Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About NTT DATA hiring for CCNA roles
NTT DATA is a global IT services company and part of the NTT Group of Japan. It provides consulting, application services, cloud, infrastructure, data and testing services for clients in many industries. Its India delivery centres hire for software engineers, test engineers, data engineers, data analysts and infrastructure professionals.
For CCNA roles, this NTT DATA practice set focuses most on Wireless and Automation (6), Routing and OSPF (5), IP Services (4), Switching and VLANs (4). It has 13 easy, 16 medium, 1 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Tokyo, Japan
Main India offices
Bengaluru, Pune, Noida, Hyderabad, Chennai
NTT DATA CCNA interview process
Online assessment (aptitude + technical)
Technical interview
Managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for NTT DATAStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Set priorities on the intended primary and secondary roots, then verify.
spanning-tree mode rapid-pvst
spanning-tree vlan 10,20 root primary
! on the backup switch
spanning-tree vlan 10,20 root secondary
show spanning-tree vlan 10
show spanning-tree root
show spanning-tree summary
02
Two OSPF routers are directly connected but show no neighbour at all. How do you troubleshoot?
I check that the interfaces are up and in the same subnet, then show ip ospf interface to compare area, hello and dead timers, network type and authentication. I make sure the interface is not passive and that the network statement or ip ospf area command covers it. Finally I check that no ACL blocks protocol 89 or multicast 224.0.0.5, and use debug ip ospf adj if needed.
A client asks its configured resolver, for example for www.example.com. If it is not cached, the resolver queries a root server, which refers it to the .com TLD server, which refers it to the authoritative server for example.com, which returns the A or AAAA record. The answer is cached for its TTL. DNS uses UDP 53 for most queries and TCP 53 for zone transfers and large replies.
802.1Q inserts a 4-byte tag after the source MAC in the Ethernet frame. The tag holds a 12-bit VLAN ID (1 to 4094 usable), 3 priority bits used by CoS for QoS, and a DEI bit. The tag is added when a frame leaves a trunk and removed at an access port. Older ISL encapsulation is obsolete; modern switches support only 802.1Q.
05
What is the difference between a hub, a switch and a router?
A hub is a Layer 1 repeater: it floods every bit out of every port, so all ports share one collision domain. A switch is Layer 2: it learns MAC addresses and forwards frames only to the correct port, giving each port its own collision domain. A router is Layer 3: it forwards packets between IP networks and separates broadcast domains.
06
What are DR and BDR in OSPF and why are they needed?
On multi-access networks such as Ethernet, a full mesh of adjacencies would create too many LSAs. OSPF elects a Designated Router and Backup DR; other routers (DROTHERs) form full adjacency only with them and stay 2-Way with each other. The highest interface priority wins, then highest router ID; priority 0 means never DR. Election is non-preemptive, so a new better router does not take over.
07
How do you configure port security with sticky MACs?
Use one trunk link and a subinterface per VLAN with 802.1Q encapsulation.
interface GigabitEthernet0/0
no shutdown
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
The switch port facing the router must be a trunk.
Physical ports include service ports for out-of-band management, distribution system ports that connect to the switch as trunks, and redundancy ports for HA. Logical interfaces include the management interface used for CAPWAP and admin access, dynamic interfaces that map WLANs to VLANs, and a virtual interface used for web auth and DHCP relay. A LAG bundles distribution ports.
Rapid PVST+ runs 802.1w per VLAN. It uses a proposal and agreement handshake on point-to-point links so ports move to forwarding in under a second, instead of waiting on timers. It has port roles root, designated, alternate and backup, and states discarding, learning and forwarding. Alternate ports provide an instant backup root port. It is the default on most modern IOS switches.
11
What is the native VLAN and what problems can a mismatch cause?
The native VLAN is the VLAN whose frames cross a trunk untagged, VLAN 1 by default. Both ends must use the same native VLAN; if they differ, frames leak between VLANs and CDP logs a native VLAN mismatch. For security, set the native VLAN to an unused ID, do not put users in it, and optionally tag it with vlan dot1q tag native to prevent VLAN hopping.
12
How do you configure PortFast and BPDU Guard on access ports?
Apply per port or globally for all PortFast ports.
interface range GigabitEthernet1/0/1 - 46
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
! or globally
spanning-tree portfast default
spanning-tree portfast bpduguard default
errdisable recovery cause bpduguard
errdisable recovery interval 300
Example line:
O 10.2.2.0/24 [110/20] via 10.0.12.2, 00:05:12, GigabitEthernet0/0
O is the source (OSPF), 10.2.2.0/24 the prefix, 110 the administrative distance and 20 the metric, 10.0.12.2 the next hop, then the age and exit interface. C is connected, L local host route, S static, D EIGRP and an asterisk marks the candidate default.
14
A new VLAN's users do not get DHCP addresses, but other VLANs work. What do you check?
I check that the SVI for the new VLAN is up and has ip helper-address pointing to the DHCP server, that the server has a scope for that subnet with the right gateway, and that the scope is activated. I confirm the VLAN is allowed on trunks. If DHCP snooping is enabled, I check the uplink is trusted, otherwise offers from the server are dropped.
15
What is NTP and why does time matter on network devices?
NTP synchronises clocks over UDP 123 using a hierarchy of strata, where stratum 1 servers connect to an atomic or GPS clock. Correct time matters because syslog and incident timelines must line up across devices, certificates and authentication protocols check time, and logs are legal evidence. Devices can be NTP clients, servers or peers, and NTP authentication protects against fake time sources.
16
What are the basic steps to configure a WLAN with WPA2 or WPA3 on a controller GUI?
Steps on a typical WLC GUI: create a dynamic interface with VLAN, IP and DHCP server; go to WLANs and create a new WLAN with profile name and SSID; map it to the dynamic interface; under Security choose WPA2 or WPA3 with PSK or 802.1X and add the RADIUS server for enterprise; set QoS profile; enable the WLAN and apply it to AP groups.
17
How do you do the basic initial configuration of a new switch?
Set the hostname, secure access and save the config.
enable
configure terminal
hostname SW1
enable secret Str0ngPass
service password-encryption
banner motd #Authorized access only#
line console 0
password ConPass
login
end
copy running-config startup-config
DHCP uses the DORA process: the client broadcasts Discover, the server answers with an Offer, the client broadcasts a Request for that offer, and the server confirms with an Acknowledgement. The lease includes IP, mask, gateway, DNS servers and lease time. Clients renew at 50 percent of the lease. DHCP uses UDP ports 67 for the server and 68 for the client.
Allow web traffic from one subnet to a server and block the rest of that subnet.
ip access-list extended WEB-ONLY
10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.80 eq 443
20 deny ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255
30 permit ip any any
interface vlan 10
ip access-group WEB-ONLY in
show access-lists WEB-ONLY
When a host needs the MAC for an IP on its subnet, it broadcasts an ARP request and the owner replies with a unicast ARP reply; the result is cached. For remote destinations the host ARPs for its default gateway. A gratuitous ARP is an unsolicited announcement of a host's own IP-to-MAC mapping, used after failover, for example by HSRP, to update switch and host tables.
21
What is route summarization and how do you calculate a summary?
Summarization advertises one prefix that covers several contiguous networks, shrinking routing tables and hiding instability. Write the networks in binary and keep the common leading bits. For 10.1.4.0/24 to 10.1.7.0/24, the third octet values 4 to 7 share the first six bits (000001), so the summary is 10.1.4.0/22. Make sure the summary does not include networks that live elsewhere.
22
You have 192.168.10.0/24 and need subnets for 100, 50, 20 hosts and two point-to-point links. Design it with VLSM.
Control and Provisioning of Wireless Access Points is the protocol between lightweight APs and the WLC. It builds two tunnels: a control tunnel on UDP 5246, encrypted with DTLS, and a data tunnel on UDP 5247 that carries client traffic in central switching mode. In FlexConnect or local switching mode, client data is switched locally at the AP instead of being tunnelled.
24
How would you represent an interface configuration in JSON and YAML?
The same data in both formats.
JSON:
{
"interface": "GigabitEthernet0/1",
"enabled": true,
"ipv4": ["192.168.1.1/24"]
}
YAML:
interface: GigabitEthernet0/1
enabled: true
ipv4:
- 192.168.1.1/24
802.11n (Wi-Fi 4) works on 2.4 and 5 GHz with MIMO. 802.11ac (Wi-Fi 5) is 5 GHz only with wider channels and MU-MIMO downlink. 802.11ax (Wi-Fi 6 and 6E) adds OFDMA, BSS colouring and target wake time, and 6E adds the 6 GHz band. 802.11be (Wi-Fi 7) adds 320 MHz channels and multi-link operation. India opened part of the 6 GHz band for indoor use.
26
Explain password security best practices for network devices.
Use enable secret, not enable password, so the hash is strong (type 8 or 9 on modern IOS). Create local users with secret, enforce minimum length with security passwords min-length, and use AAA with TACACS+ for central control. Disable Telnet, use SSH v2, set exec-timeout on lines, and add login block-for to slow brute force. Avoid type 7 passwords, which are easily reversed.
A voice VLAN lets an IP phone and a PC share one switch port while keeping their traffic separate. The port is an access port in the data VLAN, and the switch tells the phone through CDP or LLDP-MED to tag voice frames with the voice VLAN. This allows QoS priority for voice and separate addressing. Configure it with switchport voice vlan.
Routers send hellos to 224.0.0.5. They become neighbours if area ID, subnet and mask, hello and dead timers, authentication and stub flags match, and the router IDs are unique. States go Down, Init, 2-Way, ExStart, Exchange, Loading and Full. In ExStart and Exchange they agree master and slave and swap database descriptions, which is where an MTU mismatch causes a stuck adjacency.
29
A Python script gets 401 errors when calling a controller REST API. What do you check?
401 Unauthorized means authentication failed. I check the username and password or API key, whether a token must first be requested from an auth endpoint and sent in a header like X-Auth-Token, whether the token expired, and the exact header name and format. I test the same call with curl or an API client to separate script bugs from credential issues.
Set a router ID, enable OSPF on interfaces and make user ports passive.
router ospf 1
router-id 1.1.1.1
auto-cost reference-bandwidth 100000
passive-interface GigabitEthernet0/1
network 10.0.12.0 0.0.0.3 area 0
network 192.168.1.0 0.0.0.255 area 0
default-information originate
Or per interface: ip ospf 1 area 0
Tips to crack the NTT DATA CCNA interview
Revise SQL, testing and programming fundamentals for both the online assessment and technical interview.
Learn about NTT DATA's Japanese parent and its global integration of companies such as Dimension Data.
Be ready to discuss working with clients across time zones, as many teams support global accounts.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; NTT DATA interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the NTT DATA CCNA interview?
Candidates usually go through 4 stages: Online assessment (aptitude + technical); Technical interview; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the NTT DATA CCNA interview?
This practice set leans on Wireless and Automation (6), Routing and OSPF (5), IP Services (4), Switching and VLANs (4). Revise those first, then practise explaining one or two of your own projects end to end, because most NTT DATA interviewers ask you to walk through real work.
Are these the exact questions asked at NTT DATA?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like NTT DATA's. They are not a leaked or verified list of past questions.
Where does NTT DATA hire CCNA professionals in India?
NTT DATA has large teams in Bengaluru, Pune, Noida, Hyderabad, Chennai. Openings and locations change often, so check the NTT DATA careers page and filter by city and experience.