Skip to content
CCNA
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

CCNA Online Assessment Questions & Answers

40 questions for the online assessment stage — 18 easy, 18 medium, 4 hard.

About the online assessment round

Most companies start with an online test: aptitude and reasoning, a few MCQs on core CCNA concepts, and one or two short hands-on tasks. It filters a large number of applicants, so speed and accuracy both count.

Tips for the online assessment round

  • Practise under a timer: about one minute per MCQ and 15-20 minutes per hands-on task.
  • Read every option before answering; tests often include two nearly correct choices.
  • Use a stable internet connection, keep your camera on and avoid switching tabs in proctored tests.
  • Attempt the questions you are sure about first, then return to the harder ones.
Solved — online assessmentStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

How does controller-based networking differ from traditional networking?

Wireless and AutomationMedium
Save to ▾
Show answer
Traditionally each device has its own control plane and is configured box by box. In controller-based or software-defined networking, a central controller holds the policy and pushes it to devices through southbound APIs such as NETCONF or OpenFlow, while applications talk to the controller through northbound REST APIs. This gives consistent configuration, automation and network-wide visibility.
02

A new VLAN's users do not get DHCP addresses, but other VLANs work. What do you check?

IP ServicesMedium
Save to ▾
Show answer
I check that the SVI for the new VLAN is up and has ip helper-address pointing to the DHCP server, that the server has a scope for that subnet with the right gateway, and that the scope is activated. I confirm the VLAN is allowed on trunks. If DHCP snooping is enabled, I check the uplink is trusted, otherwise offers from the server are dropped.
03

What are the IPv4 address classes and private ranges?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
Class A is 1 to 126 with a default /8, Class B is 128 to 191 with /16, Class C is 192 to 223 with /24, Class D 224 to 239 is multicast and Class E is reserved. RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 127.0.0.0/8 is loopback and 169.254.0.0/16 is APIPA link-local. Today addressing is classless (CIDR).
04

What is a wildcard mask and how is it used in ACLs?

Network SecurityMedium
Save to ▾
Show answer
A wildcard mask tells the router which bits must match: 0 means must match and 1 means ignore. It is often the inverse of the subnet mask, so 192.168.1.0 0.0.0.255 matches the whole /24. host 10.1.1.1 equals 0.0.0.0 and any equals 255.255.255.255. Wildcards are also used in OSPF network statements. Calculate it by subtracting the mask from 255.255.255.255.
05

How does OSPF form a neighbour adjacency?

Routing and OSPFMedium
Save to ▾
Show answer
Routers send hellos to 224.0.0.5. They become neighbours if area ID, subnet and mask, hello and dead timers, authentication and stub flags match, and the router IDs are unique. States go Down, Init, 2-Way, ExStart, Exchange, Loading and Full. In ExStart and Exchange they agree master and slave and swap database descriptions, which is where an MTU mismatch causes a stuck adjacency.
06

How would you represent an interface configuration in JSON and YAML?

Wireless and AutomationEasy
Save to ▾
Show answer
The same data in both formats. JSON: { "interface": "GigabitEthernet0/1", "enabled": true, "ipv4": ["192.168.1.1/24"] } YAML: interface: GigabitEthernet0/1 enabled: true ipv4: - 192.168.1.1/24
07

What are syslog severity levels?

IP ServicesEasy
Save to ▾
Show answer
Syslog has eight levels from 0 to 7: emergency, alert, critical, error, warning, notification, informational and debugging. A useful memory line is Every Awesome Computer Engineer Will Need Ice cream Daily. Setting logging trap 6 sends levels 0 to 6 to the server. Syslog uses UDP 514 by default, and logs should carry timestamps with service timestamps log datetime msec.
08

How do you write a simple Python script to fetch interface data from a device?

Wireless and AutomationMedium
Save to ▾
Show answer
Netmiko handles SSH sessions; keep credentials in a file or vault, not the script. import yaml from netmiko import ConnectHandler # r1.yml holds device_type, host, username, password with open('r1.yml') as f: device = yaml.safe_load(f) with ConnectHandler(**device) as conn: output = conn.send_command('show ip interface brief') print(output)
09

Find the network, broadcast and usable range for 172.16.45.200/21.

IP Addressing and SubnettingMedium
Save to ▾
Show answer
A /21 mask is 255.255.248.0, so the interesting octet is the third with block size 8. 45 falls in the block starting at 40 (40 to 47). Network: 172.16.40.0 Broadcast: 172.16.47.255 Usable: 172.16.40.1 - 172.16.47.254 Hosts: 2^11 - 2 = 2046
10

What is 802.1Q tagging?

Switching and VLANsEasy
Save to ▾
Show answer
802.1Q inserts a 4-byte tag after the source MAC in the Ethernet frame. The tag holds a 12-bit VLAN ID (1 to 4094 usable), 3 priority bits used by CoS for QoS, and a DEI bit. The tag is added when a frame leaves a trunk and removed at an access port. Older ISL encapsulation is obsolete; modern switches support only 802.1Q.
11

How do you set the root bridge and verify STP?

STP and EtherChannelEasy
Save to ▾
Show answer
Set priorities on the intended primary and secondary roots, then verify. spanning-tree mode rapid-pvst spanning-tree vlan 10,20 root primary ! on the backup switch spanning-tree vlan 10,20 root secondary show spanning-tree vlan 10 show spanning-tree root show spanning-tree summary
12

How do you configure IPv4 static and default routes?

Routing and OSPFEasy
Save to ▾
Show answer
Use a next-hop IP, an exit interface, or both. ip route 10.2.0.0 255.255.0.0 192.168.12.2 ip route 0.0.0.0 0.0.0.0 203.0.113.1 ! floating backup with AD 200 ip route 0.0.0.0 0.0.0.0 198.51.100.1 200 ! IPv6 ipv6 route ::/0 2001:db8:12::2 show ip route static
13

What is a REST API and which HTTP methods map to CRUD?

Wireless and AutomationEasy
Save to ▾
Show answer
A REST API exposes resources at URLs and is stateless, usually with JSON payloads over HTTPS. CRUD maps to HTTP verbs: POST creates, GET reads, PUT replaces or PATCH partly updates, and DELETE removes. Responses use status codes such as 200 OK, 201 Created, 401 Unauthorized, 404 Not Found and 500 Server Error. Controllers expose northbound REST APIs for automation.
14

A newly configured router interface rejects the IP 192.168.5.64/26. Why?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
With a /26 the block size is 64, so 192.168.5.64 is the network address of the subnet .64 to .127 and cannot be assigned to a host or interface. IOS reports a bad mask or overlap error. Use a usable address such as 192.168.5.65 instead. Similarly .127 would be the broadcast. Always calculate the subnet boundary before configuring addresses.
15

How do you configure an LACP EtherChannel trunk?

STP and EtherChannelMedium
Save to ▾
Show answer
Put members in a channel group with mode active, then configure the port-channel. interface range GigabitEthernet1/0/47 - 48 channel-group 1 mode active interface Port-channel1 switchport mode trunk switchport trunk allowed vlan 10,20,99 port-channel load-balance src-dst-ip show etherchannel summary
16

How would you influence which port becomes the root port on a switch?

STP and EtherChannelHard
Save to ▾
Show answer
The root port is chosen by lowest cost, then sender bridge ID, then sender port ID. To prefer a link I lower its cost. interface GigabitEthernet1/0/49 spanning-tree vlan 10 cost 2 On the upstream switch you can change port priority instead. interface GigabitEthernet1/0/1 spanning-tree vlan 10 port-priority 64
17

What are the STP port states and timers in classic 802.1D?

STP and EtherChannelMedium
Save to ▾
Show answer
States are blocking, listening, learning, forwarding and disabled. Timers are hello 2 seconds, forward delay 15 seconds and max age 20 seconds. A port moves from blocking through listening and learning, each 15 seconds, so convergence can take 30 to 50 seconds. That delay is why Rapid STP and PortFast are used in modern networks.
18

How do you write and apply an extended named ACL?

Network SecurityMedium
Save to ▾
Show answer
Allow web traffic from one subnet to a server and block the rest of that subnet. ip access-list extended WEB-ONLY 10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.80 eq 443 20 deny ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255 30 permit ip any any interface vlan 10 ip access-group WEB-ONLY in show access-lists WEB-ONLY
19

What is the difference between a two-tier and a three-tier campus design?

Network FundamentalsMedium
Save to ▾
Show answer
A three-tier design has access, distribution and core layers: access connects users, distribution aggregates access switches and applies policy, and the core provides fast transport between distribution blocks. A two-tier or collapsed-core design merges core and distribution, which suits small and medium campuses with fewer buildings. Three-tier scales better when there are many distribution blocks.
20

How do you configure an 802.1Q trunk securely?

Switching and VLANsMedium
Save to ▾
Show answer
Hard-code the trunk, disable negotiation, change the native VLAN and prune VLANs. interface GigabitEthernet1/0/48 switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate switchport trunk native vlan 999 switchport trunk allowed vlan 10,20,30,99 show interfaces trunk
21

How do you configure single-area OSPFv2?

Routing and OSPFMedium
Save to ▾
Show answer
Set a router ID, enable OSPF on interfaces and make user ports passive. router ospf 1 router-id 1.1.1.1 auto-cost reference-bandwidth 100000 passive-interface GigabitEthernet0/1 network 10.0.12.0 0.0.0.3 area 0 network 192.168.1.0 0.0.0.255 area 0 default-information originate Or per interface: ip ospf 1 area 0
22

Explain password security best practices for network devices.

Network SecurityEasy
Save to ▾
Show answer
Use enable secret, not enable password, so the hash is strong (type 8 or 9 on modern IOS). Create local users with secret, enforce minimum length with security passwords min-length, and use AAA with TACACS+ for central control. Disable Telnet, use SSH v2, set exec-timeout on lines, and add login block-for to slow brute force. Avoid type 7 passwords, which are easily reversed.
23

What is the difference between TCP and UDP?

Network FundamentalsEasy
Save to ▾
Show answer
TCP is connection-oriented: it uses a three-way handshake, sequence numbers, acknowledgements, retransmission, windowing and flow control, so delivery is reliable and ordered. UDP is connectionless with an 8-byte header and no retransmission, so it is faster and lighter. HTTPS, SSH and SMTP use TCP; DNS queries, DHCP, SNMP, TFTP and voice or video RTP streams use UDP.
24

What is the difference between a hub, a switch and a router?

Network FundamentalsEasy
Save to ▾
Show answer
A hub is a Layer 1 repeater: it floods every bit out of every port, so all ports share one collision domain. A switch is Layer 2: it learns MAC addresses and forwards frames only to the correct port, giving each port its own collision domain. A router is Layer 3: it forwards packets between IP networks and separates broadcast domains.
25

What is the difference between an access port and a trunk port?

Switching and VLANsEasy
Save to ▾
Show answer
An access port belongs to one VLAN and carries untagged frames, typically to PCs, printers or servers. A trunk port carries traffic for many VLANs between switches, routers or hypervisors, adding an 802.1Q tag to identify each frame's VLAN, except the native VLAN which is sent untagged. Access ports can also carry a separate voice VLAN for IP phones.
26

How does a router choose the best route to a destination?

Routing and OSPFEasy
Save to ▾
Show answer
First it uses longest prefix match: the most specific matching prefix wins, so 10.1.1.0/24 beats 10.1.0.0/16. If the same prefix comes from different sources, the lowest administrative distance wins. If the same protocol offers several paths, the lowest metric wins, and equal metrics can be load-balanced with ECMP. Only the winners are installed in the routing table.
27

How do you make an access switch port a routed port on a Layer 3 switch?

Switching and VLANsHard
Save to ▾
Show answer
A routed port behaves like a router interface and does not belong to any VLAN. interface GigabitEthernet1/0/1 no switchport ip address 10.0.0.1 255.255.255.252 no shutdown Routed uplinks between distribution and core avoid spanning tree on those links and allow fast routing convergence with ECMP.
28

What is inter-VLAN routing and what are the ways to do it?

Switching and VLANsEasy
Save to ▾
Show answer
Hosts in different VLANs need a Layer 3 device to communicate. Options are: a router with one physical interface per VLAN (legacy), router-on-a-stick using one trunk with subinterfaces, or a Layer 3 switch with switched virtual interfaces (SVIs). SVIs are the most common in campuses because routing happens in hardware at line rate, with no single trunk bottleneck.
29

What is the structure of an IPv6 address and how is it shortened?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
IPv6 addresses are 128 bits written as eight groups of four hex digits separated by colons. Leading zeros in each group can be dropped, and one run of consecutive all-zero groups can be replaced with :: only once. For example 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1. A typical LAN uses a /64 prefix.
30

What is an underlay and an overlay network?

Wireless and AutomationHard
Save to ▾
Show answer
The underlay is the physical IP network of switches and routers that provides basic reachability, for example OSPF or IS-IS on routed links. The overlay is a virtual network built on top using tunnels such as VXLAN, so logical segments can stretch across the fabric independent of physical topology. SD-Access and SD-WAN use this model, with a fabric controlling the overlay.
31

How do you create a VLAN and assign an access port?

Switching and VLANsEasy
Save to ▾
Show answer
Create the VLAN, name it, and set the port mode and VLAN. vlan 20 name SALES interface GigabitEthernet1/0/5 switchport mode access switchport access vlan 20 switchport voice vlan 150 spanning-tree portfast show vlan brief
32

What is QoS and why is it needed?

IP ServicesMedium
Save to ▾
Show answer
Quality of Service gives different treatment to traffic types when links are congested. Voice needs low delay (under 150 ms one way), low jitter (under 30 ms) and low loss (under 1 percent), while bulk file transfer can wait. QoS tools classify and mark traffic, queue it with priority queues for voice, and police or shape rates. Without congestion QoS has no effect.
33

What must match for an EtherChannel to form?

STP and EtherChannelMedium
Save to ▾
Show answer
Member interfaces must have the same speed and duplex, the same mode (access or trunk), the same access VLAN or the same native and allowed VLAN list on trunks, and compatible negotiation modes. Mismatched settings put members into suspended state. Configure settings on the port-channel interface so they are pushed to members, and verify with show etherchannel summary.
34

What is NAT and what are its types?

IP ServicesEasy
Save to ▾
Show answer
Network Address Translation rewrites IP addresses as packets cross a router, usually private inside addresses to public outside ones. Static NAT maps one inside address to one public address, often for servers. Dynamic NAT maps from a pool. PAT, or NAT overload, maps many inside hosts to one public IP using unique source ports, and is what almost every office and home router uses.
35

A user complains the network is slow and the switch port shows many late collisions and CRC errors. What do you check?

Network FundamentalsMedium
Save to ▾
Show answer
Late collisions usually mean a duplex mismatch, and CRC errors point to bad cabling or interference. I would run show interfaces on the port to see duplex, speed and error counters, check the PC NIC settings, and set both sides to auto or hard-code both identically. Then I would replace the patch cable, clear counters and watch whether errors still increase.
36

How do you configure a Layer 3 EtherChannel?

STP and EtherChannelHard
Save to ▾
Show answer
Make members routed ports first, then put the IP on the port-channel. interface range TenGigabitEthernet1/1/1 - 2 no switchport channel-group 10 mode active interface Port-channel10 no switchport ip address 10.0.0.1 255.255.255.252 show etherchannel 10 summary show ip interface brief
37

What is SLAAC and how is it different from DHCPv6?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
With SLAAC a host learns the /64 prefix from a router advertisement and builds its own interface ID, without a server. Stateless DHCPv6 adds extra options such as DNS while the address still comes from SLAAC. Stateful DHCPv6 assigns the address itself and keeps bindings, similar to DHCPv4. RA flags M (managed) and O (other config) tell hosts which method to use.
38

How do you configure HSRP for a VLAN gateway?

Routing and OSPFMedium
Save to ▾
Show answer
Configure the same group and virtual IP on both switches, with higher priority on the active one. interface vlan 10 ip address 192.168.10.2 255.255.255.0 standby version 2 standby 10 ip 192.168.10.1 standby 10 priority 110 standby 10 preempt show standby brief Hosts use 192.168.10.1 as their gateway.
39

Logs show MAC address flapping for several hosts between an access port and an uplink. What do you check?

Switching and VLANsMedium
Save to ▾
Show answer
MAC flapping means the switch sees the same source MAC arriving on two ports, which usually points to a Layer 2 loop, a misconfigured server NIC team, or a virtual machine host bridging two uplinks. Check show mac address-table for the MAC, trace both ports, verify STP state and look for unmanaged switches or hypervisor teaming in active-active mode without a matching port channel. Fix the loop or teaming, and keep BPDU Guard on access ports.
40

How does DHCP work?

IP ServicesEasy
Save to ▾
Show answer
DHCP uses the DORA process: the client broadcasts Discover, the server answers with an Offer, the client broadcasts a Request for that offer, and the server confirms with an Acknowledgement. The lease includes IP, mask, gateway, DNS servers and lease time. Clients renew at 50 percent of the lease. DHCP uses UDP ports 67 for the server and 68 for the client.

Frequently asked questions

What happens in the CCNA online assessment round?

Most companies start with an online test: aptitude and reasoning, a few MCQs on core CCNA concepts, and one or two short hands-on tasks. It filters a large number of applicants, so speed and accuracy both count.

How do I clear the online assessment round?

Practise under a timer: about one minute per MCQ and 15-20 minutes per hands-on task. Read every option before answering; tests often include two nearly correct choices. Use a stable internet connection, keep your camera on and avoid switching tabs in proctored tests.

Which round comes next?

A typical order is online assessment, telephonic screening, one or two technical rounds, a managerial round and HR. Use the other round pages to practise each stage.

Practise every interview round

Telephonic Interview questionsTechnical Round questionsManagerial Round questionsRapid-Fire questionsHR & behavioural questionsFull mock interview

More ways to practise

Company-wise CCNA questionsExperience-wise CCNA questionsRole-wise CCNA questionsCity-wise CCNA questionsMost asked CCNA questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCCNA mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCCNA topic sheets