Skip to content
CCNA
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

CCNA Technical Round Questions & Answers

40 questions for the technical round stage — 1 easy, 29 medium, 10 hard.

About the technical round round

The technical round is the core of a CCNA interview: concept questions with follow-ups, a live hands-on task and a deep dive into one of your projects. Interviewers check depth, not just definitions.

Tips for the technical round round

  • Say your approach out loud before you start writing.
  • After a correct answer, expect 'why?' and 'what if?' follow-ups; go one level deeper than the question.
  • Pick one project you can explain end to end, including what you would do differently.
  • If you get stuck, explain what you would try next instead of going silent.
Solved — technical roundStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

How do you configure IPv4 and IPv6 on a router interface?

IP Addressing and SubnettingEasy
Save to ▾
Show answer
Enable IPv6 routing globally, then add both addresses to the interface. ipv6 unicast-routing interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ipv6 address 2001:db8:1:1::1/64 ipv6 address fe80::1 link-local no shutdown Verify with show ip interface brief and show ipv6 interface brief.
02

How do you quickly calculate how many subnets and hosts a mask gives?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Use two formulas and memorise the mask octets. Subnets = 2^(borrowed bits) Hosts = 2^(host bits) - 2 Example: 10.0.0.0/8 to /20 -> 2^12 = 4096 subnets, 2^12 - 2 = 4094 hosts Mask octets: 128 192 224 240 248 252 254 255 Block size = 256 - mask octet
03

How do you configure an 802.1Q trunk securely?

Switching and VLANsMedium
Save to ▾
Show answer
Hard-code the trunk, disable negotiation, change the native VLAN and prune VLANs. interface GigabitEthernet1/0/48 switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate switchport trunk native vlan 999 switchport trunk allowed vlan 10,20,30,99 show interfaces trunk
04

What is the MAC address table and what happens when it is full?

Switching and VLANsHard
Save to ▾
Show answer
The MAC address table, stored in CAM, maps MAC addresses to ports and VLANs. When it fills, as in a MAC flooding attack, new addresses cannot be learned and the switch floods unknown unicast frames out of all ports in the VLAN, which lets an attacker sniff traffic. Port security limiting MACs per port prevents this.
05

What is an underlay and an overlay network?

Wireless and AutomationHard
Save to ▾
Show answer
The underlay is the physical IP network of switches and routers that provides basic reachability, for example OSPF or IS-IS on routed links. The overlay is a virtual network built on top using tunnels such as VXLAN, so logical segments can stretch across the fabric independent of physical topology. SD-Access and SD-WAN use this model, with a fabric controlling the overlay.
06

Explain root port, designated port and blocked port.

STP and EtherChannelMedium
Save to ▾
Show answer
Every non-root switch picks one root port, its best path to the root based on lowest root path cost, then lowest sender bridge ID, then lowest sender port ID. On each segment, the switch with the best path becomes the designated port and forwards. Every remaining port becomes non-designated and blocks. All ports on the root bridge are designated.
07

Find the network, broadcast and usable range for 172.16.45.200/21.

IP Addressing and SubnettingMedium
Save to ▾
Show answer
A /21 mask is 255.255.248.0, so the interesting octet is the third with block size 8. 45 falls in the block starting at 40 (40 to 47). Network: 172.16.40.0 Broadcast: 172.16.47.255 Usable: 172.16.40.1 - 172.16.47.254 Hosts: 2^11 - 2 = 2046
08

What is CAPWAP?

Wireless and AutomationMedium
Save to ▾
Show answer
Control and Provisioning of Wireless Access Points is the protocol between lightweight APs and the WLC. It builds two tunnels: a control tunnel on UDP 5246, encrypted with DTLS, and a data tunnel on UDP 5247 that carries client traffic in central switching mode. In FlexConnect or local switching mode, client data is switched locally at the AP instead of being tunnelled.
09

Users report short outages every few minutes and logs show topology changes. How do you troubleshoot?

STP and EtherChannelHard
Save to ▾
Show answer
Frequent TCNs flush MAC tables and cause flooding. I run show spanning-tree detail to find the port and switch originating topology changes, then follow it hop by hop. Common causes are a flapping link, a host port without PortFast that changes state each time a PC reboots, or a failing NIC. I fix the link and enable PortFast on edge ports so they do not generate TCNs.
10

A server team says an ACL you applied blocked all traffic, including allowed services. What happened?

Network SecurityMedium
Save to ▾
Show answer
Most likely the ACL lacks a permit for normal traffic, so the implicit deny dropped everything, or the order put a broad deny above the specific permits. It may also be applied in the wrong direction or on the wrong interface. I check show access-lists for hit counts, fix the sequence by inserting lines, and add a final permit or the needed entries. I always test ACLs with a rollback timer.
11

How do you restrict SSH access to devices from only the management subnet?

Network SecurityMedium
Save to ▾
Show answer
Use a standard ACL on the VTY lines. ip access-list standard MGMT-ONLY permit 10.99.0.0 0.0.0.255 deny any log line vty 0 15 access-class MGMT-ONLY in transport input ssh exec-timeout 10 0 login block-for 120 attempts 3 within 60
12

Which commands would you use to test end-to-end reachability and find where packets stop?

Network FundamentalsMedium
Save to ▾
Show answer
ping tests reachability and round-trip time, and traceroute shows each Layer 3 hop. R1# ping 10.2.2.2 source Loopback0 R1# traceroute 10.2.2.2 PC> tracert 10.2.2.2 An extended ping lets you set source, size and the DF bit to test MTU. Where traceroute shows asterisks, that hop is dropping or filtering ICMP.
13

How do you write a simple Python script to fetch interface data from a device?

Wireless and AutomationMedium
Save to ▾
Show answer
Netmiko handles SSH sessions; keep credentials in a file or vault, not the script. import yaml from netmiko import ConnectHandler # r1.yml holds device_type, host, username, password with open('r1.yml') as f: device = yaml.safe_load(f) with ConnectHandler(**device) as conn: output = conn.send_command('show ip interface brief') print(output)
14

Compare WPA2 and WPA3 security.

Wireless and AutomationMedium
Save to ▾
Show answer
WPA2 uses AES-CCMP; WPA2-Personal uses a pre-shared key that is vulnerable to offline dictionary attacks, and WPA2-Enterprise uses 802.1X with RADIUS. WPA3-Personal replaces PSK with SAE, which resists offline guessing and gives forward secrecy. WPA3-Enterprise offers a 192-bit mode. WPA3 requires protected management frames. Open networks can use OWE for encryption without passwords.
15

How does DHCP snooping protect the network?

Network SecurityMedium
Save to ▾
Show answer
DHCP snooping classifies ports as trusted (uplinks toward real DHCP servers) or untrusted (user ports). Server messages such as Offer and Ack arriving on untrusted ports are dropped, which stops rogue DHCP servers. It also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard use. Rate limits on untrusted ports prevent DHCP starvation.
16

You have 192.168.10.0/24 and need subnets for 100, 50, 20 hosts and two point-to-point links. Design it with VLSM.

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Allocate largest first so blocks align. 100 hosts -> /25: 192.168.10.0/25 (.1 - .126) 50 hosts -> /26: 192.168.10.128/26 (.129 - .190) 20 hosts -> /27: 192.168.10.192/27 (.193 - .222) Link 1 -> /30: 192.168.10.224/30 Link 2 -> /30: 192.168.10.228/30 Free for growth: 192.168.10.232 - .255
17

Your manager wants to stop configuring 200 switches manually. What would you propose?

Wireless and AutomationHard
Save to ▾
Show answer
I would start with a source of truth for devices and variables, then use Ansible playbooks with Jinja2 templates to generate and push standard configs over SSH, keeping them in Git with peer review. A controller such as Catalyst Center could handle day-0 provisioning and compliance. I would start with read-only tasks like backups and audits, then move to small, tested change automation.
18

An SVI shows status down/down even though it is configured. What could be wrong?

Switching and VLANsHard
Save to ▾
Show answer
An SVI comes up only if the VLAN exists in the VLAN database and at least one access or trunk port in that VLAN is up and forwarding, and the SVI is not shut down. So I check show vlan brief for the VLAN, check that at least one port in it is connected, check trunks allow it, and run no shutdown on the SVI. On Layer 3 switches, ip routing must be enabled for routing.
19

How do you configure router-on-a-stick?

Switching and VLANsMedium
Save to ▾
Show answer
Use one trunk link and a subinterface per VLAN with 802.1Q encapsulation. interface GigabitEthernet0/0 no shutdown interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 interface GigabitEthernet0/0.20 encapsulation dot1Q 20 ip address 192.168.20.1 255.255.255.0 The switch port facing the router must be a trunk.
20

What is SLAAC and how is it different from DHCPv6?

IP Addressing and SubnettingMedium
Save to ▾
Show answer
With SLAAC a host learns the /64 prefix from a router advertisement and builds its own interface ID, without a server. Stateless DHCPv6 adds extra options such as DNS while the address still comes from SLAAC. Stateful DHCPv6 assigns the address itself and keeps bindings, similar to DHCPv4. RA flags M (managed) and O (other config) tell hosts which method to use.
21

Why does OSPF use areas and what is area 0?

Routing and OSPFMedium
Save to ▾
Show answer
Areas limit how far detailed LSAs flood, so SPF runs on a smaller database and changes in one area do not force recalculation everywhere. Area 0 is the backbone and every other area must connect to it, directly or through a virtual link. Routers connecting areas are ABRs and can summarize routes between areas. Single-area OSPF is the focus of CCNA.
22

How do you use CDP and LLDP to discover neighbours?

Network FundamentalsMedium
Save to ▾
Show answer
CDP is a proprietary Layer 2 discovery protocol enabled by default on IOS; LLDP is the open IEEE 802.1AB standard. show cdp neighbors show cdp neighbors detail configure terminal lldp run show lldp neighbors detail Detail output shows the neighbour's IP, platform and port. Disable CDP on internet-facing ports with no cdp enable.
23

How does a switch learn and forward frames?

Network FundamentalsMedium
Save to ▾
Show answer
A switch reads the source MAC of each incoming frame and records it with the port in the MAC address table. For forwarding it looks up the destination MAC: a known unicast goes out one port, while unknown unicast, broadcast and most multicast frames are flooded in the VLAN. Entries age out after 300 seconds by default. Check with show mac address-table.
24

What must match for an EtherChannel to form?

STP and EtherChannelMedium
Save to ▾
Show answer
Member interfaces must have the same speed and duplex, the same mode (access or trunk), the same access VLAN or the same native and allowed VLAN list on trunks, and compatible negotiation modes. Mismatched settings put members into suspended state. Configure settings on the port-channel interface so they are pushed to members, and verify with show etherchannel summary.
25

What is the difference between autonomous APs, controller-based APs and cloud-managed APs?

Wireless and AutomationMedium
Save to ▾
Show answer
Autonomous APs are configured one by one and suit very small sites. Lightweight APs are managed by a Wireless LAN Controller using CAPWAP tunnels, which centralises configuration, RF management and roaming, and suits campuses. Cloud-managed APs are configured from a cloud dashboard, ideal for many branches. Split-MAC means real-time functions stay on the AP while management sits on the controller.
26

What are the basic steps to configure a WLAN with WPA2 or WPA3 on a controller GUI?

Wireless and AutomationMedium
Save to ▾
Show answer
Steps on a typical WLC GUI: create a dynamic interface with VLAN, IP and DHCP server; go to WLANs and create a new WLAN with profile name and SSID; map it to the dynamic interface; under Security choose WPA2 or WPA3 with PSK or 802.1X and add the RADIUS server for enterprise; set QoS profile; enable the WLAN and apply it to AP groups.
27

Your company is adding a new branch with 40 users. What network components would you propose?

Network FundamentalsMedium
Save to ▾
Show answer
A branch router or SD-WAN edge for the WAN link and internet, one or two 48-port PoE access switches for PCs, phones and access points, and wireless access points managed by a controller or the cloud. I would add a firewall function, DHCP and DNS settings, VLANs for data, voice, guest and management, and a backup 4G or broadband link for resilience.
28

Explain the main IPv6 address types.

IP Addressing and SubnettingMedium
Save to ▾
Show answer
Global unicast (2000::/3) is publicly routable. Unique local (fc00::/7, in practice fd00::/8) is like private IPv4. Link-local (fe80::/10) is auto-created on every IPv6 interface and used for neighbour discovery and routing next hops. Multicast is ff00::/8, for example ff02::1 all nodes and ff02::2 all routers. Anycast is a unicast address shared by several devices. IPv6 has no broadcast.
29

What is AAA and the difference between TACACS+ and RADIUS?

Network SecurityMedium
Save to ▾
Show answer
AAA stands for Authentication (who you are), Authorization (what you can do) and Accounting (what you did). TACACS+ uses TCP 49, encrypts the whole payload and separates authentication from authorization, so it is preferred for device administration with per-command control. RADIUS uses UDP 1812 and 1813, encrypts only the password and is used for network access such as 802.1X and VPN.
30

How would you redesign a flat network where 600 users sit in VLAN 1?

Switching and VLANsHard
Save to ▾
Show answer
I would split users into VLANs by function or floor, each with a /24 or smaller, put voice, wireless, printers, servers and management in their own VLANs, and route between them on a Layer 3 core with SVIs. DHCP scopes and helper addresses would be added per VLAN. I would migrate in phases with a rollback plan and move VLAN 1 out of use for both users and the native VLAN.
31

How would you plan an IP addressing scheme for a company with 10 branches?

IP Addressing and SubnettingHard
Save to ▾
Show answer
I would reserve a large block, for example 10.0.0.0/16, and give each branch a summarizable /20 such as 10.0.16.0/20, 10.0.32.0/20 and so on. Inside each, assign fixed ranges per role: users, voice, wireless, servers, management and WAN links. This lets each branch be summarized as one route, keeps firewall rules simple, and leaves room to grow. I keep it in an IPAM tool.
32

What is SNMP and the differences between v2c and v3?

IP ServicesMedium
Save to ▾
Show answer
SNMP lets a manager poll devices for counters and receive traps or informs about events, using a MIB with OIDs. Polling uses UDP 161 and traps UDP 162. SNMPv2c uses a plain-text community string with no encryption. SNMPv3 adds user-based authentication and encryption with authPriv mode, so it is the version to use in production, especially on networks reachable from many teams.
33

A broadcast storm brought the network down after someone connected a cable between two wall ports. How do you prevent this?

STP and EtherChannelMedium
Save to ▾
Show answer
Two wall ports patched to the same switch formed a loop. To stop it now, I find the port with rising broadcast counters and shut it. To prevent repeats, enable PortFast with BPDU Guard on all access ports, keep Rapid PVST+ running everywhere, add storm-control broadcast thresholds on access ports and enable errdisable recovery with a sensible interval.
34

What is Dynamic ARP Inspection?

Network SecurityHard
Save to ▾
Show answer
DAI checks ARP packets on untrusted ports against the DHCP snooping binding table and drops ARP replies whose IP-to-MAC mapping does not match. This stops ARP spoofing and man-in-the-middle attacks where an attacker claims to be the default gateway. Static hosts need ARP ACLs. It requires DHCP snooping enabled in the same VLAN and trusted uplink ports.
35

Auditors find that network devices use shared admin passwords and Telnet. What is your remediation plan?

Network SecurityHard
Save to ▾
Show answer
Disable Telnet with transport input ssh, enable SSH v2, and move admin login to AAA with TACACS+ so each engineer has a personal account with command authorisation and accounting logs. Keep one local fallback account in a password vault. Restrict VTY access with an ACL to the management subnet. Roll out with automation, test on a pilot, then document it for the audit.
36

An automation job pushed a wrong configuration to 50 switches and broke their uplinks. How do you recover and stop it happening again?

Wireless and AutomationHard
Save to ▾
Show answer
First stop the job, then recover through out-of-band console or a management network, using configuration archive rollback or a saved backup. In future, run changes with commit confirmed or reload in as a safety timer, test in a lab, use a dry run or check mode, deploy to one canary switch, then in small batches with automatic post-checks. Store templates in Git with peer review so every change is visible and reversible.
37

What is DTP and why should you disable it?

Switching and VLANsMedium
Save to ▾
Show answer
Dynamic Trunking Protocol negotiates whether a link becomes a trunk. Modes are dynamic auto, dynamic desirable, trunk and access. Auto plus auto stays access, while desirable with auto or desirable forms a trunk. Attackers can use DTP to form a trunk and reach all VLANs, so best practice is to hard-code access or trunk and use switchport nonegotiate on trunks.
38

What are the first hop redundancy protocols and how does HSRP work?

Routing and OSPFMedium
Save to ▾
Show answer
FHRPs give hosts a virtual gateway IP shared by two or more routers. HSRP is proprietary: routers elect an active router by highest priority (default 100), and the standby takes over the virtual IP and MAC if hellos stop. Preempt lets a higher priority router reclaim the role. VRRP is the open standard, and GLBP adds load sharing across several routers.
39

A Python script gets 401 errors when calling a controller REST API. What do you check?

Wireless and AutomationMedium
Save to ▾
Show answer
401 Unauthorized means authentication failed. I check the username and password or API key, whether a token must first be requested from an auth endpoint and sent in a header like X-Auth-Token, whether the token expired, and the exact header name and format. I test the same call with curl or an API client to separate script bugs from credential issues.
40

Compare single-mode and multimode fiber.

Network FundamentalsMedium
Save to ▾
Show answer
Single-mode fiber has a small core (about 9 microns) and uses a laser, so it carries light over long distances, often 10 km or more. Multimode fiber has a larger core (50 or 62.5 microns), uses cheaper LED or VCSEL optics and suits shorter runs inside a building or data center, usually up to a few hundred metres at 10 Gbps. SFP modules must match the fiber type.

Frequently asked questions

What happens in the CCNA technical round round?

The technical round is the core of a CCNA interview: concept questions with follow-ups, a live hands-on task and a deep dive into one of your projects. Interviewers check depth, not just definitions.

How do I clear the technical round round?

Say your approach out loud before you start writing. After a correct answer, expect 'why?' and 'what if?' follow-ups; go one level deeper than the question. Pick one project you can explain end to end, including what you would do differently.

Which round comes next?

A typical order is online assessment, telephonic screening, one or two technical rounds, a managerial round and HR. Use the other round pages to practise each stage.

Practise every interview round

Online Assessment questionsTelephonic Interview questionsManagerial Round questionsRapid-Fire questionsHR & behavioural questionsFull mock interview

More ways to practise

Company-wise CCNA questionsExperience-wise CCNA questionsRole-wise CCNA questionsCity-wise CCNA questionsMost asked CCNA questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCCNA mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCCNA topic sheets