Skip to content
CCNA
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

CCNA Rapid-Fire Questions & Answers

50 questions for the rapid-fire stage — 33 easy, 16 medium, 1 hard.

About the rapid-fire round

Rapid-fire questions are quick definitions and one-line answers that interviewers fire at the start or end of a round to check your CCNA basics. Aim to answer each in under 20 seconds.

Tips for the rapid-fire round

  • Answer in one or two sentences, then stop.
  • If you don't know, say so quickly and move on; don't guess at length.
  • Revise these the morning of the interview.
  • Practise with a friend who reads them in random order.
Solved — rapid-fireStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What is the difference between a hub, a switch and a router?

Network FundamentalsEasy
Save to ▾
Show answer
A hub is a Layer 1 repeater: it floods every bit out of every port, so all ports share one collision domain. A switch is Layer 2: it learns MAC addresses and forwards frames only to the correct port, giving each port its own collision domain. A router is Layer 3: it forwards packets between IP networks and separates broadcast domains.
02

What are SSID, BSSID and ESS?

Wireless and AutomationEasy
Save to ▾
Show answer
The SSID is the network name users see. The BSSID is the MAC address of the access point radio serving a BSS, the basic service set of one AP and its clients. An ESS is multiple BSSs sharing the same SSID connected by a wired distribution system, so clients can roam between APs. Each AP can broadcast several SSIDs, each with its own BSSID.
03

What is the structure of an IPv6 address and how is it shortened?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
IPv6 addresses are 128 bits written as eight groups of four hex digits separated by colons. Leading zeros in each group can be dropped, and one run of consecutive all-zero groups can be replaced with :: only once. For example 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1. A typical LAN uses a /64 prefix.
04

What is QoS and why is it needed?

IP ServicesMedium
Save to ▾
Show answer
Quality of Service gives different treatment to traffic types when links are congested. Voice needs low delay (under 150 ms one way), low jitter (under 30 ms) and low loss (under 1 percent), while bulk file transfer can wait. QoS tools classify and mark traffic, queue it with priority queues for voice, and police or shape rates. Without congestion QoS has no effect.
05

What is NAT and what are its types?

IP ServicesEasy
Save to ▾
Show answer
Network Address Translation rewrites IP addresses as packets cross a router, usually private inside addresses to public outside ones. Static NAT maps one inside address to one public address, often for servers. Dynamic NAT maps from a pool. PAT, or NAT overload, maps many inside hosts to one public IP using unique source ports, and is what almost every office and home router uses.
06

What is AAA and the difference between TACACS+ and RADIUS?

Network SecurityMedium
Save to ▾
Show answer
AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.
07

Why are channels 1, 6 and 11 used in 2.4 GHz?

Wireless and AutomationEasy
Save to ▾
Show answer
In 2.4 GHz each channel is about 22 MHz wide but channels are only 5 MHz apart, so most adjacent channels overlap and interfere. Channels 1, 6 and 11 are the only three non-overlapping channels, so neighbouring access points should alternate between them. The 5 GHz band has many more non-overlapping 20 MHz channels, which is why it is preferred for capacity.
08

How does the TCP/IP model map to the OSI model?

Network FundamentalsEasy
Save to ▾
Show answer
The TCP/IP model has four or five layers. Its Application layer covers OSI layers 5 to 7, Transport maps to Layer 4, Internet maps to Layer 3, and Network Access (or Link plus Physical) covers layers 1 and 2. CCNA uses the five-layer version. Real protocols such as HTTP, TCP and IP are defined by the TCP/IP suite, so it is the practical model.
09

What is EtherChannel and its benefits?

STP and EtherChannelEasy
Save to ▾
Show answer
EtherChannel bundles 2 to 8 physical links into one logical port-channel. STP sees it as one link, so all members forward instead of one being blocked. It adds bandwidth and redundancy, as one member failing does not drop the channel. Traffic is load-balanced per flow using a hash of MAC, IP or port fields, so a single flow still uses only one member link.
10

What are the key elements of a security program for a network?

Network SecurityEasy
Save to ▾
Show answer
A security program combines user awareness training, physical access control, and technical controls such as strong authentication, firewalls, IPS, VPNs and patching. It is built around the CIA triad: confidentiality, integrity and availability. Policies define what is allowed, and logging and monitoring detect problems. CCNA focuses on device hardening, ACLs, Layer 2 security, AAA, VPNs and wireless security.
11

What are the IPv4 address classes and private ranges?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
Class A is 1 to 126 with a default /8, Class B is 128 to 191 with /16, Class C is 192 to 223 with /24, Class D 224 to 239 is multicast and Class E is reserved. RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 127.0.0.0/8 is loopback and 169.254.0.0/16 is APIPA link-local. Today addressing is classless (CIDR).
12

What are the default administrative distances you should know?

Routing and OSPFEasy
Save to ▾
Show answer
Connected 0, static 1, EIGRP summary 5, eBGP 20, internal EIGRP 90, OSPF 110, IS-IS 115, RIP 120, external EIGRP 170 and iBGP 200. A value of 255 means the route is never used. AD compares trust between sources, so a static route with AD 1 beats OSPF for the same prefix unless you configure a floating static with a higher AD.
13

How is the OSPF router ID chosen?

Routing and OSPFEasy
Save to ▾
Show answer
The router ID is a 32-bit value chosen in this order: manually configured router-id, then the highest IP on an up loopback interface, then the highest IP on an up physical interface. It is chosen when the OSPF process starts, so changes need clear ip ospf process. Best practice is to set it manually so it is stable and easy to recognise in the database.
14

What is route summarization and how do you calculate a summary?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Summarization advertises one prefix that covers several contiguous networks, shrinking routing tables and hiding instability. Write the networks in binary and keep the common leading bits. For 10.1.4.0/24 to 10.1.7.0/24, the third octet values 4 to 7 share the first six bits (000001), so the summary is 10.1.4.0/22. Make sure the summary does not include networks that live elsewhere.
15

What is a VLAN and why is it used?

Switching and VLANsEasy
Save to ▾
Show answer
A VLAN is a logical Layer 2 broadcast domain created on a switch, independent of physical location. VLANs separate users, voice, guests and servers, reduce broadcast traffic, and improve security because traffic between VLANs must pass through a router or Layer 3 switch where it can be filtered. For example, finance and guest Wi-Fi users can share switches but stay isolated.
16

How does a router choose the best route to a destination?

Routing and OSPFEasy
Save to ▾
Show answer
First it uses longest prefix match: the most specific matching prefix wins, so 10.1.1.0/24 beats 10.1.0.0/16. If the same prefix comes from different sources, the lowest administrative distance wins. If the same protocol offers several paths, the lowest metric wins, and equal metrics can be load-balanced with ECMP. Only the winners are installed in the routing table.
17

Explain password security best practices for network devices.

Network SecurityEasy
Save to ▾
Show answer
Use enable secret, not enable password, so the hash is strong (type 8 or 9 on modern IOS). Create local users with secret, enforce minimum length with security passwords min-length, and use AAA with TACACS+ for central control. Disable Telnet, use SSH v2, set exec-timeout on lines, and add login block-for to slow brute force. Avoid type 7 passwords, which are easily reversed.
18

Why does OSPF use areas and what is area 0?

Routing and OSPFMedium
Save to ▾
Show answer
Areas limit how far detailed LSAs flood, so SPF runs on a smaller database and changes in one area do not force recalculation everywhere. Area 0 is the backbone and every other area must connect to it, directly or through a virtual link. Routers connecting areas are ABRs and can summarize routes between areas. Single-area OSPF is the focus of CCNA.
19

What is DTP and why should you disable it?

Switching and VLANsMedium
Save to ▾
Show answer
Dynamic Trunking Protocol negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access. Auto plus auto stays access, while desirable with auto or desirable forms a trunk. Attackers can use DTP to form a trunk and reach all VLANs, so best practice is to hard-code access or trunk and use switchport nonegotiate on trunks.
20

What is a REST API and which HTTP methods map to CRUD?

Wireless and AutomationEasy
Save to ▾
Show answer
A REST API exposes resources at URLs and is stateless, usually with JSON payloads over HTTPS. CRUD maps to HTTP verbs: POST creates, GET reads, PUT replaces or PATCH partly updates, and DELETE removes. Responses use status codes such as 200 OK, 201 Created, 401 Unauthorized, 404 Not Found and 500 Server Error. Controllers expose northbound REST APIs for automation.
21

What are the data plane, control plane and management plane?

Wireless and AutomationEasy
Save to ▾
Show answer
The data plane forwards packets, using tables such as the FIB and MAC table, ideally in hardware. The control plane builds those tables using protocols like OSPF, STP and ARP. The management plane is how admins and tools interact with the device, through SSH, SNMP, syslog and APIs. Separating them helps understanding of SDN, where the control plane can be centralised.
22

How does controller-based networking differ from traditional networking?

Wireless and AutomationMedium
Save to ▾
Show answer
Traditionally each device has its own control plane and is configured box by box. In controller-based or software-defined networking, a central controller holds the policy and pushes it to devices through southbound APIs such as NETCONF or OpenFlow, while applications talk to the controller through northbound REST APIs. This gives consistent configuration, automation and network-wide visibility.
23

What are DR and BDR in OSPF and why are they needed?

Routing and OSPFMedium
Save to ▾
Show answer
On multi-access networks such as Ethernet, a full mesh of adjacencies would create too many LSAs. OSPF elects a Designated Router and Backup DR; other routers (DROTHERs) form full adjacency only with them and stay 2-Way with each other. The highest interface priority wins, then highest router ID; priority 0 means never DR. Election is non-preemptive, so a new better router does not take over.
24

What are syslog severity levels?

IP ServicesEasy
Save to ▾
Show answer
Syslog has eight levels from 0 to 7: emergency, alert, critical, error, warning, notification, informational and debugging. A useful memory line is Every Awesome Computer Engineer Will Need Ice cream Daily. Setting logging trap 6 sends levels 0 to 6 to the server. Syslog uses UDP 514 by default, and logs should carry timestamps with service timestamps log datetime msec.
25

How are ACL entries processed and what is the implicit deny?

Network SecurityEasy
Save to ▾
Show answer
ACL entries are checked top-down and the first match decides permit or deny; later lines are ignored. Every ACL ends with an invisible deny any, so traffic that matches no line is dropped. Therefore specific entries must come before general ones, and an ACL with only deny statements blocks everything. Always add a permit for allowed traffic and test after applying.
26

How does DNS resolution work?

IP ServicesMedium
Save to ▾
Show answer
A client asks its configured resolver, for example for www.example.com. If it is not cached, the resolver queries a root server, which refers it to the .com TLD server, which refers it to the authoritative server for example.com, which returns the A or AAAA record. The answer is cached for its TTL. DNS uses UDP 53 for most queries and TCP 53 for zone transfers and large replies.
27

Why is Spanning Tree Protocol needed?

STP and EtherChannelEasy
Save to ▾
Show answer
Redundant Layer 2 links create loops, and Ethernet frames have no TTL, so broadcasts circulate forever, causing broadcast storms, MAC table instability and duplicate frames. STP (802.1D) blocks redundant paths so there is one loop-free path to every switch, and unblocks a backup link if the active one fails. Without it, a single loop can take down a whole campus within seconds.
28

What is a floating static route?

Routing and OSPFMedium
Save to ▾
Show answer
A floating static route is a backup static route with a higher administrative distance than the primary route, so it stays out of the routing table until the primary disappears. For example, if OSPF (AD 110) learns the main path, ip route 0.0.0.0 0.0.0.0 203.0.113.1 200 installs only when OSPF loses the route. It is common for backup internet or 4G links.
29

What is the difference between an access port and a trunk port?

Switching and VLANsEasy
Save to ▾
Show answer
An access port belongs to one VLAN and carries untagged frames, typically to PCs, printers or servers. A trunk port carries traffic for many VLANs between switches, routers or hypervisors, adding an 802.1Q tag to identify each frame's VLAN, except the native VLAN which is sent untagged. Access ports can also carry a separate voice VLAN for IP phones.
30

How does DHCP work?

IP ServicesEasy
Save to ▾
Show answer
DHCP uses the DORA process: the client broadcasts Discover, the server answers with an Offer, the client broadcasts a Request for that offer, and the server confirms with an Acknowledgement. The lease includes IP, mask, gateway, DNS servers and lease time. Clients renew at 50 percent of the lease. DHCP uses UDP ports 67 for the server and 68 for the client.
31

What are the STP port states and timers in classic 802.1D?

STP and EtherChannelMedium
Save to ▾
Show answer
States are blocking, listening, learning, forwarding and disabled. Timers are hello 2 seconds, forward delay 15 seconds and max age 20 seconds. A port moves from blocking through listening and learning, each 15 seconds, so convergence can take 30 to 50 seconds. That delay is why Rapid STP and PortFast are used in modern networks.
32

Explain the TCP three-way handshake.

Network FundamentalsEasy
Save to ▾
Show answer
The client sends a SYN with an initial sequence number. The server replies with SYN-ACK, acknowledging the client sequence and sending its own. The client sends an ACK and the session is established. Closing uses FIN and ACK from each side. A firewall that sees repeated SYNs without the final ACK may be looking at a SYN flood attack.
33

How does ARP work and what is a gratuitous ARP?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
When a host needs the MAC for an IP on its subnet, it broadcasts an ARP request and the owner replies with a unicast ARP reply; the result is cached. For remote destinations the host ARPs for its default gateway. A gratuitous ARP is an unsolicited announcement of a host's own IP-to-MAC mapping, used after failover, for example by HSRP, to update switch and host tables.
34

What is NTP and why does time matter on network devices?

IP ServicesEasy
Save to ▾
Show answer
NTP synchronises clocks over UDP 123 using a hierarchy of strata, where stratum 1 servers connect to an atomic or GPS clock. Correct time matters because syslog and incident timelines must line up across devices, certificates and authentication protocols check time, and logs are legal evidence. Devices can be NTP clients, servers or peers, and NTP authentication protects against fake time sources.
35

What is SNMP and the differences between v2c and v3?

IP ServicesMedium
Save to ▾
Show answer
SNMP lets a manager poll devices for counters and receive traps or informs about events, using a MIB with OIDs. Polling uses UDP 161 and traps UDP 162. SNMPv2c uses a plain-text community string with no encryption. SNMPv3 adds user-based authentication and encryption with authPriv mode, so it is the version to use in production, especially on networks reachable from many teams.
36

What is Dynamic ARP Inspection?

Network SecurityHard
Save to ▾
Show answer
DAI checks ARP packets on untrusted ports against the DHCP snooping binding table and drops ARP replies whose IP-to-MAC mapping does not match. This stops ARP spoofing and man-in-the-middle attacks where an attacker claims to be the default gateway. Static hosts need ARP ACLs. It requires DHCP snooping enabled in the same VLAN and trusted uplink ports.
37

What is the difference between TCP and UDP?

Network FundamentalsEasy
Save to ▾
Show answer
TCP is connection-oriented: it uses a three-way handshake, sequence numbers, acknowledgements, retransmission, windowing and flow control, so delivery is reliable and ordered. UDP is connectionless with an 8-byte header and no retransmission, so it is faster and lighter. HTTPS, SSH and SMTP use TCP; DNS queries, DHCP, SNMP, TFTP and voice or video RTP streams use UDP.
38

What is a DHCP relay agent and why is it needed?

IP ServicesEasy
Save to ▾
Show answer
DHCP Discover is a broadcast, and routers do not forward broadcasts, so a central DHCP server cannot hear clients on other subnets. A relay agent, configured with ip helper-address on the gateway interface, converts the broadcast into a unicast to the server and adds the gateway IP so the server picks the right scope. This lets one server serve many VLANs.
39

What are the default STP path costs for common link speeds?

STP and EtherChannelMedium
Save to ▾
Show answer
With short (802.1D revised) costs: 10 Mbps is 100, 100 Mbps is 19, 1 Gbps is 4 and 10 Gbps is 2. With the long pathcost method, 1 Gbps is 20000 and 10 Gbps is 2000, which distinguishes higher speeds. Root path cost is the sum of costs on ports toward the root, and the lowest total wins when choosing root ports.
40

What are the seven layers of the OSI model?

Network FundamentalsEasy
Save to ▾
Show answer
From bottom to top: Physical, Data Link, Network, Transport, Session, Presentation and Application. Each layer serves the one above it. For example, Ethernet frames work at Layer 2, IP packets at Layer 3 and TCP segments at Layer 4. Engineers use the model to troubleshoot bottom-up: check cables and link lights first, then MAC learning, then IP reachability.
41

What is the difference between standard and extended ACLs?

Network SecurityEasy
Save to ▾
Show answer
Standard ACLs (1 to 99 and 1300 to 1999) match only the source IP, so they should be placed close to the destination. Extended ACLs (100 to 199 and 2000 to 2699) match protocol, source, destination and ports, so they can be placed close to the source to drop unwanted traffic early. Named ACLs work for both and allow editing individual lines by sequence number.
42

How many usable hosts are in a /26 subnet and what is the block size?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
A /26 leaves 6 host bits, so 2 to the power 6 is 64 addresses and 62 usable hosts after removing network and broadcast. The mask is 255.255.255.192 and the block size is 256 minus 192, which is 64. So subnets of 192.168.1.0/26 start at .0, .64, .128 and .192. For 192.168.1.70/26 the network is .64 and broadcast .127.
43

What is a collision domain and a broadcast domain?

Network FundamentalsMedium
Save to ▾
Show answer
A collision domain is a segment where two devices sending at the same time can collide; every switch port is its own collision domain, and with full duplex collisions do not occur. A broadcast domain is the set of devices that receive a Layer 2 broadcast. Routers and VLANs separate broadcast domains, so one VLAN equals one broadcast domain.
44

What are the main 802.11 Wi-Fi standards?

Wireless and AutomationEasy
Save to ▾
Show answer
802.11n (Wi-Fi 4) works on 2.4 and 5 GHz with MIMO. 802.11ac (Wi-Fi 5) is 5 GHz only with wider channels and MU-MIMO downlink. 802.11ax (Wi-Fi 6 and 6E) adds OFDMA, BSS colouring and target wake time, and 6E adds the 6 GHz band. 802.11be (Wi-Fi 7) adds 320 MHz channels and multi-link operation. India opened part of the 6 GHz band for indoor use.
45

What is SLAAC and how is it different from DHCPv6?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
With SLAAC a host learns the /64 prefix from a router advertisement and builds its own interface ID, without a server. Stateless DHCPv6 adds extra options such as DNS while the address still comes from SLAAC. Stateful DHCPv6 assigns the address itself and keeps bindings, similar to DHCPv4. RA flags M (managed) and O (other config) tell hosts which method to use.
46

What is 802.1Q tagging?

Switching and VLANsEasy
Save to ▾
Show answer
802.1Q inserts a 4-byte tag after the source MAC in the Ethernet frame. The tag holds a 12-bit VLAN ID (1 to 4094 usable), 3 priority bits used by CoS for QoS, and a DEI bit. The tag is added when a frame leaves a trunk and removed at an access port. Older ISL encapsulation is obsolete; modern switches support only 802.1Q.
47

What is inter-VLAN routing and what are the ways to do it?

Switching and VLANsEasy
Save to ▾
Show answer
Hosts in different VLANs need a Layer 3 device to communicate. Options are: a router with one physical interface per VLAN (legacy), router-on-a-stick using one trunk with subinterfaces, or a Layer 3 switch with switched virtual interfaces (SVIs). SVIs are the most common in campuses because routing happens in hardware at line rate, with no single trunk bottleneck.
48

How is the root bridge elected?

STP and EtherChannelEasy
Save to ▾
Show answer
Switches exchange BPDUs and the one with the lowest bridge ID becomes root. The bridge ID is the priority (default 32768 plus the VLAN number in PVST) followed by the MAC address, so if priorities tie, the lowest MAC wins. Because the oldest switch often has the lowest MAC, you should set priority manually, for example spanning-tree vlan 10 root primary on the core.
49

Compare Ansible, Puppet and Chef for network automation.

Wireless and AutomationMedium
Save to ▾
Show answer
Ansible is agentless, uses SSH or APIs, writes playbooks in YAML and uses a push model, so it is the most popular for network devices. Puppet uses an agent, a declarative manifest language and a pull model. Chef uses Ruby-based recipes with an agent and pull model. Puppet and Chef are more common for servers. All support idempotent configuration management.
50

How does a switch learn and forward frames?

Network FundamentalsMedium
Save to ▾
Show answer
A switch reads the source MAC of each incoming frame and records it with the port in the MAC address table. For forwarding it looks up the destination MAC: a known unicast goes out one port, while unknown unicast, broadcast and most multicast frames are flooded in the VLAN. Entries age out after 300 seconds by default. Check with show mac address-table.

Frequently asked questions

What happens in the CCNA rapid-fire round?

Rapid-fire questions are quick definitions and one-line answers that interviewers fire at the start or end of a round to check your CCNA basics. Aim to answer each in under 20 seconds.

How do I clear the rapid-fire round?

Answer in one or two sentences, then stop. If you don't know, say so quickly and move on; don't guess at length. Revise these the morning of the interview.

Which round comes next?

A typical order is online assessment, telephonic screening, one or two technical rounds, a managerial round and HR. Use the other round pages to practise each stage.

Practise every interview round

Online Assessment questionsTelephonic Interview questionsTechnical Round questionsManagerial Round questionsHR & behavioural questionsFull mock interview

More ways to practise

Company-wise CCNA questionsExperience-wise CCNA questionsRole-wise CCNA questionsCity-wise CCNA questionsMost asked CCNA questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCCNA mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCCNA topic sheets