Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Nokia hiring for CCNA roles
Nokia is a Finnish technology company that today focuses on telecom network infrastructure, including mobile networks, fixed broadband, optical and IP networks, and cloud network software. It also runs Nokia Bell Labs for research. In India it has research, development and manufacturing operations and hires software engineers, network engineers, testers and hardware engineers.
For CCNA roles, this Nokia practice set focuses most on Wireless and Automation (7), IP Addressing and Subnetting (5), IP Services (4), Network Security (4). It has 7 easy, 20 medium, 3 hard questions, so you can start easy and work up to the harder ones.
Company type
Telecom
Headquarters
Espoo, Finland
Main India offices
Bengaluru, Chennai, Noida, Gurugram
Nokia CCNA interview process
Online assessment (aptitude + technical)
Technical interview 1
Technical interview 2 or managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for NokiaStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Member interfaces must have the same speed and duplex, the same mode (access or trunk), the same access VLAN or the same native and allowed VLAN list on trunks, and compatible negotiation modes. Mismatched settings put members into suspended state. Configure settings on the port-channel interface so they are pushed to members, and verify with show etherchannel summary.
Configure the same group and virtual IP on both switches, with higher priority on the active one.
interface vlan 10
ip address 192.168.10.2 255.255.255.0
standby version 2
standby 10 ip 192.168.10.1
standby 10 priority 110
standby 10 preempt
show standby brief
Hosts use 192.168.10.1 as their gateway.
WPA2 uses AES-CCMP; WPA2-Personal uses a pre-shared key that is vulnerable to offline dictionary attacks, and WPA2-Enterprise uses 802.1X with RADIUS. WPA3-Personal replaces PSK with SAE, which resists offline guessing and gives forward secrecy. WPA3-Enterprise offers a 192-bit mode. WPA3 requires protected management frames. Open networks can use OWE for encryption without passwords.
04
How do you approach working in a 24x7 network operations shift?
Situation: I joined a NOC that ran rotating shifts. Task: stay effective and keep handovers clean. Action: I followed runbooks, kept a shift log of every alert and action, raised early escalations for anything outside my scope and used quiet hours to lab new topics. Result: I handled shift incidents within SLA, earned positive feedback for clear handovers and was moved to the L2 team in a year.
DHCP Discover is a broadcast, and routers do not forward broadcasts, so a central DHCP server cannot hear clients on other subnets. A relay agent, configured with ip helper-address on the gateway interface, converts the broadcast into a unicast to the server and adds the gateway IP so the server picks the right scope. This lets one server serve many VLANs.
06
What is SNMP and the differences between v2c and v3?
SNMP lets a manager poll devices for counters and receive traps or informs about events, using a MIB with OIDs. Polling uses UDP 161 and traps UDP 162. SNMPv2c uses a plain-text community string with no encryption. SNMPv3 adds user-based authentication and encryption with authPriv mode, so it is the version to use in production, especially on networks reachable from many teams.
07
How do you configure IPv4 and IPv6 on a router interface?
Enable IPv6 routing globally, then add both addresses to the interface.
ipv6 unicast-routing
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
ipv6 address 2001:db8:1:1::1/64
ipv6 address fe80::1 link-local
no shutdown
Verify with show ip interface brief and show ipv6 interface brief.
08
How do you back up and restore a device configuration?
Copy the config to a server and back.
copy running-config tftp://10.0.0.40/R1-backup.cfg
copy running-config scp://admin@10.0.0.40/R1.cfg
copy tftp://10.0.0.40/R1-backup.cfg running-config
configure replace flash:R1-good.cfg
archive
path flash:R1-archive
write-memory
configure replace gives a clean rollback instead of merging.
09
Write a simple Ansible playbook that configures NTP on IOS devices.
Traditionally each device has its own control plane and is configured box by box. In controller-based or software-defined networking, a central controller holds the policy and pushes it to devices through southbound APIs such as NETCONF or OpenFlow, while applications talk to the controller through northbound REST APIs. This gives consistent configuration, automation and network-wide visibility.
11
Users suddenly receive IP addresses from a wrong subnet. What do you suspect and how do you fix it?
A rogue DHCP server, often a home router plugged into a wall port, is answering requests. I find it by checking the DHCP server IP on an affected client with ipconfig /all, then tracing its MAC with show mac address-table. I shut that port, and prevent it permanently by enabling DHCP snooping on user VLANs with only uplinks trusted.
12
What is SLAAC and how is it different from DHCPv6?
With SLAAC a host learns the /64 prefix from a router advertisement and builds its own interface ID, without a server. Stateless DHCPv6 adds extra options such as DNS while the address still comes from SLAAC. Stateful DHCPv6 assigns the address itself and keeps bindings, similar to DHCPv4. RA flags M (managed) and O (other config) tell hosts which method to use.
13
What is AAA and the difference between TACACS+ and RADIUS?
AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.
The router ID is a 32-bit value chosen in this order: manually configured router-id, then the highest IP on an up loopback interface, then the highest IP on an up physical interface. It is chosen when the OSPF process starts, so changes need clear ip ospf process. Best practice is to set it manually so it is stable and easy to recognise in the database.
802.11n (Wi-Fi 4) works on 2.4 and 5 GHz with MIMO. 802.11ac (Wi-Fi 5) is 5 GHz only with wider channels and MU-MIMO downlink. 802.11ax (Wi-Fi 6 and 6E) adds OFDMA, BSS colouring and target wake time, and 6E adds the 6 GHz band. 802.11be (Wi-Fi 7) adds 320 MHz channels and multi-link operation. India opened part of the 6 GHz band for indoor use.
16
How do you make an access switch port a routed port on a Layer 3 switch?
A routed port behaves like a router interface and does not belong to any VLAN.
interface GigabitEthernet1/0/1
no switchport
ip address 10.0.0.1 255.255.255.252
no shutdown
Routed uplinks between distribution and core avoid spanning tree on those links and allow fast routing convergence with ECMP.
17
How do you configure PortFast and BPDU Guard on access ports?
Apply per port or globally for all PortFast ports.
interface range GigabitEthernet1/0/1 - 46
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
! or globally
spanning-tree portfast default
spanning-tree portfast bpduguard default
errdisable recovery cause bpduguard
errdisable recovery interval 300
DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.
Dynamic Trunking Protocol negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access. Auto plus auto stays access, while desirable with auto or desirable forms a trunk. Attackers can use DTP to form a trunk and reach all VLANs, so best practice is to hard-code access or trunk and use switchport nonegotiate on trunks.
20
Find the network, broadcast and usable range for 172.16.45.200/21.
A /21 mask is 255.255.248.0, so the interesting octet is the third with block size 8. 45 falls in the block starting at 40 (40 to 47).
Network: 172.16.40.0
Broadcast: 172.16.47.255
Usable: 172.16.40.1 - 172.16.47.254
Hosts: 2^11 - 2 = 2046
21
Tell me about a time you took initiative beyond your assigned work.
Situation: our team got many Wi-Fi complaints but had no data. Task: nobody had asked, but I wanted to find the cause. Action: I did a walk-through survey with a free tool, mapped channels and signal, and found three APs on the same 2.4 GHz channel and one dead AP. I shared a short report with fixes. Result: after the changes, Wi-Fi tickets dropped by about 60 percent in a month.
22
You have 192.168.10.0/24 and need subnets for 100, 50, 20 hosts and two point-to-point links. Design it with VLSM.
The root port is chosen by lowest cost, then sender bridge ID, then sender port ID. To prefer a link I lower its cost.
interface GigabitEthernet1/0/49
spanning-tree vlan 10 cost 2
On the upstream switch you can change port priority instead.
interface GigabitEthernet1/0/1
spanning-tree vlan 10 port-priority 64
24
A Python script gets 401 errors when calling a controller REST API. What do you check?
401 Unauthorized means authentication failed. I check the username and password or API key, whether a token must first be requested from an auth endpoint and sent in a header like X-Auth-Token, whether the token expired, and the exact header name and format. I test the same call with curl or an API client to separate script bugs from credential issues.
25
An internal web server must be reachable from the internet on a public IP. How do you set it up?
Use static NAT or port forwarding so the public IP maps to the server's private IP, for example ip nat inside source static tcp 192.168.1.20 443 203.0.113.10 443. Add an ACL or firewall rule allowing only port 443 inbound, put the server in a DMZ VLAN, and create a public DNS record. Ideally place a firewall or reverse proxy in front instead of exposing the server directly.
26
Two hosts are in the same VLAN but one has mask /24 and the other /25. What problems may occur?
Each host decides local or remote using its own mask. With 192.168.1.10/24 and 192.168.1.200/25, the first thinks .200 is local and ARPs directly, but the second sees .10 as remote and sends replies to its gateway. Traffic can become one-way or asymmetric and may break completely if the gateway does not route it back. Fix the mask so both match the design.
The underlay is the physical IP network of switches and routers that provides basic reachability, for example OSPF or IS-IS on routed links. The overlay is a virtual network built on top using tunnels such as VXLAN, so logical segments can stretch across the fabric independent of physical topology. SD-Access and SD-WAN use this model, with a fabric controlling the overlay.
28
A user complains the network is slow and the switch port shows many late collisions and CRC errors. What do you check?
Late collisions usually mean a duplex mismatch, and CRC errors point to bad cabling or interference. I would run show interfaces on the port to see duplex, speed and error counters, check the PC NIC settings, and set both sides to auto or hard-code both identically. Then I would replace the patch cable, clear counters and watch whether errors still increase.
29
How do you check interface status and errors on an IOS device?
show ip interface brief gives status and IP of all interfaces, and show interfaces gives counters and duplex.
Router# show ip interface brief
Router# show interfaces GigabitEthernet0/1
Router# show interfaces status
Router# clear counters GigabitEthernet0/1
Status up/down means Layer 1 is up but Layer 2 keepalives fail; administratively down means the interface is shut.
30
What is a wildcard mask and how is it used in ACLs?
A wildcard mask tells the router which bits must match: 0 means must match and 1 means ignore. It is often the inverse of the subnet mask, so 192.168.1.0 0.0.0.255 matches the whole /24. host 10.1.1.1 equals 0.0.0.0 and any equals 255.255.255.255. Wildcards are also used in OSPF network statements. Calculate it by subtracting the mask from 255.255.255.255.
Tips to crack the Nokia CCNA interview
Revise networking fundamentals including OSI layers, routing, switching and IP addressing, which are core to many Nokia roles.
Practise C, C++ or Python programming and Linux basics, since telecom software often runs on Linux platforms.
Read about Nokia's shift from phones to network infrastructure and its 5G work to answer company questions accurately.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Nokia interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Nokia CCNA interview?
Candidates usually go through 4 stages: Online assessment (aptitude + technical); Technical interview 1; Technical interview 2 or managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Nokia CCNA interview?
This practice set leans on Wireless and Automation (7), IP Addressing and Subnetting (5), IP Services (4), Network Security (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Nokia interviewers ask you to walk through real work.
Are these the exact questions asked at Nokia?
No. These are curated practice questions that match the skills and difficulty usually tested in telecom interviews like Nokia's. They are not a leaked or verified list of past questions.
Where does Nokia hire CCNA professionals in India?
Nokia has large teams in Bengaluru, Chennai, Noida, Gurugram. Openings and locations change often, so check the Nokia careers page and filter by city and experience.