was clear.
Put members in a channel group with mode active, then configure the port-channel.
interface range GigabitEthernet1/0/47 - 48
channel-group 1 mode active
interface Port-channel1
switchport mode trunk
switchport trunk allowed vlan 10,20,99
port-channel load-balance src-dst-ip
show etherchannel summary
IPsec uses IKE (v1 or v2) to authenticate peers and negotiate keys, ESP to encrypt and authenticate data, and optionally AH for authentication only, which breaks with NAT. Algorithms include AES for encryption, SHA-256 for integrity and Diffie-Hellman groups for key exchange. Tunnel mode encrypts the whole original packet and is used for site-to-site VPNs.
22
What is the structure of an IPv6 address and how is it shortened?
IPv6 addresses are 128 bits written as eight groups of four hex digits separated by colons. Leading zeros in each group can be dropped, and one run of consecutive all-zero groups can be replaced with :: only once. For example 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1. A typical LAN uses a /64 prefix.
The client sends a SYN with an initial sequence number. The server replies with SYN-ACK, acknowledging the client sequence and sending its own. The client sends an ACK and the session is established. Closing uses FIN and ACK from each side. A firewall that sees repeated SYNs without the final ACK may be looking at a SYN flood attack.
24
What are the IPv4 address classes and private ranges?
Class A is 1 to 126 with a default /8, Class B is 128 to 191 with /16, Class C is 192 to 223 with /24, Class D 224 to 239 is multicast and Class E is reserved. RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 127.0.0.0/8 is loopback and 169.254.0.0/16 is APIPA link-local. Today addressing is classless (CIDR).
25
What is EUI-64 and how is the interface ID generated?
EUI-64 builds a 64-bit interface ID from a 48-bit MAC. Split the MAC in half, insert FFFE in the middle and flip the seventh bit of the first byte. For MAC 0050.56AB.CDEF the ID becomes 0250:56FF:FEAB:CDEF. Routers can use ipv6 address 2001:db8:1::/64 eui-64. Hosts often prefer random privacy addresses instead, to avoid exposing the MAC.
26
What is the native VLAN and what problems can a mismatch cause?
The native VLAN is the VLAN whose frames cross a trunk untagged, VLAN 1 by default. Both ends must use the same native VLAN; if they differ, frames leak between VLANs and CDP logs a native VLAN mismatch. For security, set the native VLAN to an unused ID, do not put users in it, and optionally tag it with vlan dot1q tag native to prevent VLAN hopping.
DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.
28
What are the default administrative distances you should know?
Connected 0, static 1, EIGRP summary 5, eBGP 20, internal EIGRP 90, OSPF 110, IS-IS 115, RIP 120, external EIGRP 170 and iBGP 200. A value of 255 means the route is never used. AD compares trust between sources, so a static route with AD 1 beats OSPF for the same prefix unless you configure a floating static with a higher AD.
RFC 3021 allows /31 on point-to-point links because there is no need for network and broadcast addresses when only two devices exist. A /31 gives exactly two usable addresses, saving half the space of a /30. It is common on ISP and data center fabric links. Both ends must support it; on IOS you simply configure ip address 10.0.0.0 255.255.255.254.
Member interfaces must have the same speed and duplex, the same mode (access or trunk), the same access VLAN or the same native and allowed VLAN list on trunks, and compatible negotiation modes. Mismatched settings put members into suspended state. Configure settings on the port-channel interface so they are pushed to members, and verify with show etherchannel summary.
Tips to crack the LTIMindtree CCNA interview
Practise aptitude, logical reasoning and basic coding questions, as the online assessment is usually the first filter.
Revise SQL, OOP and testing fundamentals, plus any cloud or data tools you list on your resume.
Learn about the L&T Group background and the LTI and Mindtree merger to answer company-related questions.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; LTIMindtree interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the LTIMindtree CCNA interview?
Candidates usually go through 4 stages: Online assessment (aptitude + reasoning); Coding test; Technical interview; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the LTIMindtree CCNA interview?
This practice set leans on Network Security (6), STP and EtherChannel (5), Network Fundamentals (5), IP Addressing and Subnetting (5). Revise those first, then practise explaining one or two of your own projects end to end, because most LTIMindtree interviewers ask you to walk through real work.
Are these the exact questions asked at LTIMindtree?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like LTIMindtree's. They are not a leaked or verified list of past questions.
Where does LTIMindtree hire CCNA professionals in India?
LTIMindtree has large teams in Mumbai, Pune, Bengaluru, Chennai, Hyderabad. Openings and locations change often, so check the LTIMindtree careers page and filter by city and experience.