Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Tech Mahindra hiring for CCNA roles
Tech Mahindra is an Indian IT services and consulting company and part of the Mahindra Group. It is known for its strong telecom and communications practice and also serves banking, manufacturing and healthcare clients. In India it hires for software engineers, test engineers, network engineers, data analysts and data engineers.
For CCNA roles, this Tech Mahindra practice set focuses most on Network Security (7), STP and EtherChannel (6), IP Services (4), Wireless and Automation (3). It has 11 easy, 17 medium, 2 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Pune, India
Main India offices
Pune, Hyderabad, Bengaluru, Noida, Chennai
Tech Mahindra CCNA interview process
Online assessment (aptitude + English essay)
Coding test
Technical interview
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for Tech MahindraStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Switches exchange BPDUs and the one with the lowest bridge ID becomes root. The bridge ID is the priority (default 32768 plus the VLAN number in PVST) followed by the MAC address, so if priorities tie, the lowest MAC wins. Because the oldest switch often has the lowest MAC, you should set priority manually, for example spanning-tree vlan 10 root primary on the core.
02
Guest Wi-Fi users must reach only the internet, not internal networks. How do you enforce it?
Put guests in their own VLAN and subnet, ideally terminating on a firewall or a separate VRF. Apply an inbound extended ACL on the guest SVI that permits DHCP and DNS to the allowed servers, denies all RFC 1918 destinations, and then permits any to the internet. Enable client isolation on the wireless side and rate limit the guest SSID so it cannot consume the WAN.
03
How are ACL entries processed and what is the implicit deny?
ACL entries are checked top-down and the first match decides permit or deny; later lines are ignored. Every ACL ends with an invisible deny any, so traffic that matches no line is dropped. Therefore specific entries must come before general ones, and an ACL with only deny statements blocks everything. Always add a permit for allowed traffic and test after applying.
04
What are the basic steps to configure a WLAN with WPA2 or WPA3 on a controller GUI?
Steps on a typical WLC GUI: create a dynamic interface with VLAN, IP and DHCP server; go to WLANs and create a new WLAN with profile name and SSID; map it to the dynamic interface; under Security choose WPA2 or WPA3 with PSK or 802.1X and add the RADIUS server for enterprise; set QoS profile; enable the WLAN and apply it to AP groups.
05
What is the difference between site-to-site and remote-access VPNs?
A site-to-site VPN connects whole networks, usually two routers or firewalls, using an always-on IPsec tunnel, so users do not need any client. A remote-access VPN connects individual users from laptops or phones to the company network using a client with TLS or IPsec, and authenticates each user. Both encrypt traffic over the internet to provide confidentiality and integrity.
A VLAN is a logical Layer 2 broadcast domain created on a switch, independent of physical location. VLANs separate users, voice, guests and servers, reduce broadcast traffic, and improve security because traffic between VLANs must pass through a router or Layer 3 switch where it can be filtered. For example, finance and guest Wi-Fi users can share switches but stay isolated.
DHCP uses the DORA process: the client broadcasts Discover, the server answers with an Offer, the client broadcasts a Request for that offer, and the server confirms with an Acknowledgement. The lease includes IP, mask, gateway, DNS servers and lease time. Clients renew at 50 percent of the lease. DHCP uses UDP ports 67 for the server and 68 for the client.
Rapid PVST+ runs 802.1w per VLAN. It uses a proposal and agreement handshake on point-to-point links so ports move to forwarding in under a second, instead of waiting on timers. It has port roles root, designated, alternate and backup, and states discarding, learning and forwarding. Alternate ports provide an instant backup root port. It is the default on most modern IOS switches.
09
How do you configure SSH access on a switch or router?
SSH needs a hostname, domain name, RSA keys, a local user and VTY lines restricted to SSH.
hostname R1
ip domain-name lab.local
crypto key generate rsa modulus 2048
ip ssh version 2
username admin privilege 15 secret Adm1nPass
line vty 0 4
login local
transport input ssh
10
What are the key elements of a security program for a network?
A security program combines user awareness training, physical access control, and technical controls such as strong authentication, firewalls, IPS, VPNs and patching. It is built around the CIA triad: confidentiality, integrity and availability. Policies define what is allowed, and logging and monitoring detect problems. CCNA focuses on device hardening, ACLs, Layer 2 security, AAA, VPNs and wireless security.
VLAN Trunking Protocol shares VLAN definitions from a server switch to clients in the same VTP domain. Modes are server, client, transparent and off. The risk is that a switch with a higher configuration revision number can overwrite and wipe VLANs across the domain. Many networks use transparent mode or VTP version 3 with a primary server to avoid this.
12
What is the difference between policing and shaping?
Policing drops or re-marks traffic that exceeds a rate immediately, with no buffering, so it causes TCP retransmissions; it is used inbound or by ISPs. Shaping buffers excess traffic and sends it later, smoothing bursts to a configured rate at the cost of delay; it is used outbound, for example to match a 100 Mbps subscription on a 1 Gbps port.
13
What is the difference between autonomous APs, controller-based APs and cloud-managed APs?
Autonomous APs are configured one by one and suit very small sites. Lightweight APs are managed by a Wireless LAN Controller using CAPWAP tunnels, which centralises configuration, RF management and roaming, and suits campuses. Cloud-managed APs are configured from a cloud dashboard, ideal for many branches. Split-MAC means real-time functions stay on the AP while management sits on the controller.
Set priorities on the intended primary and secondary roots, then verify.
spanning-tree mode rapid-pvst
spanning-tree vlan 10,20 root primary
! on the backup switch
spanning-tree vlan 10,20 root secondary
show spanning-tree vlan 10
show spanning-tree root
show spanning-tree summary
15
How do you approach working in a 24x7 network operations shift?
Situation: I joined a NOC that ran rotating shifts. Task: stay effective and keep handovers clean. Action: I followed runbooks, kept a shift log of every alert and action, raised early escalations for anything outside my scope and used quiet hours to lab new topics. Result: I handled shift incidents within SLA, earned positive feedback for clear handovers and was moved to the L2 team in a year.
16
How do you configure a router as a DHCP relay and verify it?
Add the helper address on the client-facing interface.
interface vlan 20
ip helper-address 10.0.0.50
show ip interface vlan 20 | include Helper
debug ip dhcp server packet
The helper also forwards some other UDP broadcasts such as TFTP and DNS by default; use no ip forward-protocol udp to limit them.
Variable Length Subnet Masking means using different prefix lengths inside one address block, so each subnet is sized to its need. You allocate the largest subnets first, then smaller ones, to avoid overlaps. For example, from 10.1.1.0/24 you could give a 100-user LAN a /25, a 50-user LAN a /26, and point-to-point WAN links /30 or /31. It saves address space compared with fixed-length subnetting.
18
How many usable hosts are in a /26 subnet and what is the block size?
A /26 leaves 6 host bits, so 2 to the power 6 is 64 addresses and 62 usable hosts after removing network and broadcast. The mask is 255.255.255.192 and the block size is 256 minus 192, which is 64. So subnets of 192.168.1.0/26 start at .0, .64, .128 and .192. For 192.168.1.70/26 the network is .64 and broadcast .127.
19
Tell me about a time you automated or simplified a repetitive task.
Situation: our team manually backed up 80 router configs each week. Task: save time and avoid missed backups. Action: I enabled the archive feature with time-period on each device and later wrote a small Python script with Netmiko to pull and store configs in Git. Result: weekly effort dropped from four hours to zero, and we could see config differences after every change.
Cost equals reference bandwidth divided by interface bandwidth. The default reference is 100 Mbps, so FastEthernet, Gigabit and 10 Gigabit all get cost 1, which hides the faster links. Change it with auto-cost reference-bandwidth 100000 on every router so 1G becomes 100 and 10G becomes 10. You can also set ip ospf cost directly on an interface. Path cost is the sum of outgoing interface costs.
21
What are the IPv4 address classes and private ranges?
Class A is 1 to 126 with a default /8, Class B is 128 to 191 with /16, Class C is 192 to 223 with /24, Class D 224 to 239 is multicast and Class E is reserved. RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 127.0.0.0/8 is loopback and 169.254.0.0/16 is APIPA link-local. Today addressing is classless (CIDR).
22
An EtherChannel shows members in suspended state. What do you check?
Suspended (s) usually means a configuration mismatch between members or with the far end. I compare speed, duplex, trunk mode, native VLAN and allowed VLANs on each member and the port-channel with show run interface, check LACP modes on both sides, and look at logs. I fix the config on the port-channel, then shut and no shut members so they rejoin. show etherchannel summary should show P flags.
23
What is the native VLAN and what problems can a mismatch cause?
The native VLAN is the VLAN whose frames cross a trunk untagged, VLAN 1 by default. Both ends must use the same native VLAN; if they differ, frames leak between VLANs and CDP logs a native VLAN mismatch. For security, set the native VLAN to an unused ID, do not put users in it, and optionally tag it with vlan dot1q tag native to prevent VLAN hopping.
24
What is AAA and the difference between TACACS+ and RADIUS?
AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.
25
A server team says an ACL you applied blocked all traffic, including allowed services. What happened?
Most likely the ACL lacks a permit for normal traffic, so the implicit deny dropped everything, or the order put a broad deny above the specific permits. It may also be applied in the wrong direction or on the wrong interface. I check show access-lists for hit counts, fix the sequence by inserting lines, and add a final permit or the needed entries. I always test ACLs with a rollback timer.
EtherChannel bundles 2 to 8 physical links into one logical port-channel. STP sees it as one link, so all members forward instead of one being blocked. It adds bandwidth and redundancy, as one member failing does not drop the channel. Traffic is load-balanced per flow using a hash of MAC, IP or port fields, so a single flow still uses only one member link.
802.11n (Wi-Fi 4) works on 2.4 and 5 GHz with MIMO. 802.11ac (Wi-Fi 5) is 5 GHz only with wider channels and MU-MIMO downlink. 802.11ax (Wi-Fi 6 and 6E) adds OFDMA, BSS colouring and target wake time, and 6E adds the 6 GHz band. 802.11be (Wi-Fi 7) adds 320 MHz channels and multi-link operation. India opened part of the 6 GHz band for indoor use.
DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.
29
What is a collision domain and a broadcast domain?
A collision domain is a segment where two devices sending at the same time can collide; every switch port is its own collision domain, and with full duplex collisions do not occur. A broadcast domain is the set of devices that receive a Layer 2 broadcast. Routers and VLANs separate broadcast domains, so one VLAN equals one broadcast domain.
30
How would you influence which port becomes the root port on a switch?
The root port is chosen by lowest cost, then sender bridge ID, then sender port ID. To prefer a link I lower its cost.
interface GigabitEthernet1/0/49
spanning-tree vlan 10 cost 2
On the upstream switch you can change port priority instead.
interface GigabitEthernet1/0/1
spanning-tree vlan 10 port-priority 64
Tips to crack the Tech Mahindra CCNA interview
Read about telecom basics like 4G, 5G and network operations, since communications is Tech Mahindra's largest vertical.
Practise English essay and verbal ability sections, which often appear in Tech Mahindra online assessments.
Revise SQL and one programming language, and prepare a clear two-minute explanation of your project.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Tech Mahindra interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Tech Mahindra CCNA interview?
Candidates usually go through 4 stages: Online assessment (aptitude + English essay); Coding test; Technical interview; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Tech Mahindra CCNA interview?
This practice set leans on Network Security (7), STP and EtherChannel (6), IP Services (4), Wireless and Automation (3). Revise those first, then practise explaining one or two of your own projects end to end, because most Tech Mahindra interviewers ask you to walk through real work.
Are these the exact questions asked at Tech Mahindra?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like Tech Mahindra's. They are not a leaked or verified list of past questions.
Where does Tech Mahindra hire CCNA professionals in India?
Tech Mahindra has large teams in Pune, Hyderabad, Bengaluru, Noida, Chennai. Openings and locations change often, so check the Tech Mahindra careers page and filter by city and experience.