Skip to content
CCNA
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Practical CCNA Interview Questions

45 questions with answers. Hands-on questions where you write code, a query, a formula or concrete steps.

How to approach these questions

Talk while you work: say your approach first, write the simplest correct version, then improve it and mention edge cases.

Solved — practicalStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

How do you check interface status and errors on an IOS device?

Network FundamentalsEasy
Save to ▾
Show answer
show ip interface brief gives status and IP of all interfaces, and show interfaces gives counters and duplex. Router# show ip interface brief Router# show interfaces GigabitEthernet0/1 Router# show interfaces status Router# clear counters GigabitEthernet0/1 Status up/down means Layer 1 is up but Layer 2 keepalives fail; administratively down means the interface is shut.
02

How do you do the basic initial configuration of a new switch?

Network FundamentalsEasy
Save to ▾
Show answer
Set the hostname, secure access and save the config. enable configure terminal hostname SW1 enable secret Str0ngPass service password-encryption banner motd #Authorized access only# line console 0 password ConPass login end copy running-config startup-config
03

How do you configure SSH access on a switch or router?

Network FundamentalsMedium
Save to ▾
Show answer
SSH needs a hostname, domain name, RSA keys, a local user and VTY lines restricted to SSH. hostname R1 ip domain-name lab.local crypto key generate rsa modulus 2048 ip ssh version 2 username admin privilege 15 secret Adm1nPass line vty 0 4 login local transport input ssh
04

What is the difference between running-config and startup-config?

Network FundamentalsEasy
Save to ▾
Show answer
running-config lives in RAM and holds the active configuration, so every change applies immediately but is lost on reload. startup-config is stored in NVRAM and is loaded at boot. You save with copy running-config startup-config or write memory. To roll back unsaved changes you can reload without saving, which is why many engineers use reload in 10 before risky remote changes.
05

How do you use CDP and LLDP to discover neighbours?

Network FundamentalsMedium
Save to ▾
Show answer
CDP is a proprietary Layer 2 discovery protocol enabled by default on IOS; LLDP is the open IEEE 802.1AB standard. show cdp neighbors show cdp neighbors detail configure terminal lldp run show lldp neighbors detail Detail output shows the neighbour's IP, platform and port. Disable CDP on internet-facing ports with no cdp enable.
06

Which commands would you use to test end-to-end reachability and find where packets stop?

Network FundamentalsMedium
Save to ▾
Show answer
ping tests reachability and round-trip time, and traceroute shows each Layer 3 hop. R1# ping 10.2.2.2 source Loopback0 R1# traceroute 10.2.2.2 PC> tracert 10.2.2.2 An extended ping lets you set source, size and the DF bit to test MTU. Where traceroute shows asterisks, that hop is dropping or filtering ICMP.
07

Find the network, broadcast and usable range for 172.16.45.200/21.

IP Addressing and SubnettingMedium
Save to ▾
Show answer
A /21 mask is 255.255.248.0, so the interesting octet is the third with block size 8. 45 falls in the block starting at 40 (40 to 47). Network: 172.16.40.0 Broadcast: 172.16.47.255 Usable: 172.16.40.1 - 172.16.47.254 Hosts: 2^11 - 2 = 2046
08

You have 192.168.10.0/24 and need subnets for 100, 50, 20 hosts and two point-to-point links. Design it with VLSM.

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Allocate largest first so blocks align. 100 hosts -> /25: 192.168.10.0/25 (.1 - .126) 50 hosts -> /26: 192.168.10.128/26 (.129 - .190) 20 hosts -> /27: 192.168.10.192/27 (.193 - .222) Link 1 -> /30: 192.168.10.224/30 Link 2 -> /30: 192.168.10.228/30 Free for growth: 192.168.10.232 - .255
09

How do you configure IPv4 and IPv6 on a router interface?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
Enable IPv6 routing globally, then add both addresses to the interface. ipv6 unicast-routing interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ipv6 address 2001:db8:1:1::1/64 ipv6 address fe80::1 link-local no shutdown Verify with show ip interface brief and show ipv6 interface brief.
10

How do you verify IP settings and test from a Windows and Linux host?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
Windows and Linux both have a small core toolkit. ipconfig /all (IP, mask, gateway, DNS, DHCP server) ipconfig /release && ipconfig /renew arp -a ip addr ; ip route ; ip neigh resolvectl status nslookup example.com Add ping and tracert or traceroute to test the path.
11

How do you quickly calculate how many subnets and hosts a mask gives?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Use two formulas and memorise the mask octets. Subnets = 2^(borrowed bits) Hosts = 2^(host bits) - 2 Example: 10.0.0.0/8 to /20 -> 2^12 = 4096 subnets, 2^12 - 2 = 4094 hosts Mask octets: 128 192 224 240 248 252 254 255 Block size = 256 - mask octet
12

How would you plan an IP addressing scheme for a company with 10 branches?

IP Addressing and SubnettingHard
Save to ▾
Show answer
I would reserve a large block, for example 10.0.0.0/16, and give each branch a summarizable /20 such as 10.0.16.0/20, 10.0.32.0/20 and so on. Inside each, assign fixed ranges per role: users, voice, wireless, servers, management and WAN links. This lets each branch be summarized as one route, keeps firewall rules simple, and leaves room to grow. I keep it in an IPAM tool.
13

How do you create a VLAN and assign an access port?

Switching and VLANsEasy
Save to ▾
Show answer
Create the VLAN, name it, and set the port mode and VLAN. vlan 20 name SALES interface GigabitEthernet1/0/5 switchport mode access switchport access vlan 20 switchport voice vlan 150 spanning-tree portfast show vlan brief
14

How do you configure an 802.1Q trunk securely?

Switching and VLANsMedium
Save to ▾
Show answer
Hard-code the trunk, disable negotiation, change the native VLAN and prune VLANs. interface GigabitEthernet1/0/48 switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate switchport trunk native vlan 999 switchport trunk allowed vlan 10,20,30,99 show interfaces trunk
15

How do you configure router-on-a-stick?

Switching and VLANsMedium
Save to ▾
Show answer
Use one trunk link and a subinterface per VLAN with 802.1Q encapsulation. interface GigabitEthernet0/0 no shutdown interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 interface GigabitEthernet0/0.20 encapsulation dot1Q 20 ip address 192.168.20.1 255.255.255.0 The switch port facing the router must be a trunk.
16

How do you configure inter-VLAN routing on a Layer 3 switch with SVIs?

Switching and VLANsMedium
Save to ▾
Show answer
Enable routing and create an SVI per VLAN as the gateway. ip routing interface vlan 10 ip address 192.168.10.1 255.255.255.0 ip helper-address 10.0.0.50 no shutdown interface vlan 20 ip address 192.168.20.1 255.255.255.0 no shutdown show ip route connected
17

How do you verify VLANs, trunks and MAC learning on a switch?

Switching and VLANsEasy
Save to ▾
Show answer
These show commands cover most VLAN troubleshooting. show vlan brief show interfaces trunk show interfaces Gi1/0/5 switchport show mac address-table vlan 20 show mac address-table address 0050.56ab.cdef show interfaces status They show VLAN membership, allowed and active VLANs on trunks, native VLAN and where each MAC was learned.
18

How do you make an access switch port a routed port on a Layer 3 switch?

Switching and VLANsHard
Save to ▾
Show answer
A routed port behaves like a router interface and does not belong to any VLAN. interface GigabitEthernet1/0/1 no switchport ip address 10.0.0.1 255.255.255.252 no shutdown Routed uplinks between distribution and core avoid spanning tree on those links and allow fast routing convergence with ECMP.
19

How do you set the root bridge and verify STP?

STP and EtherChannelEasy
Save to ▾
Show answer
Set priorities on the intended primary and secondary roots, then verify. spanning-tree mode rapid-pvst spanning-tree vlan 10,20 root primary ! on the backup switch spanning-tree vlan 10,20 root secondary show spanning-tree vlan 10 show spanning-tree root show spanning-tree summary
20

How do you configure PortFast and BPDU Guard on access ports?

STP and EtherChannelEasy
Save to ▾
Show answer
Apply per port or globally for all PortFast ports. interface range GigabitEthernet1/0/1 - 46 switchport mode access spanning-tree portfast spanning-tree bpduguard enable ! or globally spanning-tree portfast default spanning-tree portfast bpduguard default errdisable recovery cause bpduguard errdisable recovery interval 300
21

How do you configure an LACP EtherChannel trunk?

STP and EtherChannelMedium
Save to ▾
Show answer
Put members in a channel group with mode active, then configure the port-channel. interface range GigabitEthernet1/0/47 - 48 channel-group 1 mode active interface Port-channel1 switchport mode trunk switchport trunk allowed vlan 10,20,99 port-channel load-balance src-dst-ip show etherchannel summary
22

How do you configure a Layer 3 EtherChannel?

STP and EtherChannelHard
Save to ▾
Show answer
Make members routed ports first, then put the IP on the port-channel. interface range TenGigabitEthernet1/1/1 - 2 no switchport channel-group 10 mode active interface Port-channel10 no switchport ip address 10.0.0.1 255.255.255.252 show etherchannel 10 summary show ip interface brief
23

How would you influence which port becomes the root port on a switch?

STP and EtherChannelHard
Save to ▾
Show answer
The root port is chosen by lowest cost, then sender bridge ID, then sender port ID. To prefer a link I lower its cost. interface GigabitEthernet1/0/49 spanning-tree vlan 10 cost 2 On the upstream switch you can change port priority instead. interface GigabitEthernet1/0/1 spanning-tree vlan 10 port-priority 64
24

How do you configure IPv4 static and default routes?

Routing and OSPFEasy
Save to ▾
Show answer
Use a next-hop IP, an exit interface, or both. ip route 10.2.0.0 255.255.0.0 192.168.12.2 ip route 0.0.0.0 0.0.0.0 203.0.113.1 ! floating backup with AD 200 ip route 0.0.0.0 0.0.0.0 198.51.100.1 200 ! IPv6 ipv6 route ::/0 2001:db8:12::2 show ip route static
25

How do you configure single-area OSPFv2?

Routing and OSPFMedium
Save to ▾
Show answer
Set a router ID, enable OSPF on interfaces and make user ports passive. router ospf 1 router-id 1.1.1.1 auto-cost reference-bandwidth 100000 passive-interface GigabitEthernet0/1 network 10.0.12.0 0.0.0.3 area 0 network 192.168.1.0 0.0.0.255 area 0 default-information originate Or per interface: ip ospf 1 area 0
26

Which commands verify OSPF operation?

Routing and OSPFEasy
Save to ▾
Show answer
These commands cover neighbours, interfaces, routes and the database. show ip ospf neighbor show ip ospf interface brief show ip ospf interface Gi0/0 show ip route ospf show ip ospf database show ip protocols show ip protocols shows router ID, networks, passive interfaces and the reference bandwidth.
27

How do you configure HSRP for a VLAN gateway?

Routing and OSPFMedium
Save to ▾
Show answer
Configure the same group and virtual IP on both switches, with higher priority on the active one. interface vlan 10 ip address 192.168.10.2 255.255.255.0 standby version 2 standby 10 ip 192.168.10.1 standby 10 priority 110 standby 10 preempt show standby brief Hosts use 192.168.10.1 as their gateway.
28

How do you read a line in the IOS routing table?

Routing and OSPFEasy
Save to ▾
Show answer
Example line: O 10.2.2.0/24 [110/20] via 10.0.12.2, 00:05:12, GigabitEthernet0/0 O is the source (OSPF), 10.2.2.0/24 the prefix, 110 the administrative distance and 20 the metric, 10.0.12.2 the next hop, then the age and exit interface. C is connected, L local host route, S static, D EIGRP and an asterisk marks the candidate default.
29

How do you change OSPF DR election on a segment?

Routing and OSPFHard
Save to ▾
Show answer
Set interface priority; higher wins and 0 never becomes DR. interface GigabitEthernet0/0 ip ospf priority 255 ! on a router that should never be DR interface GigabitEthernet0/0 ip ospf priority 0 clear ip ospf process Because election is non-preemptive, reset the process or the neighbours for the change to take effect.
30

How do you configure a DHCP server on a router?

IP ServicesEasy
Save to ▾
Show answer
Exclude static addresses first, then define the pool. ip dhcp excluded-address 192.168.10.1 192.168.10.20 ip dhcp pool VLAN10 network 192.168.10.0 255.255.255.0 default-router 192.168.10.1 dns-server 8.8.8.8 1.1.1.1 lease 7 show ip dhcp binding show ip dhcp pool
31

How do you configure PAT (NAT overload)?

IP ServicesMedium
Save to ▾
Show answer
Mark interfaces, match inside hosts with an ACL and overload the outside interface. interface GigabitEthernet0/1 ip nat inside interface GigabitEthernet0/0 ip nat outside access-list 1 permit 192.168.0.0 0.0.255.255 ip nat inside source list 1 interface GigabitEthernet0/0 overload show ip nat translations
32

How do you configure NTP, syslog and SNMPv3 on a device?

IP ServicesHard
Save to ▾
Show answer
A typical management baseline: ntp server 10.0.0.10 prefer clock timezone IST 5 30 service timestamps log datetime msec localtime logging host 10.0.0.20 logging trap informational snmp-server group NMS v3 priv snmp-server user nmsuser NMS v3 auth sha AuthPass1 priv aes 128 PrivPass1 snmp-server host 10.0.0.30 version 3 priv nmsuser
33

How do you configure a router as a DHCP relay and verify it?

IP ServicesMedium
Save to ▾
Show answer
Add the helper address on the client-facing interface. interface vlan 20 ip helper-address 10.0.0.50 show ip interface vlan 20 | include Helper debug ip dhcp server packet The helper also forwards some other UDP broadcasts such as TFTP and DNS by default; use no ip forward-protocol udp to limit them.
34

How do you back up and restore a device configuration?

IP ServicesMedium
Save to ▾
Show answer
Copy the config to a server and back. copy running-config tftp://10.0.0.40/R1-backup.cfg copy running-config scp://admin@10.0.0.40/R1.cfg copy tftp://10.0.0.40/R1-backup.cfg running-config configure replace flash:R1-good.cfg archive path flash:R1-archive write-memory configure replace gives a clean rollback instead of merging.
35

Which QoS classes would you build for a typical branch WAN?

IP ServicesHard
Save to ▾
Show answer
A simple five-class model works for most branches. Voice (EF) priority queue, about 10 percent Video (AF41) guaranteed 20-25 percent Signalling (CS3) 5 percent Business apps (AF21) 25-30 percent Default (BE) remaining, with fair queuing Scavenger (CS1) small share for backups and updates
36

How do you write and apply an extended named ACL?

Network SecurityMedium
Save to ▾
Show answer
Allow web traffic from one subnet to a server and block the rest of that subnet. ip access-list extended WEB-ONLY 10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.80 eq 443 20 deny ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255 30 permit ip any any interface vlan 10 ip access-group WEB-ONLY in show access-lists WEB-ONLY
37

How do you configure port security with sticky MACs?

Network SecurityEasy
Save to ▾
Show answer
Port security works on static access ports. interface GigabitEthernet1/0/10 switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security mac-address sticky switchport port-security violation restrict show port-security interface Gi1/0/10
38

How do you enable DHCP snooping and DAI?

Network SecurityHard
Save to ▾
Show answer
Enable per VLAN, trust uplinks and rate-limit user ports. ip dhcp snooping ip dhcp snooping vlan 10,20 no ip dhcp snooping information option ip arp inspection vlan 10,20 interface GigabitEthernet1/0/48 ip dhcp snooping trust ip arp inspection trust interface range Gi1/0/1 - 46 ip dhcp snooping limit rate 15 show ip dhcp snooping binding
39

How do you restrict SSH access to devices from only the management subnet?

Network SecurityMedium
Save to ▾
Show answer
Use a standard ACL on the VTY lines. ip access-list standard MGMT-ONLY permit 10.99.0.0 0.0.0.255 deny any log line vty 0 15 access-class MGMT-ONLY in transport input ssh exec-timeout 10 0 login block-for 120 attempts 3 within 60
40

How do you configure AAA with TACACS+ and a local fallback?

Network SecurityHard
Save to ▾
Show answer
Define the server, then method lists with local as backup. aaa new-model tacacs server ISE1 address ipv4 10.0.0.60 key Tac@csKey1 aaa authentication login default group tacacs+ local aaa authorization exec default group tacacs+ local aaa accounting commands 15 default start-stop group tacacs+ username breakglass privilege 15 secret L0calOnly!
41

How do you write a simple Python script to fetch interface data from a device?

Wireless and AutomationMedium
Save to ▾
Show answer
Netmiko handles SSH sessions; keep credentials in a file or vault, not the script. import yaml from netmiko import ConnectHandler # r1.yml holds device_type, host, username, password with open('r1.yml') as f: device = yaml.safe_load(f) with ConnectHandler(**device) as conn: output = conn.send_command('show ip interface brief') print(output)
42

How do you call a REST API from Python and parse the JSON?

Wireless and AutomationHard
Save to ▾
Show answer
Use the requests library and convert the reply to a dictionary. import requests url = 'https://controller.example.local/api/v1/network-device' headers = {'X-Auth-Token': token, 'Accept': 'application/json'} r = requests.get(url, headers=headers, timeout=10) r.raise_for_status() for dev in r.json()['response']: print(dev['hostname'], dev['managementIpAddress'])
43

Write a simple Ansible playbook that configures NTP on IOS devices.

Wireless and AutomationMedium
Save to ▾
Show answer
Ansible uses YAML and the ios_config module. - name: Configure NTP hosts: ios_switches gather_facts: no connection: network_cli tasks: - name: Set NTP server ios_config: lines: - ntp server 10.0.0.10 save_when: modified
44

What are the basic steps to configure a WLAN with WPA2 or WPA3 on a controller GUI?

Wireless and AutomationMedium
Save to ▾
Show answer
Steps on a typical WLC GUI: create a dynamic interface with VLAN, IP and DHCP server; go to WLANs and create a new WLAN with profile name and SSID; map it to the dynamic interface; under Security choose WPA2 or WPA3 with PSK or 802.1X and add the RADIUS server for enterprise; set QoS profile; enable the WLAN and apply it to AP groups.
45

How would you represent an interface configuration in JSON and YAML?

Wireless and AutomationEasy
Save to ▾
Show answer
The same data in both formats. JSON: { "interface": "GigabitEthernet0/1", "enabled": true, "ipv4": ["192.168.1.1/24"] } YAML: interface: GigabitEthernet0/1 enabled: true ipv4: - 192.168.1.1/24

Frequently asked questions

Why are practical questions important?

Most technical rounds include at least one live task. Practising the exact typing and reasoning makes you calm and fast in the real round.

How should I answer them?

Talk while you work: say your approach first, write the simplest correct version, then improve it and mention edge cases.

More ways to practise

Company-wise CCNA questionsExperience-wise CCNA questionsRole-wise CCNA questionsCity-wise CCNA questionsMost asked CCNA questionsScenario-based questionsHR & behavioural questionsCCNA mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCCNA topic sheets