25 Network Fundamentals questions with answers for ccna roles — 10 easy, 12 medium, 3 hard.
About Network Fundamentals
Every networking interview starts here. This topic covers the OSI and TCP/IP models, TCP versus UDP, switches, routers and cabling, campus and data center designs, and the first IOS commands you use daily. It also covers bottom-up troubleshooting of slow links, interface errors and no-connectivity tickets, which are the bread and butter of NOC and support roles.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
From bottom to top: Physical, Data Link, Network, Transport, Session, Presentation and Application. Each layer serves the one above it. For example, Ethernet frames work at Layer 2, IP packets at Layer 3 and TCP segments at Layer 4. Engineers use the model to troubleshoot bottom-up: check cables and link lights first, then MAC learning, then IP reachability.
The TCP/IP model has four or five layers. Its Application layer covers OSI layers 5 to 7, Transport maps to Layer 4, Internet maps to Layer 3, and Network Access (or Link plus Physical) covers layers 1 and 2. CCNA uses the five-layer version. Real protocols such as HTTP, TCP and IP are defined by the TCP/IP suite, so it is the practical model.
TCP is connection-oriented: it uses a three-way handshake, sequence numbers, acknowledgements, retransmission, windowing and flow control, so delivery is reliable and ordered. UDP is connectionless with an 8-byte header and no retransmission, so it is faster and lighter. HTTPS, SSH and SMTP use TCP; DNS queries, DHCP, SNMP, TFTP and voice or video RTP streams use UDP.
The client sends a SYN with an initial sequence number. The server replies with SYN-ACK, acknowledging the client sequence and sending its own. The client sends an ACK and the session is established. Closing uses FIN and ACK from each side. A firewall that sees repeated SYNs without the final ACK may be looking at a SYN flood attack.
05
What is the difference between a hub, a switch and a router?
A hub is a Layer 1 repeater: it floods every bit out of every port, so all ports share one collision domain. A switch is Layer 2: it learns MAC addresses and forwards frames only to the correct port, giving each port its own collision domain. A router is Layer 3: it forwards packets between IP networks and separates broadcast domains.
06
Users on a new floor report no network connectivity at all and the switch port LEDs are off. What is your approach?
No link light means a Layer 1 problem. I verify the switch has power and the ports are not administratively shut down with show ip interface brief. I test the cable with a tester, check the patch panel mapping and confirm the NIC is enabled. If the switch uses PoE for phones or access points, I also check the power budget with show power inline.
07
How do you check interface status and errors on an IOS device?
show ip interface brief gives status and IP of all interfaces, and show interfaces gives counters and duplex.
Router# show ip interface brief
Router# show interfaces GigabitEthernet0/1
Router# show interfaces status
Router# clear counters GigabitEthernet0/1
Status up/down means Layer 1 is up but Layer 2 keepalives fail; administratively down means the interface is shut.
08
How do you do the basic initial configuration of a new switch?
Set the hostname, secure access and save the config.
enable
configure terminal
hostname SW1
enable secret Str0ngPass
service password-encryption
banner motd #Authorized access only#
line console 0
password ConPass
login
end
copy running-config startup-config
09
What is the difference between running-config and startup-config?
running-config lives in RAM and holds the active configuration, so every change applies immediately but is lost on reload. startup-config is stored in NVRAM and is loaded at boot. You save with copy running-config startup-config or write memory. To roll back unsaved changes you can reload without saving, which is why many engineers use reload in 10 before risky remote changes.
Situation: in college I set up the hostel Wi-Fi and LAN for 120 students. Task: fix constant drop-outs. Action: I learned VLANs, channel planning and DHCP, then practiced every CCNA topic in Packet Tracer and GNS3. Result: complaints dropped sharply, and I realised I enjoy solving real problems that affect many people. Networking underpins cloud, security and automation, so it gives me a long and growing career path.
11
What is a collision domain and a broadcast domain?
A collision domain is a segment where two devices sending at the same time can collide; every switch port is its own collision domain, and with full duplex collisions do not occur. A broadcast domain is the set of devices that receive a Layer 2 broadcast. Routers and VLANs separate broadcast domains, so one VLAN equals one broadcast domain.
Single-mode fiber has a small core (about 9 microns) and uses a laser, so it carries light over long distances, often 10 km or more. Multimode fiber has a larger core (50 or 62.5 microns), uses cheaper LED or VCSEL optics and suits shorter runs inside a building or data center, usually up to a few hundred metres at 10 Gbps. SFP modules must match the fiber type.
13
What is the difference between a two-tier and a three-tier campus design?
A three-tier design has access, distribution and core layers: access connects users, distribution aggregates access switches and applies policy, and the core provides fast transport between distribution blocks. A two-tier or collapsed-core design merges core and distribution, which suits small and medium campuses with fewer buildings. Three-tier scales better when there are many distribution blocks.
14
What is a spine-leaf architecture and why is it used in data centers?
In spine-leaf, every leaf switch connects to every spine switch, and servers connect only to leaves. Any server is therefore at most two hops from another, giving predictable latency and good east-west bandwidth. Capacity is added by adding spines or leaves. It usually runs Layer 3 with ECMP to use all links, instead of relying on spanning tree.
15
A user complains the network is slow and the switch port shows many late collisions and CRC errors. What do you check?
Late collisions usually mean a duplex mismatch, and CRC errors point to bad cabling or interference. I would run show interfaces on the port to see duplex, speed and error counters, check the PC NIC settings, and set both sides to auto or hard-code both identically. Then I would replace the patch cable, clear counters and watch whether errors still increase.
16
A PC can ping its default gateway but cannot open any website. How would you troubleshoot?
Gateway reachability proves Layers 1 to 3 locally, so I move upward. I ping a public IP address; if that works but names fail, DNS is the problem, so I check the configured DNS server with ipconfig /all and test with nslookup. If the public IP also fails, I check the router's default route, NAT and upstream link. Finally I check proxy settings and any firewall blocking ports 80 and 443.
17
Your company is adding a new branch with 40 users. What network components would you propose?
A branch router or SD-WAN edge for the WAN link and internet, one or two 48-port PoE access switches for PCs, phones and access points, and wireless access points managed by a controller or the cloud. I would add a firewall function, DHCP and DNS settings, VLANs for data, voice, guest and management, and a backup 4G or broadband link for resilience.
18
How do you configure SSH access on a switch or router?
SSH needs a hostname, domain name, RSA keys, a local user and VTY lines restricted to SSH.
hostname R1
ip domain-name lab.local
crypto key generate rsa modulus 2048
ip ssh version 2
username admin privilege 15 secret Adm1nPass
line vty 0 4
login local
transport input ssh
19
How do you use CDP and LLDP to discover neighbours?
CDP is a proprietary Layer 2 discovery protocol enabled by default on IOS; LLDP is the open IEEE 802.1AB standard.
show cdp neighbors
show cdp neighbors detail
configure terminal
lldp run
show lldp neighbors detail
Detail output shows the neighbour's IP, platform and port. Disable CDP on internet-facing ports with no cdp enable.
20
Which commands would you use to test end-to-end reachability and find where packets stop?
ping tests reachability and round-trip time, and traceroute shows each Layer 3 hop.
R1# ping 10.2.2.2 source Loopback0
R1# traceroute 10.2.2.2
PC> tracert 10.2.2.2
An extended ping lets you set source, size and the DF bit to test MTU. Where traceroute shows asterisks, that hop is dropping or filtering ICMP.
A switch reads the source MAC of each incoming frame and records it with the port in the MAC address table. For forwarding it looks up the destination MAC: a known unicast goes out one port, while unknown unicast, broadcast and most multicast frames are flooded in the VLAN. Entries age out after 300 seconds by default. Check with show mac address-table.
22
Tell me about a time you solved a difficult network outage.
Situation: a branch lost access to the data center during month-end close. Task: restore service fast. Action: I worked bottom-up, found the WAN link up but OSPF stuck in EXSTART, and traced it to an MTU change by the provider. I set ip ospf mtu-ignore as a temporary fix and raised a ticket for the MTU. Result: service was back in 25 minutes and I documented the check in our runbook.
23
A server team reports that a link between two switches is up but traffic is dropping intermittently. What do you check?
I check show interfaces on both ends for input errors, CRC, runts, giants, output drops and resets. Output drops suggest congestion, so I look at utilisation and QoS. CRC errors suggest a bad cable, dirty fiber or faulty SFP, so I check optical levels with show interfaces transceiver. I also confirm both sides agree on speed and duplex and that the MTU matches.
24
After a core switch replacement, ping works across the campus but large file transfers and some VPN sessions hang. What do you suspect?
Suspect an MTU mismatch. Small pings fit in one frame, but full-size packets are dropped when one link or the new switch uses a smaller MTU, or when ICMP is blocked so Path MTU Discovery fails. Test with ping using a size of 1472 and the do-not-fragment bit, compare interface MTU on both ends, and check jumbo frame settings. Fix by matching MTU end to end or adjusting TCP MSS on tunnel interfaces.
25
Tell me about a time you led a network migration or a major change.
Situation: our office had to move 300 users from old access switches to a new stack in one weekend. Task: I owned the plan. Action: I documented every port, pre-built configs, ran a pilot on one floor, wrote a rollback plan and kept a call bridge open with the desktop team. Result: we finished two hours early with only three port issues, fixed on Monday morning. I learned that a tested rollback plan gives the whole team confidence.
Frequently asked questions
How important is Network Fundamentals in CCNA interviews?
Every networking interview starts here. This topic covers the OSI and TCP/IP models, TCP versus UDP, switches, routers and cabling, campus and data center designs, and the first IOS commands you use daily. It also covers bottom-up troubleshooting of slow links, interface errors and no-connectivity tickets, which are the bread and butter of NOC and support roles.
How should I use the Network Fundamentals sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.