‹ Back to previous section Course home All page URLs

CCNA Managerial Round Questions & Answers

35 questions for the managerial round stage — 1 easy, 20 medium, 14 hard.

About the managerial round round

The managerial round is usually with a hiring manager or team lead. It mixes real-work scenarios, prioritisation and stakeholder questions with behavioural questions about ownership, conflict and learning.

Tips for the managerial round round

Use the STAR format for every story: Situation, Task, Action, Result.
Show trade-offs: what you chose, what you gave up and why.
Be honest about mistakes and focus on what you changed afterwards.
Ask the manager about team goals and how success is measured in the role.

Solved — managerial roundStart practicing

3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.

3 questions free Unlock the rest in seconds

What are the STP port states and timers in classic 802.1D?

STP and EtherChannelMedium

Show answer

States are blocking, listening, learning, forwarding and disabled. Timers are hello 2 seconds, forward delay 15 seconds and max age 20 seconds. A port moves from blocking through listening and learning, each 15 seconds, so convergence can take 30 to 50 seconds. That delay is why Rapid STP and PortFast are used in modern networks.

Logs show MAC address flapping for several hosts between an access port and an uplink. What do you check?

Switching and VLANsMedium

Show answer

MAC flapping means the switch sees the same source MAC arriving on two ports, which usually points to a Layer 2 loop, a misconfigured server NIC team, or a virtual machine host bridging two uplinks. Check show mac address-table for the MAC, trace both ports, verify STP state and look for unmanaged switches or hypervisor teaming in active-active mode without a matching port channel. Fix the loop or teaming, and keep BPDU Guard on access ports.

A broadcast storm brought the network down after someone connected a cable between two wall ports. How do you prevent this?

STP and EtherChannelMedium

Show answer

Two wall ports patched to the same switch formed a loop. To stop it now, I find the port with rising broadcast counters and shut it. To prevent repeats, enable PortFast with BPDU Guard on all access ports, keep Rapid PVST+ running everywhere, add storm-control broadcast thresholds on access ports and enable errdisable recovery with a sensible interval.

Tell me about a time a change you approved caused an outage. What did you do and what changed afterwards?

STP and EtherChannelHard

Show answer

Situation: I approved a change that set a new root bridge priority, but the engineer applied it on the wrong switch and the campus reconverged during business hours. Task: restore service and find the gap. Action: we rolled back in ten minutes, informed users and ran a blameless review. Result: we added device name checks to the change template, peer review of exact commands and a maintenance window rule for any STP change. There was no repeat incident that year.

A server team reports that a link between two switches is up but traffic is dropping intermittently. What do you check?

Network FundamentalsHard

Show answer

I check show interfaces on both ends for input errors, CRC, runts, giants, output drops and resets. Output drops suggest congestion, so I look at utilisation and QoS. CRC errors suggest a bad cable, dirty fiber or faulty SFP, so I check optical levels with show interfaces transceiver. I also confirm both sides agree on speed and duplex and that the MTU matches.

A new VLAN's users do not get DHCP addresses, but other VLANs work. What do you check?

IP ServicesMedium

Show answer

I check that the SVI for the new VLAN is up and has ip helper-address pointing to the DHCP server, that the server has a scope for that subnet with the right gateway, and that the scope is activated. I confirm the VLAN is allowed on trunks. If DHCP snooping is enabled, I check the uplink is trusted, otherwise offers from the server are dropped.

Auditors find that network devices use shared admin passwords and Telnet. What is your remediation plan?

Network SecurityHard

Show answer

Disable Telnet with transport input ssh, enable SSH v2, and move admin login to AAA with TACACS+ so each engineer has a personal account with command authorisation and accounting logs. Keep one local fallback account in a password vault. Restrict VTY access with an ACL to the management subnet. Roll out with automation, test on a pilot, then document it for the audit.

How would you influence which port becomes the root port on a switch?

STP and EtherChannelHard

Show answer

The root port is chosen by lowest cost, then sender bridge ID, then sender port ID. To prefer a link I lower its cost. interface GigabitEthernet1/0/49 spanning-tree vlan 10 cost 2 On the upstream switch you can change port priority instead. interface GigabitEthernet1/0/1 spanning-tree vlan 10 port-priority 64

How do you handle a change that must be done during a night window?

Switching and VLANsMedium

Show answer

Situation: we had to migrate 30 access ports to new VLANs overnight. Task: finish with zero business impact. Action: I prepared configs in advance, got peer review, scheduled a rollback, informed the helpdesk and tested each floor with a laptop after changes. Result: the migration finished an hour early, morning tickets were zero, and the plan became our template for later VLAN changes.

Syslog timestamps from different devices do not match during an incident review. What do you fix?

IP ServicesMedium

Show answer

Clocks are not synchronised. I configure all devices to use the same internal NTP servers with ntp server, set the timezone with clock timezone IST 5 30, add service timestamps log datetime msec localtime, and enable NTP authentication. Then I check show ntp associations and show ntp status to confirm synchronisation. This makes future incident timelines reliable.

An internal web server must be reachable from the internet on a public IP. How do you set it up?

IP ServicesMedium

Show answer

Use static NAT or port forwarding so the public IP maps to the server's private IP, for example ip nat inside source static tcp 192.168.1.20 443 203.0.113.10 443. Add an ACL or firewall rule allowing only port 443 inbound, put the server in a DMZ VLAN, and create a public DNS record. Ideally place a firewall or reverse proxy in front instead of exposing the server directly.

After adding a second internet router, some sessions break at the stateful firewall because return traffic uses the other exit. How do you fix it?

Routing and OSPFHard

Show answer

This is asymmetric routing: the firewall sees only one direction of the flow and drops it. Make the path symmetric by using one active exit per prefix, for example HSRP or a higher OSPF default-route cost on the backup, and advertise inbound routes consistently with the same preference. If both links must be active, pair the firewalls with state sharing or use NAT per exit so return traffic comes back to the router that sent it.

During a merger both companies use 10.0.0.0/16. How do you allow them to communicate?

IP Addressing and SubnettingHard

Show answer

Overlapping address space means routing alone cannot work. Short term, use NAT on the interconnect so each side sees the other as a different translated range, for example twice NAT or policy NAT. Long term, renumber one network into a free range, which is cleaner but needs planning for DHCP, DNS, firewall rules and static IPs. I would also document the IP address management plan to prevent repeats.

What is the difference between a two-tier and a three-tier campus design?

Network FundamentalsMedium

Show answer

A three-tier design has access, distribution and core layers: access connects users, distribution aggregates access switches and applies policy, and the core provides fast transport between distribution blocks. A two-tier or collapsed-core design merges core and distribution, which suits small and medium campuses with fewer buildings. Three-tier scales better when there are many distribution blocks.

Tell me about a time you worked with a difficult end user during a ticket.

Switching and VLANsEasy

Show answer

Situation: a senior manager was angry that his laptop lost network access before a client call. Task: fix it fast and calm him down. Action: I listened, gave a clear time estimate, found the port had been moved to a wrong VLAN in a recent change, corrected it and confirmed the call worked. Result: he was back online in ten minutes, and I added a port description check to our change process.

What are DR and BDR in OSPF and why are they needed?

Routing and OSPFMedium

Show answer

On multi-access networks such as Ethernet, a full mesh of adjacencies would create too many LSAs. OSPF elects a Designated Router and Backup DR; other routers (DROTHERs) form full adjacency only with them and stay 2-Way with each other. The highest interface priority wins, then highest router ID; priority 0 means never DR. Election is non-preemptive, so a new better router does not take over.

Describe a situation where you had to explain a technical issue to a non-technical manager.

Routing and OSPFMedium

Show answer

Situation: a routing loop during a carrier change caused a two-hour outage and the operations head wanted an explanation. Task: explain cause and prevention simply. Action: I used a road map analogy, explained that two routers kept sending traffic to each other, showed the timeline and our fix, and listed three prevention steps with dates. Result: management approved a proper change review board, and trust in our team improved.

After moving DHCP to a new central server, remote PCs get addresses but IP phones fail to download their configuration. What do you check?

IP ServicesMedium

Show answer

The phones need extra DHCP options that were probably not copied, such as option 150 or option 66 for the TFTP or call server and sometimes a voice VLAN option. Check the scope options on the new server, confirm the relay on each SVI points to it, and capture the DHCP offer to see which options arrive. Also verify the voice VLAN scope exists and that ACLs allow TFTP from the phone subnets to the call server.

After adding a new VLAN, users on one access switch cannot use it but others can. Why?

Switching and VLANsMedium

Show answer

The most likely cause is the trunk to that switch does not allow the new VLAN, because someone configured an explicit allowed list. Check show interfaces trunk and add it with switchport trunk allowed vlan add 50, not without add, which would replace the list. Also confirm the VLAN exists on that switch with show vlan brief, especially if VTP is transparent.

How do you mentor junior engineers who struggle with subnetting and troubleshooting?

IP Addressing and SubnettingMedium

Show answer

I start with the block-size method instead of binary tables, because it is fast and easy to remember. I give them daily five-minute subnetting drills, then real tickets where I let them lead while I watch and ask questions. For example, one junior engineer kept guessing during outages, so I taught him a fixed bottom-up checklist. Within two months he was closing Layer 2 and Layer 3 tickets on his own and teaching the next new joiner.

Your company is running out of IP addresses on a /24 user subnet. What options do you have?

IP Addressing and SubnettingMedium

Show answer

Options: expand to a /23 if the adjacent block is free and update the router and DHCP scope; create a new VLAN and subnet for some users, which also limits broadcast size; shorten DHCP lease times if many guest devices hold leases; and move printers, phones and IoT devices to their own subnets. Long term, plan an addressing scheme with growth headroom and consider dual-stack IPv6.

A new lightweight AP does not join the controller. How do you troubleshoot?

Wireless and AutomationHard

Show answer

I check the AP gets a DHCP address and can reach the WLC management IP. It discovers the controller through DHCP option 43, the standard CAPWAP controller DNS name, broadcast or a primed controller IP, so I verify one of these. Then I check UDP 5246 and 5247 are not blocked, the AP's clock and certificate are valid, the country code matches, and the WLC has AP licences available.

Users report short outages every few minutes and logs show topology changes. How do you troubleshoot?

STP and EtherChannelHard

Show answer

Frequent TCNs flush MAC tables and cause flooding. I run show spanning-tree detail to find the port and switch originating topology changes, then follow it hop by hop. Common causes are a flapping link, a host port without PortFast that changes state each time a PC reboots, or a failing NIC. I fix the link and enable PortFast on edge ports so they do not generate TCNs.

Compare single-mode and multimode fiber.

Network FundamentalsMedium

Show answer

Single-mode fiber has a small core (about 9 microns) and uses a laser, so it carries light over long distances, often 10 km or more. Multimode fiber has a larger core (50 or 62.5 microns), uses cheaper LED or VCSEL optics and suits shorter runs inside a building or data center, usually up to a few hundred metres at 10 Gbps. SFP modules must match the fiber type.

What is the difference between autonomous APs, controller-based APs and cloud-managed APs?

Wireless and AutomationMedium

Show answer

Autonomous APs are configured one by one and suit very small sites. Lightweight APs are managed by a Wireless LAN Controller using CAPWAP tunnels, which centralises configuration, RF management and roaming, and suits campuses. Cloud-managed APs are configured from a cloud dashboard, ideal for many branches. Split-MAC means real-time functions stay on the AP while management sits on the controller.

A Python script gets 401 errors when calling a controller REST API. What do you check?

Wireless and AutomationMedium

Show answer

401 Unauthorized means authentication failed. I check the username and password or API key, whether a token must first be requested from an auth endpoint and sent in a header like X-Auth-Token, whether the token expired, and the exact header name and format. I test the same call with curl or an API client to separate script bugs from credential issues.

Why are /31 subnets used on point-to-point links?

IP Addressing and SubnettingMedium

Show answer

RFC 3021 allows /31 on point-to-point links because there is no need for network and broadcast addresses when only two devices exist. A /31 gives exactly two usable addresses, saving half the space of a /30. It is common on ISP and data center fabric links. Both ends must support it; on IOS you simply configure ip address 10.0.0.0 255.255.255.254.

Tell me about a time you led a network migration or a major change.

Network FundamentalsHard

Show answer

Situation: our office had to move 300 users from old access switches to a new stack in one weekend. Task: I owned the plan. Action: I documented every port, pre-built configs, ran a pilot on one floor, wrote a rollback plan and kept a call bridge open with the desktop team. Result: we finished two hours early with only three port issues, fixed on Monday morning. I learned that a tested rollback plan gives the whole team confidence.

An SVI shows status down/down even though it is configured. What could be wrong?

Switching and VLANsHard

Show answer

An SVI comes up only if the VLAN exists in the VLAN database and at least one access or trunk port in that VLAN is up and forwarding, and the SVI is not shut down. So I check show vlan brief for the VLAN, check that at least one port in it is connected, check trunks allow it, and run no shutdown on the SVI. On Layer 3 switches, ip routing must be enabled for routing.

How do you enable DHCP snooping and DAI?

Network SecurityHard

Show answer

Enable per VLAN, trust uplinks and rate-limit user ports. ip dhcp snooping ip dhcp snooping vlan 10,20 no ip dhcp snooping information option ip arp inspection vlan 10,20 interface GigabitEthernet1/0/48 ip dhcp snooping trust ip arp inspection trust interface range Gi1/0/1 - 46 ip dhcp snooping limit rate 15 show ip dhcp snooping binding

Users complain Wi-Fi is slow in a conference room with 60 people. What do you check and fix?

Wireless and AutomationMedium

Show answer

This is usually a capacity, not a coverage, issue. I check client count per AP and channel utilisation on the controller. Fixes include adding APs with lower transmit power, steering clients to 5 or 6 GHz with band steering, disabling low data rates such as 1, 2 and 5.5 Mbps, using 20 or 40 MHz channels in dense areas, and limiting per-client bandwidth on the SSID.

A route you expect from OSPF is in the OSPF database but not in the routing table. Why?

Routing and OSPFHard

Show answer

Another source with a lower AD may be providing the same prefix, such as a static route, so the OSPF route is not installed. Or a more specific route wins by longest match. The next hop may also be unreachable, or a distribute-list may filter it. I check show ip route for the prefix, show ip ospf database, and compare administrative distances.

An automation job pushed a wrong configuration to 50 switches and broke their uplinks. How do you recover and stop it happening again?

Wireless and AutomationHard

Show answer

First stop the job, then recover through out-of-band console or a management network, using configuration archive rollback or a saved backup. In future, run changes with commit confirmed or reload in as a safety timer, test in a lab, use a dry run or check mode, deploy to one canary switch, then in small batches with automatic post-checks. Store templates in Git with peer review so every change is visible and reversible.

Two OSPF routers on the same link are stuck in EXSTART state. What is the cause and fix?

Routing and OSPFHard

Show answer

EXSTART or EXCHANGE stuck usually means an MTU mismatch, because database description packets larger than the neighbour's MTU are dropped. I compare MTU with show interfaces and set ip mtu to match on both sides. As a temporary workaround, ip ospf mtu-ignore can be used, but fixing the MTU is better. Duplicate router IDs can also cause odd adjacency behaviour, so I check those too.

A user complains the network is slow and the switch port shows many late collisions and CRC errors. What do you check?

Network FundamentalsMedium

Show answer

Late collisions usually mean a duplex mismatch, and CRC errors point to bad cabling or interference. I would run show interfaces on the port to see duplex, speed and error counters, check the PC NIC settings, and set both sides to auto or hard-code both identically. Then I would replace the patch cable, clear counters and watch whether errors still increase.

Frequently asked questions

What happens in the CCNA managerial round round?

How do I clear the managerial round round?

Use the STAR format for every story: Situation, Task, Action, Result. Show trade-offs: what you chose, what you gave up and why. Be honest about mistakes and focus on what you changed afterwards.

Which round comes next?

A typical order is online assessment, telephonic screening, one or two technical rounds, a managerial round and HR. Use the other round pages to practise each stage.

Practise every interview round

Online Assessment questions Telephonic Interview questions Technical Round questions Rapid-Fire questions HR & behavioural questions Full mock interview

More ways to practise

Company-wise CCNA questions Experience-wise CCNA questions Role-wise CCNA questions City-wise CCNA questions Most asked CCNA questions Scenario-based questions Practical / hands-on questions HR & behavioural questions CCNA mock interview Online assessment questions Technical round questions Managerial round questions CCNA topic sheets