CCNA Mock Interview: 20 Questions in 50 Minutes

First it uses longest prefix match: the most specific matching prefix wins, so 10.1.1.0/24 beats 10.1.0.0/16. If the same prefix comes from different sources, the lowest administrative distance wins. If the same protocol offers several paths, the lowest metric wins, and equal metrics can be load-balanced with ECMP. Only the winners are installed in the routing table.

Hosts in different VLANs need a Layer 3 device to communicate. Options are: a router with one physical interface per VLAN (legacy), router-on-a-stick using one trunk with subinterfaces, or a Layer 3 switch with switched virtual interfaces (SVIs). SVIs are the most common in campuses because routing happens in hardware at line rate, with no single trunk bottleneck.

From bottom to top: Physical, Data Link, Network, Transport, Session, Presentation and Application. Each layer serves the one above it. For example, Ethernet frames work at Layer 2, IP packets at Layer 3 and TCP segments at Layer 4. Engineers use the model to troubleshoot bottom-up: check cables and link lights first, then MAC learning, then IP reachability.

Redundant Layer 2 links create loops, and Ethernet frames have no TTL, so broadcasts circulate forever, causing broadcast storms, MAC table instability and duplicate frames. STP (802.1D) blocks redundant paths so there is one loop-free path to every switch, and unblocks a backup link if the active one fails. Without it, a single loop can take down a whole campus within seconds.

WPA2 uses AES-CCMP; WPA2-Personal uses a pre-shared key that is vulnerable to offline dictionary attacks, and WPA2-Enterprise uses 802.1X with RADIUS. WPA3-Personal replaces PSK with SAE, which resists offline guessing and gives forward secrecy. WPA3-Enterprise offers a 192-bit mode. WPA3 requires protected management frames. Open networks can use OWE for encryption without passwords.

FHRPs give hosts a virtual gateway IP shared by two or more routers. HSRP is proprietary: routers elect an active router by highest priority (default 100), and the standby takes over the virtual IP and MAC if hellos stop. Preempt lets a higher priority router reclaim the role. VRRP is the open standard, and GLBP adds load sharing across several routers.

Every non-root switch picks one root port, its best path to the root based on lowest root path cost, then lowest sender bridge ID, then lowest sender port ID. On each segment, the switch with the best path becomes the designated port and forwards. Every remaining port becomes non-designated and blocks. All ports on the root bridge are designated.

Disable Telnet with transport input ssh, enable SSH v2, and move admin login to AAA with TACACS+ so each engineer has a personal account with command authorisation and accounting logs. Keep one local fallback account in a password vault. Restrict VTY access with an ACL to the management subnet. Roll out with automation, test on a pilot, then document it for the audit.

A rogue DHCP server, often a home router plugged into a wall port, is answering requests. I find it by checking the DHCP server IP on an affected client with ipconfig /all, then tracing its MAC with show mac address-table. I shut that port, and prevent it permanently by enabling DHCP snooping on user VLANs with only uplinks trusted.

Late collisions usually mean a duplex mismatch, and CRC errors point to bad cabling or interference. I would run show interfaces on the port to see duplex, speed and error counters, check the PC NIC settings, and set both sides to auto or hard-code both identically. Then I would replace the patch cable, clear counters and watch whether errors still increase.

I would start with a source of truth for devices and variables, then use Ansible playbooks with Jinja2 templates to generate and push standard configs over SSH, keeping them in Git with peer review. A controller such as Catalyst Center could handle day-0 provisioning and compliance. I would start with read-only tasks like backups and audits, then move to small, tested change automation.

Association works, so the issue is between the AP or WLC and DHCP. I check the WLAN is mapped to the right dynamic interface and VLAN, that the VLAN is allowed on the WLC and AP trunks, and that DHCP relay or helper is set on the VLAN gateway. In FlexConnect local switching, I check the AP switchport trunk and VLAN mapping. Finally I check the DHCP scope.

Situation: as a fresher I realised many interview questions asked about recent attacks. Task: build a habit of learning. Action: I follow vendor security advisories, CERT-In alerts and a few security newsletters, practise in a home lab with packet captures, and read the release notes of devices we use. Result: I can explain current threats in interviews and suggested patching a vulnerable IOS version in my internship.

Situation: a senior manager was angry that his laptop lost network access before a client call. Task: fix it fast and calm him down. Action: I listened, gave a clear time estimate, found the port had been moved to a wrong VLAN in a recent change, corrected it and confirmed the call worked. Result: he was back online in ten minutes, and I added a port description check to our change process.

Situation: we had to migrate 30 access ports to new VLANs overnight. Task: finish with zero business impact. Action: I prepared configs in advance, got peer review, scheduled a rollback, informed the helpdesk and tested each floor with a laptop after changes. Result: the migration finished an hour early, morning tickets were zero, and the plan became our template for later VLAN changes.

Situation: a routing loop during a carrier change caused a two-hour outage and the operations head wanted an explanation. Task: explain cause and prevention simply. Action: I used a road map analogy, explained that two routers kept sending traffic to each other, showed the timeline and our fix, and listed three prevention steps with dates. Result: management approved a proper change review board, and trust in our team improved.