Medium CCNA Interview Questions

A collision domain is a segment where two devices sending at the same time can collide; every switch port is its own collision domain, and with full duplex collisions do not occur. A broadcast domain is the set of devices that receive a Layer 2 broadcast. Routers and VLANs separate broadcast domains, so one VLAN equals one broadcast domain.

Single-mode fiber has a small core (about 9 microns) and uses a laser, so it carries light over long distances, often 10 km or more. Multimode fiber has a larger core (50 or 62.5 microns), uses cheaper LED or VCSEL optics and suits shorter runs inside a building or data center, usually up to a few hundred metres at 10 Gbps. SFP modules must match the fiber type.

A three-tier design has access, distribution and core layers: access connects users, distribution aggregates access switches and applies policy, and the core provides fast transport between distribution blocks. A two-tier or collapsed-core design merges core and distribution, which suits small and medium campuses with fewer buildings. Three-tier scales better when there are many distribution blocks.

In spine-leaf, every leaf switch connects to every spine switch, and servers connect only to leaves. Any server is therefore at most two hops from another, giving predictable latency and good east-west bandwidth. Capacity is added by adding spines or leaves. It usually runs Layer 3 with ECMP to use all links, instead of relying on spanning tree.

Late collisions usually mean a duplex mismatch, and CRC errors point to bad cabling or interference. I would run show interfaces on the port to see duplex, speed and error counters, check the PC NIC settings, and set both sides to auto or hard-code both identically. Then I would replace the patch cable, clear counters and watch whether errors still increase.

Gateway reachability proves Layers 1 to 3 locally, so I move upward. I ping a public IP address; if that works but names fail, DNS is the problem, so I check the configured DNS server with ipconfig /all and test with nslookup. If the public IP also fails, I check the router's default route, NAT and upstream link. Finally I check proxy settings and any firewall blocking ports 80 and 443.

A branch router or SD-WAN edge for the WAN link and internet, one or two 48-port PoE access switches for PCs, phones and access points, and wireless access points managed by a controller or the cloud. I would add a firewall function, DHCP and DNS settings, VLANs for data, voice, guest and management, and a backup 4G or broadband link for resilience.

A switch reads the source MAC of each incoming frame and records it with the port in the MAC address table. For forwarding it looks up the destination MAC: a known unicast goes out one port, while unknown unicast, broadcast and most multicast frames are flooded in the VLAN. Entries age out after 300 seconds by default. Check with show mac address-table.

Situation: a branch lost access to the data center during month-end close. Task: restore service fast. Action: I worked bottom-up, found the WAN link up but OSPF stuck in EXSTART, and traced it to an MTU change by the provider. I set ip ospf mtu-ignore as a temporary fix and raised a ticket for the MTU. Result: service was back in 25 minutes and I documented the check in our runbook.

Variable Length Subnet Masking means using different prefix lengths inside one address block, so each subnet is sized to its need. You allocate the largest subnets first, then smaller ones, to avoid overlaps. For example, from 10.1.1.0/24 you could give a 100-user LAN a /25, a 50-user LAN a /26, and point-to-point WAN links /30 or /31. It saves address space compared with fixed-length subnetting.

Summarization advertises one prefix that covers several contiguous networks, shrinking routing tables and hiding instability. Write the networks in binary and keep the common leading bits. For 10.1.4.0/24 to 10.1.7.0/24, the third octet values 4 to 7 share the first six bits (000001), so the summary is 10.1.4.0/22. Make sure the summary does not include networks that live elsewhere.

RFC 3021 allows /31 on point-to-point links because there is no need for network and broadcast addresses when only two devices exist. A /31 gives exactly two usable addresses, saving half the space of a /30. It is common on ISP and data center fabric links. Both ends must support it; on IOS you simply configure ip address 10.0.0.0 255.255.255.254.

Global unicast (2000::/3) is publicly routable. Unique local (fc00::/7, in practice fd00::/8) is like private IPv4. Link-local (fe80::/10) is auto-created on every IPv6 interface and used for neighbour discovery and routing next hops. Multicast is ff00::/8, for example ff02::1 all nodes and ff02::2 all routers. Anycast is a unicast address shared by several devices. IPv6 has no broadcast.

With SLAAC a host learns the /64 prefix from a router advertisement and builds its own interface ID, without a server. Stateless DHCPv6 adds extra options such as DNS while the address still comes from SLAAC. Stateful DHCPv6 assigns the address itself and keeps bindings, similar to DHCPv4. RA flags M (managed) and O (other config) tell hosts which method to use.

Each host decides local or remote using its own mask. With 192.168.1.10/24 and 192.168.1.200/25, the first thinks .200 is local and ARPs directly, but the second sees .10 as remote and sends replies to its gateway. Traffic can become one-way or asymmetric and may break completely if the gateway does not route it back. Fix the mask so both match the design.

Options: expand to a /23 if the adjacent block is free and update the router and DHCP scope; create a new VLAN and subnet for some users, which also limits broadcast size; shorten DHCP lease times if many guest devices hold leases; and move printers, phones and IoT devices to their own subnets. Long term, plan an addressing scheme with growth headroom and consider dual-stack IPv6.

Situation: I applied a /25 mask instead of /24 on a core VLAN interface during a change window. Task: fix it fast and own the error. Action: monitoring alerted on half the users, I checked my change, corrected the mask within ten minutes and informed my lead immediately. Result: impact was short, and I added a peer-review step and a pre-written rollback to every change plan afterwards.

I start with the block-size method instead of binary tables, because it is fast and easy to remember. I give them daily five-minute subnetting drills, then real tickets where I let them lead while I watch and ask questions. For example, one junior engineer kept guessing during outages, so I taught him a fixed bottom-up checklist. Within two months he was closing Layer 2 and Layer 3 tickets on his own and teaching the next new joiner.

The native VLAN is the VLAN whose frames cross a trunk untagged, VLAN 1 by default. Both ends must use the same native VLAN; if they differ, frames leak between VLANs and CDP logs a native VLAN mismatch. For security, set the native VLAN to an unused ID, do not put users in it, and optionally tag it with vlan dot1q tag native to prevent VLAN hopping.

Dynamic Trunking Protocol negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access. Auto plus auto stays access, while desirable with auto or desirable forms a trunk. Attackers can use DTP to form a trunk and reach all VLANs, so best practice is to hard-code access or trunk and use switchport nonegotiate on trunks.

VLAN Trunking Protocol shares VLAN definitions from a server switch to clients in the same VTP domain. Modes are server, client, transparent and off. The risk is that a switch with a higher configuration revision number can overwrite and wipe VLANs across the domain. Many networks use transparent mode or VTP version 3 with a primary server to avoid this.

A voice VLAN lets an IP phone and a PC share one switch port while keeping their traffic separate. The port is an access port in the data VLAN, and the switch tells the phone through CDP or LLDP-MED to tag voice frames with the voice VLAN. This allows QoS priority for voice and separate addressing. Configure it with switchport voice vlan.

A Layer 3 switch forwards packets between VLANs in hardware using SVIs or routed ports, giving very high throughput with many Ethernet ports. A router usually has fewer ports but richer WAN features such as NAT, VPN, deep QoS, varied WAN interfaces and large routing tables. In campuses, Layer 3 switches handle inter-VLAN routing while routers or firewalls handle the edge.

First I check each PC has the correct IP, mask and gateway for its VLAN. Then I confirm the switch ports are in the right VLANs with show vlan brief, and that the trunk to the Layer 3 device allows both VLANs using show interfaces trunk. On the Layer 3 device I check the SVIs or subinterfaces are up and have the right IPs, and that no ACL blocks the traffic.

The most likely cause is the trunk to that switch does not allow the new VLAN, because someone configured an explicit allowed list. Check show interfaces trunk and add it with switchport trunk allowed vlan add 50, not without add, which would replace the list. Also confirm the VLAN exists on that switch with show vlan brief, especially if VTP is transparent.

I check show interfaces trunk and show interfaces switchport on both sides. Common causes are mismatched modes (both dynamic auto), one side hard-coded as access, encapsulation not set on older switches, or the port being err-disabled. Native VLAN mismatch and allowed list differences do not stop the trunk but break traffic. Best fix is switchport mode trunk on both ends with nonegotiate.

Situation: we had to migrate 30 access ports to new VLANs overnight. Task: finish with zero business impact. Action: I prepared configs in advance, got peer review, scheduled a rollback, informed the helpdesk and tested each floor with a laptop after changes. Result: the migration finished an hour early, morning tickets were zero, and the plan became our template for later VLAN changes.

MAC flapping means the switch sees the same source MAC arriving on two ports, which usually points to a Layer 2 loop, a misconfigured server NIC team, or a virtual machine host bridging two uplinks. Check show mac address-table for the MAC, trace both ports, verify STP state and look for unmanaged switches or hypervisor teaming in active-active mode without a matching port channel. Fix the loop or teaming, and keep BPDU Guard on access ports.

Every non-root switch picks one root port, its best path to the root based on lowest root path cost, then lowest sender bridge ID, then lowest sender port ID. On each segment, the switch with the best path becomes the designated port and forwards. Every remaining port becomes non-designated and blocks. All ports on the root bridge are designated.

States are blocking, listening, learning, forwarding and disabled. Timers are hello 2 seconds, forward delay 15 seconds and max age 20 seconds. A port moves from blocking through listening and learning, each 15 seconds, so convergence can take 30 to 50 seconds. That delay is why Rapid STP and PortFast are used in modern networks.

Rapid PVST+ runs 802.1w per VLAN. It uses a proposal and agreement handshake on point-to-point links so ports move to forwarding in under a second, instead of waiting on timers. It has port roles root, designated, alternate and backup, and states discarding, learning and forwarding. Alternate ports provide an instant backup root port. It is the default on most modern IOS switches.

With short (802.1D revised) costs: 10 Mbps is 100, 100 Mbps is 19, 1 Gbps is 4 and 10 Gbps is 2. With the long pathcost method, 1 Gbps is 20000 and 10 Gbps is 2000, which distinguishes higher speeds. Root path cost is the sum of costs on ports toward the root, and the lowest total wins when choosing root ports.

LACP (802.3ad, now 802.1AX) is the open standard with modes active and passive; at least one side must be active. PAgP is proprietary with modes desirable and auto; at least one side must be desirable. Mode on forces the channel with no negotiation, which can cause loops if the other side is not configured. LACP is preferred because it works with servers, firewalls and other vendors.

Member interfaces must have the same speed and duplex, the same mode (access or trunk), the same access VLAN or the same native and allowed VLAN list on trunks, and compatible negotiation modes. Mismatched settings put members into suspended state. Configure settings on the port-channel interface so they are pushed to members, and verify with show etherchannel summary.

Two wall ports patched to the same switch formed a loop. To stop it now, I find the port with rising broadcast counters and shut it. To prevent repeats, enable PortFast with BPDU Guard on all access ports, keep Rapid PVST+ running everywhere, add storm-control broadcast thresholds on access ports and enable errdisable recovery with a sensible interval.

The old switch has the lowest MAC with default priority, so it won the election. I set the core or distribution switch as root with spanning-tree vlan 1-4094 priority 4096, or root primary, and the secondary with 8192. I add Root Guard on distribution downlinks so access switches can never become root again. Then I verify with show spanning-tree root.

Suspended (s) usually means a configuration mismatch between members or with the far end. I compare speed, duplex, trunk mode, native VLAN and allowed VLANs on each member and the port-channel with show run interface, check LACP modes on both sides, and look at logs. I fix the config on the port-channel, then shut and no shut members so they rejoin. show etherchannel summary should show P flags.

Situation: our team moved from PVST to MST for a data center with 600 VLANs, and I had not used MST. Task: be ready for the migration in two weeks. Action: I read the configuration guides, built the design in a GNS3 lab, broke it deliberately and wrote a step-by-step checklist. Result: the migration ran in one window without outage, and I ran a short knowledge session for the team.

A floating static route is a backup static route with a higher administrative distance than the primary route, so it stays out of the routing table until the primary disappears. For example, if OSPF (AD 110) learns the main path, ip route 0.0.0.0 0.0.0.0 203.0.113.1 200 installs only when OSPF loses the route. It is common for backup internet or 4G links.

Distance vector protocols like RIP share their routing table with neighbours and trust what they hear, so they converge slowly and need loop prevention such as split horizon. Link state protocols like OSPF and IS-IS flood link state advertisements so each router builds a full topology map and runs Dijkstra's SPF algorithm. Link state converges faster and scales better but uses more memory and CPU.

Routers send hellos to 224.0.0.5. They become neighbours if area ID, subnet and mask, hello and dead timers, authentication and stub flags match, and the router IDs are unique. States go Down, Init, 2-Way, ExStart, Exchange, Loading and Full. In ExStart and Exchange they agree master and slave and swap database descriptions, which is where an MTU mismatch causes a stuck adjacency.

On multi-access networks such as Ethernet, a full mesh of adjacencies would create too many LSAs. OSPF elects a Designated Router and Backup DR; other routers (DROTHERs) form full adjacency only with them and stay 2-Way with each other. The highest interface priority wins, then highest router ID; priority 0 means never DR. Election is non-preemptive, so a new better router does not take over.

Cost equals reference bandwidth divided by interface bandwidth. The default reference is 100 Mbps, so FastEthernet, Gigabit and 10 Gigabit all get cost 1, which hides the faster links. Change it with auto-cost reference-bandwidth 100000 on every router so 1G becomes 100 and 10G becomes 10. You can also set ip ospf cost directly on an interface. Path cost is the sum of outgoing interface costs.

Areas limit how far detailed LSAs flood, so SPF runs on a smaller database and changes in one area do not force recalculation everywhere. Area 0 is the backbone and every other area must connect to it, directly or through a virtual link. Routers connecting areas are ABRs and can summarize routes between areas. Single-area OSPF is the focus of CCNA.

FHRPs give hosts a virtual gateway IP shared by two or more routers. HSRP is proprietary: routers elect an active router by highest priority (default 100), and the standby takes over the virtual IP and MAC if hellos stop. Preempt lets a higher priority router reclaim the role. VRRP is the open standard, and GLBP adds load sharing across several routers.

I check that the interfaces are up and in the same subnet, then show ip ospf interface to compare area, hello and dead timers, network type and authentication. I make sure the interface is not passive and that the network statement or ip ospf area command covers it. Finally I check that no ACL blocks protocol 89 or multicast 224.0.0.5, and use debug ip ospf adj if needed.

Situation: a routing loop during a carrier change caused a two-hour outage and the operations head wanted an explanation. Task: explain cause and prevention simply. Action: I used a road map analogy, explained that two routers kept sending traffic to each other, showed the timeline and our fix, and listed three prevention steps with dates. Result: management approved a proper change review board, and trust in our team improved.

Situation: a senior engineer wanted static routes for twelve new branches. Task: I believed OSPF would scale better. Action: instead of arguing in the meeting, I built both options in a lab, measured failover time and listed the change effort for each. I shared the results privately first. Result: we agreed on OSPF with summarization at the hub, and he asked me to write the standard. I learned that data persuades better than opinions.

Inside local is the private address of an inside host, for example 192.168.1.10. Inside global is the public address that represents it outside, for example 203.0.113.5. Outside global is the real address of the remote host. Outside local is how the remote host appears to inside users, usually the same as outside global unless destination NAT is used. show ip nat translations displays these columns.

A client asks its configured resolver, for example for www.example.com. If it is not cached, the resolver queries a root server, which refers it to the .com TLD server, which refers it to the authoritative server for example.com, which returns the A or AAAA record. The answer is cached for its TTL. DNS uses UDP 53 for most queries and TCP 53 for zone transfers and large replies.

SNMP lets a manager poll devices for counters and receive traps or informs about events, using a MIB with OIDs. Polling uses UDP 161 and traps UDP 162. SNMPv2c uses a plain-text community string with no encryption. SNMPv3 adds user-based authentication and encryption with authPriv mode, so it is the version to use in production, especially on networks reachable from many teams.

Quality of Service gives different treatment to traffic types when links are congested. Voice needs low delay (under 150 ms one way), low jitter (under 30 ms) and low loss (under 1 percent), while bulk file transfer can wait. QoS tools classify and mark traffic, queue it with priority queues for voice, and police or shape rates. Without congestion QoS has no effect.

I check show ip nat translations to see whether translations appear when users browse. If none, I verify ip nat inside and ip nat outside on the correct interfaces, that the ACL used by NAT matches the user subnets, and that the overload interface has an IP. I also check the default route and run show ip nat statistics for hits and misses.

I check that the SVI for the new VLAN is up and has ip helper-address pointing to the DHCP server, that the server has a scope for that subnet with the right gateway, and that the scope is activated. I confirm the VLAN is allowed on trunks. If DHCP snooping is enabled, I check the uplink is trusted, otherwise offers from the server are dropped.

Clocks are not synchronised. I configure all devices to use the same internal NTP servers with ntp server, set the timezone with clock timezone IST 5 30, add service timestamps log datetime msec localtime, and enable NTP authentication. Then I check show ntp associations and show ntp status to confirm synchronisation. This makes future incident timelines reliable.

Use static NAT or port forwarding so the public IP maps to the server's private IP, for example ip nat inside source static tcp 192.168.1.20 443 203.0.113.10 443. Add an ACL or firewall rule allowing only port 443 inbound, put the server in a DMZ VLAN, and create a public DNS record. Ideally place a firewall or reverse proxy in front instead of exposing the server directly.

Situation: our team manually backed up 80 router configs each week. Task: save time and avoid missed backups. Action: I enabled the archive feature with time-period on each device and later wrote a small Python script with Netmiko to pull and store configs in Git. Result: weekly effort dropped from four hours to zero, and we could see config differences after every change.

The phones need extra DHCP options that were probably not copied, such as option 150 or option 66 for the TFTP or call server and sometimes a voice VLAN option. Check the scope options on the new server, confirm the relay on each SVI points to it, and capture the DHCP offer to see which options arrive. Also verify the voice VLAN scope exists and that ACLs allow TFTP from the phone subnets to the call server.

A wildcard mask tells the router which bits must match: 0 means must match and 1 means ignore. It is often the inverse of the subnet mask, so 192.168.1.0 0.0.0.255 matches the whole /24. host 10.1.1.1 equals 0.0.0.0 and any equals 255.255.255.255. Wildcards are also used in OSPF network statements. Calculate it by subtracting the mask from 255.255.255.255.

Port security limits the MAC addresses allowed on an access port, either statically or by sticky learning. If an extra MAC appears, the violation mode acts: shutdown (default) err-disables the port, restrict drops the frames, logs and increments a counter, and protect silently drops frames. It stops MAC flooding and unauthorised devices on user ports.

DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.

AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.

A site-to-site VPN connects whole networks, usually two routers or firewalls, using an always-on IPsec tunnel, so users do not need any client. A remote-access VPN connects individual users from laptops or phones to the company network using a client with TLS or IPsec, and authenticates each user. Both encrypt traffic over the internet to provide confidentiality and integrity.

Most likely the ACL lacks a permit for normal traffic, so the implicit deny dropped everything, or the order put a broad deny above the specific permits. It may also be applied in the wrong direction or on the wrong interface. I check show access-lists for hit counts, fix the sequence by inserting lines, and add a final permit or the needed entries. I always test ACLs with a rollback timer.

A rogue DHCP server, often a home router plugged into a wall port, is answering requests. I find it by checking the DHCP server IP on an affected client with ipconfig /all, then tracing its MAC with show mac address-table. I shut that port, and prevent it permanently by enabling DHCP snooping on user VLANs with only uplinks trusted.

Put guests in their own VLAN and subnet, ideally terminating on a firewall or a separate VRF. Apply an inbound extended ACL on the guest SVI that permits DHCP and DNS to the allowed servers, denies all RFC 1918 destinations, and then permits any to the internet. Enable client isolation on the wireless side and rate limit the guest SSID so it cannot consume the WAN.

Situation: during a routine audit I noticed SNMP v2c with the default community public on several access switches. Task: close the gap without disrupting monitoring. Action: I reported it to my lead with evidence, proposed SNMPv3 with an ACL, tested with the monitoring team and rolled out in two batches. Result: the risk was closed in a week and SNMP checks were added to our device baseline.

Autonomous APs are configured one by one and suit very small sites. Lightweight APs are managed by a Wireless LAN Controller using CAPWAP tunnels, which centralises configuration, RF management and roaming, and suits campuses. Cloud-managed APs are configured from a cloud dashboard, ideal for many branches. Split-MAC means real-time functions stay on the AP while management sits on the controller.

Control and Provisioning of Wireless Access Points is the protocol between lightweight APs and the WLC. It builds two tunnels: a control tunnel on UDP 5246, encrypted with DTLS, and a data tunnel on UDP 5247 that carries client traffic in central switching mode. In FlexConnect or local switching mode, client data is switched locally at the AP instead of being tunnelled.

WPA2 uses AES-CCMP; WPA2-Personal uses a pre-shared key that is vulnerable to offline dictionary attacks, and WPA2-Enterprise uses 802.1X with RADIUS. WPA3-Personal replaces PSK with SAE, which resists offline guessing and gives forward secrecy. WPA3-Enterprise offers a 192-bit mode. WPA3 requires protected management frames. Open networks can use OWE for encryption without passwords.

Traditionally each device has its own control plane and is configured box by box. In controller-based or software-defined networking, a central controller holds the policy and pushes it to devices through southbound APIs such as NETCONF or OpenFlow, while applications talk to the controller through northbound REST APIs. This gives consistent configuration, automation and network-wide visibility.

Ansible is agentless, uses SSH or APIs, writes playbooks in YAML and uses a push model, so it is the most popular for network devices. Puppet uses an agent, a declarative manifest language and a pull model. Chef uses Ruby-based recipes with an agent and pull model. Puppet and Chef are more common for servers. All support idempotent configuration management.

This is usually a capacity, not a coverage, issue. I check client count per AP and channel utilisation on the controller. Fixes include adding APs with lower transmit power, steering clients to 5 or 6 GHz with band steering, disabling low data rates such as 1, 2 and 5.5 Mbps, using 20 or 40 MHz channels in dense areas, and limiting per-client bandwidth on the SSID.

Association works, so the issue is between the AP or WLC and DHCP. I check the WLAN is mapped to the right dynamic interface and VLAN, that the VLAN is allowed on the WLC and AP trunks, and that DHCP relay or helper is set on the VLAN gateway. In FlexConnect local switching, I check the AP switchport trunk and VLAN mapping. Finally I check the DHCP scope.

401 Unauthorized means authentication failed. I check the username and password or API key, whether a token must first be requested from an auth endpoint and sent in a header like X-Auth-Token, whether the token expired, and the exact header name and format. I test the same call with curl or an API client to separate script bugs from credential issues.

Steps on a typical WLC GUI: create a dynamic interface with VLAN, IP and DHCP server; go to WLANs and create a new WLAN with profile name and SSID; map it to the dynamic interface; under Security choose WPA2 or WPA3 with PSK or 802.1X and add the RADIUS server for enterprise; set QoS profile; enable the WLAN and apply it to AP groups.

Situation: our team got many Wi-Fi complaints but had no data. Task: nobody had asked, but I wanted to find the cause. Action: I did a walk-through survey with a free tool, mapped channels and signal, and found three APs on the same 2.4 GHz channel and one dead AP. I shared a short report with fixes. Result: after the changes, Wi-Fi tickets dropped by about 60 percent in a month.