Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About TCS hiring for CCNA roles
Tata Consultancy Services is a Tata Group company and one of the largest IT services and consulting firms in the world. It delivers application development, testing, cloud, data and analytics services to clients in banking, retail, manufacturing and other industries. In India it hires freshers and experienced staff for software testing, data engineering, BI reporting and analytics roles across its delivery centres.
For CCNA roles, this TCS practice set focuses most on Switching and VLANs (6), Network Security (5), Routing and OSPF (4), IP Services (4). It has 14 easy, 15 medium, 1 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Mumbai, India
Main India offices
Mumbai, Chennai, Pune, Bengaluru, Hyderabad
TCS CCNA interview process
TCS NQT online assessment (aptitude + coding)
Technical interview
Managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for TCSStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you create a VLAN and assign an access port?
Create the VLAN, name it, and set the port mode and VLAN.
vlan 20
name SALES
interface GigabitEthernet1/0/5
switchport mode access
switchport access vlan 20
switchport voice vlan 150
spanning-tree portfast
show vlan brief
802.1Q inserts a 4-byte tag after the source MAC in the Ethernet frame. The tag holds a 12-bit VLAN ID (1 to 4094 usable), 3 priority bits used by CoS for QoS, and a DEI bit. The tag is added when a frame leaves a trunk and removed at an access port. Older ISL encapsulation is obsolete; modern switches support only 802.1Q.
03
What are the basic steps to configure a WLAN with WPA2 or WPA3 on a controller GUI?
Steps on a typical WLC GUI: create a dynamic interface with VLAN, IP and DHCP server; go to WLANs and create a new WLAN with profile name and SSID; map it to the dynamic interface; under Security choose WPA2 or WPA3 with PSK or 802.1X and add the RADIUS server for enterprise; set QoS profile; enable the WLAN and apply it to AP groups.
04
What are the default administrative distances you should know?
Connected 0, static 1, EIGRP summary 5, eBGP 20, internal EIGRP 90, OSPF 110, IS-IS 115, RIP 120, external EIGRP 170 and iBGP 200. A value of 255 means the route is never used. AD compares trust between sources, so a static route with AD 1 beats OSPF for the same prefix unless you configure a floating static with a higher AD.
Cost equals reference bandwidth divided by interface bandwidth. The default reference is 100 Mbps, so FastEthernet, Gigabit and 10 Gigabit all get cost 1, which hides the faster links. Change it with auto-cost reference-bandwidth 100000 on every router so 1G becomes 100 and 10G becomes 10. You can also set ip ospf cost directly on an interface. Path cost is the sum of outgoing interface costs.
06
An internal web server must be reachable from the internet on a public IP. How do you set it up?
Use static NAT or port forwarding so the public IP maps to the server's private IP, for example ip nat inside source static tcp 192.168.1.20 443 203.0.113.10 443. Add an ACL or firewall rule allowing only port 443 inbound, put the server in a DMZ VLAN, and create a public DNS record. Ideally place a firewall or reverse proxy in front instead of exposing the server directly.
07
What is a REST API and which HTTP methods map to CRUD?
A REST API exposes resources at URLs and is stateless, usually with JSON payloads over HTTPS. CRUD maps to HTTP verbs: POST creates, GET reads, PUT replaces or PATCH partly updates, and DELETE removes. Responses use status codes such as 200 OK, 201 Created, 401 Unauthorized, 404 Not Found and 500 Server Error. Controllers expose northbound REST APIs for automation.
08
What are the IPv4 address classes and private ranges?
Class A is 1 to 126 with a default /8, Class B is 128 to 191 with /16, Class C is 192 to 223 with /24, Class D 224 to 239 is multicast and Class E is reserved. RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 127.0.0.0/8 is loopback and 169.254.0.0/16 is APIPA link-local. Today addressing is classless (CIDR).
Dynamic Trunking Protocol negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access. Auto plus auto stays access, while desirable with auto or desirable forms a trunk. Attackers can use DTP to form a trunk and reach all VLANs, so best practice is to hard-code access or trunk and use switchport nonegotiate on trunks.
10
How do you verify VLANs, trunks and MAC learning on a switch?
These show commands cover most VLAN troubleshooting.
show vlan brief
show interfaces trunk
show interfaces Gi1/0/5 switchport
show mac address-table vlan 20
show mac address-table address 0050.56ab.cdef
show interfaces status
They show VLAN membership, allowed and active VLANs on trunks, native VLAN and where each MAC was learned.
Syslog has eight levels from 0 to 7: emergency, alert, critical, error, warning, notification, informational and debugging. A useful memory line is Every Awesome Computer Engineer Will Need Ice cream Daily. Setting logging trap 6 sends levels 0 to 6 to the server. Syslog uses UDP 514 by default, and logs should carry timestamps with service timestamps log datetime msec.
12
How do you do the basic initial configuration of a new switch?
Set the hostname, secure access and save the config.
enable
configure terminal
hostname SW1
enable secret Str0ngPass
service password-encryption
banner motd #Authorized access only#
line console 0
password ConPass
login
end
copy running-config startup-config
Put members in a channel group with mode active, then configure the port-channel.
interface range GigabitEthernet1/0/47 - 48
channel-group 1 mode active
interface Port-channel1
switchport mode trunk
switchport trunk allowed vlan 10,20,99
port-channel load-balance src-dst-ip
show etherchannel summary
14
How do you configure IPv4 static and default routes?
Use a next-hop IP, an exit interface, or both.
ip route 10.2.0.0 255.255.0.0 192.168.12.2
ip route 0.0.0.0 0.0.0.0 203.0.113.1
! floating backup with AD 200
ip route 0.0.0.0 0.0.0.0 198.51.100.1 200
! IPv6
ipv6 route ::/0 2001:db8:12::2
show ip route static
15
How are ACL entries processed and what is the implicit deny?
ACL entries are checked top-down and the first match decides permit or deny; later lines are ignored. Every ACL ends with an invisible deny any, so traffic that matches no line is dropped. Therefore specific entries must come before general ones, and an ACL with only deny statements blocks everything. Always add a permit for allowed traffic and test after applying.
16
What is a wildcard mask and how is it used in ACLs?
A wildcard mask tells the router which bits must match: 0 means must match and 1 means ignore. It is often the inverse of the subnet mask, so 192.168.1.0 0.0.0.255 matches the whole /24. host 10.1.1.1 equals 0.0.0.0 and any equals 255.255.255.255. Wildcards are also used in OSPF network statements. Calculate it by subtracting the mask from 255.255.255.255.
17
Users can connect to the corporate SSID but get no IP address. What do you check?
Association works, so the issue is between the AP or WLC and DHCP. I check the WLAN is mapped to the right dynamic interface and VLAN, that the VLAN is allowed on the WLC and AP trunks, and that DHCP relay or helper is set on the VLAN gateway. In FlexConnect local switching, I check the AP switchport trunk and VLAN mapping. Finally I check the DHCP scope.
18
Explain password security best practices for network devices.
Use enable secret, not enable password, so the hash is strong (type 8 or 9 on modern IOS). Create local users with secret, enforce minimum length with security passwords min-length, and use AAA with TACACS+ for central control. Disable Telnet, use SSH v2, set exec-timeout on lines, and add login block-for to slow brute force. Avoid type 7 passwords, which are easily reversed.
19
What is EUI-64 and how is the interface ID generated?
EUI-64 builds a 64-bit interface ID from a 48-bit MAC. Split the MAC in half, insert FFFE in the middle and flip the seventh bit of the first byte. For MAC 0050.56AB.CDEF the ID becomes 0250:56FF:FEAB:CDEF. Routers can use ipv6 address 2001:db8:1::/64 eui-64. Hosts often prefer random privacy addresses instead, to avoid exposing the MAC.
20
After adding a new VLAN, users on one access switch cannot use it but others can. Why?
The most likely cause is the trunk to that switch does not allow the new VLAN, because someone configured an explicit allowed list. Check show interfaces trunk and add it with switchport trunk allowed vlan add 50, not without add, which would replace the list. Also confirm the VLAN exists on that switch with show vlan brief, especially if VTP is transparent.
21
Describe a situation where you had to explain a technical issue to a non-technical manager.
Situation: a routing loop during a carrier change caused a two-hour outage and the operations head wanted an explanation. Task: explain cause and prevention simply. Action: I used a road map analogy, explained that two routers kept sending traffic to each other, showed the timeline and our fix, and listed three prevention steps with dates. Result: management approved a proper change review board, and trust in our team improved.
22
What is the difference between an access port and a trunk port?
An access port belongs to one VLAN and carries untagged frames, typically to PCs, printers or servers. A trunk port carries traffic for many VLANs between switches, routers or hypervisors, adding an 802.1Q tag to identify each frame's VLAN, except the native VLAN which is sent untagged. Access ports can also carry a separate voice VLAN for IP phones.
23
What is the difference between a two-tier and a three-tier campus design?
A three-tier design has access, distribution and core layers: access connects users, distribution aggregates access switches and applies policy, and the core provides fast transport between distribution blocks. A two-tier or collapsed-core design merges core and distribution, which suits small and medium campuses with fewer buildings. Three-tier scales better when there are many distribution blocks.
24
Tell me about a time you found a security issue and reported it.
Situation: during a routine audit I noticed SNMP v2c with the default community public on several access switches. Task: close the gap without disrupting monitoring. Action: I reported it to my lead with evidence, proposed SNMPv3 with an ACL, tested with the monitoring team and rolled out in two batches. Result: the risk was closed in a week and SNMP checks were added to our device baseline.
Global unicast (2000::/3) is publicly routable. Unique local (fc00::/7, in practice fd00::/8) is like private IPv4. Link-local (fe80::/10) is auto-created on every IPv6 interface and used for neighbour discovery and routing next hops. Multicast is ff00::/8, for example ff02::1 all nodes and ff02::2 all routers. Anycast is a unicast address shared by several devices. IPv6 has no broadcast.
26
How do you configure port security with sticky MACs?
Inside local is the private address of an inside host, for example 192.168.1.10. Inside global is the public address that represents it outside, for example 203.0.113.5. Outside global is the real address of the remote host. Outside local is how the remote host appears to inside users, usually the same as outside global unless destination NAT is used. show ip nat translations displays these columns.
Network Address Translation rewrites IP addresses as packets cross a router, usually private inside addresses to public outside ones. Static NAT maps one inside address to one public address, often for servers. Dynamic NAT maps from a pool. PAT, or NAT overload, maps many inside hosts to one public IP using unique source ports, and is what almost every office and home router uses.
29
What are the STP port states and timers in classic 802.1D?
States are blocking, listening, learning, forwarding and disabled. Timers are hello 2 seconds, forward delay 15 seconds and max age 20 seconds. A port moves from blocking through listening and learning, each 15 seconds, so convergence can take 30 to 50 seconds. That delay is why Rapid STP and PortFast are used in modern networks.
A switch reads the source MAC of each incoming frame and records it with the port in the MAC address table. For forwarding it looks up the destination MAC: a known unicast goes out one port, while unknown unicast, broadcast and most multicast frames are flooded in the VLAN. Entries age out after 300 seconds by default. Check with show mac address-table.
Tips to crack the TCS CCNA interview
Practise TCS NQT style numerical, verbal and reasoning sections along with two basic coding problems under strict time limits.
Be ready to explain your final-year project, SQL basics and core concepts like OOP, DBMS and software testing life cycle.
Read about TCS service lines such as BFSI and its iON and Ignio platforms to answer why you want to join.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; TCS interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the TCS CCNA interview?
Candidates usually go through 4 stages: TCS NQT online assessment (aptitude + coding); Technical interview; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the TCS CCNA interview?
This practice set leans on Switching and VLANs (6), Network Security (5), Routing and OSPF (4), IP Services (4). Revise those first, then practise explaining one or two of your own projects end to end, because most TCS interviewers ask you to walk through real work.
Are these the exact questions asked at TCS?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like TCS's. They are not a leaked or verified list of past questions.
Where does TCS hire CCNA professionals in India?
TCS has large teams in Mumbai, Chennai, Pune, Bengaluru, Hyderabad. Openings and locations change often, so check the TCS careers page and filter by city and experience.