Top 100 CCNA Interview Questions for Network Engineers (2026)

Physical sends bits. Data Link uses frames and MAC addresses. Network uses IP packets and routing. Transport uses TCP or UDP ports. Session manages sessions. Presentation handles format, encryption, and compression. Application is where protocols like HTTP, DNS, and FTP live.

TCP is reliable and connection-based. It uses a handshake, acknowledgments, retransmission, and ordered delivery. UDP is faster and connectionless. It is used when speed matters more than retransmitting old data, such as voice, video, DNS, and gaming.

The client sends SYN. The server replies SYN-ACK. The client sends ACK. After this, both sides agree on sequence numbers and the TCP session is ready.

The device checks DNS cache, resolves the domain to an IP, uses ARP for the local next-hop MAC, builds a TCP connection, performs TLS for HTTPS, sends an HTTP request, and receives the web page from the server.

ARP maps an IPv4 address to a MAC address on the same LAN. A host broadcasts “Who has this IP?” and the owner replies with its MAC. Routers do not forward ARP broadcasts.

show arp
clear arp-cache

A collision domain is where devices can collide while transmitting. Each switch port is its own collision domain. A broadcast domain is where Layer 2 broadcasts are received. VLANs and routers separate broadcast domains.

A hub repeats bits to all ports. A switch forwards frames using MAC addresses. A router forwards packets between networks using IP addresses and a routing table.

Each layer adds its header as data moves down the stack: segment, packet, frame, and bits. The receiver removes those headers in reverse order.

A MAC address is a 48-bit hardware address written in hexadecimal. The first half identifies the vendor OUI and the second half identifies the interface. Broadcast MAC is FF:FF:FF:FF:FF:FF.

Half-duplex sends or receives, but not both at the same time. Full-duplex sends and receives at the same time. Modern switched Ethernet is full-duplex; duplex mismatches cause errors and poor performance.

Class A is /8, Class B is /16, Class C is /24, Class D is multicast, and Class E is reserved. Today networks use CIDR, but classes are still asked in interviews. Private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

You need 5 host bits because 2^5 - 2 = 30. That gives a /27 mask, 255.255.255.224. A /24 becomes eight /27 subnets, each with 30 usable hosts and block size 32.

VLSM lets you use different subnet masks inside the same network. It saves IP addresses because each subnet gets the size it actually needs.

CIDR uses prefix notation like /24 and allows any prefix length. Classful addressing forced networks into A, B, or C sizes. CIDR saves addresses and supports route summarization.

/20 is 255.255.240.0. The block size in the third octet is 16. The 45 falls in the 32-47 block. Network is 172.16.32.0, broadcast is 172.16.47.255, usable range is 172.16.32.1 to 172.16.47.254.

Route summarization combines many routes into one larger route. Use it at routing boundaries when addresses are contiguous. It makes routing tables smaller and convergence cleaner.

A loopback is a logical interface that stays up while the router is running. It is used for router IDs, management, BGP peering, and stable reachability.

Unicast is one-to-one. Broadcast is one-to-all in the subnet. Multicast is one-to-a-group, using addresses from 224.0.0.0/4 in IPv4.

A /30 has four total addresses and two usable hosts. It is commonly used for point-to-point router links. /31 is also used on modern point-to-point links.

The subnet mask tells the device which part of the IP is network and which part is host. It helps a device decide whether to ARP locally or send traffic to a gateway.

A VLAN creates a separate Layer 2 broadcast domain on the same switch. VLANs improve segmentation, reduce broadcasts, and separate users or services without needing separate physical switches.

802.1Q adds a VLAN tag to frames on trunk links so multiple VLANs can cross one physical link. The native VLAN crosses untagged.

interface Gi0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 99

A switch reads the source MAC of incoming frames and maps that MAC to the incoming port. If the destination MAC is unknown, it floods the frame out other ports in the VLAN.

STP prevents Layer 2 loops by blocking redundant paths. Without STP, broadcasts can loop forever and bring down the network.

The switch with the lowest bridge ID wins. Bridge ID includes priority and MAC address. Lower priority is preferred; if tied, lower MAC wins.

PortFast moves an access port to forwarding immediately. Use it only on end-device ports. Pair it with BPDU Guard to protect against accidental switch connections.

spanning-tree portfast
spanning-tree bpduguard enable

EtherChannel bundles multiple physical links into one logical link. LACP is the open standard. PAgP is Cisco proprietary. Member links must match speed, duplex, VLAN, and trunk settings.

The switch creates an SVI for each VLAN and enables IP routing. Each SVI acts as the gateway for that VLAN, and routing happens in hardware.

DTP negotiates trunks automatically between Cisco switches. Best practice is to hardcode access or trunk mode and disable negotiation on user-facing ports.

DHCP Snooping allows DHCP server messages only from trusted ports. It blocks rogue DHCP servers and builds a binding table used by Dynamic ARP Inspection and IP Source Guard.

Administrative distance tells how trusted a route source is. Lower is better. Connected is 0, static is 1, EIGRP internal is 90, OSPF is 110, RIP is 120, and iBGP is 200.

Distance-vector protocols learn from neighbors. Link-state protocols build a topology database and calculate best paths. Link-state protocols usually scale and converge better.

On broadcast networks, OSPF elects a DR and BDR to reduce adjacencies. Highest priority wins. If tied, highest router ID wins. Priority 0 means the router cannot become DR or BDR.

OSPF cost is reference bandwidth divided by interface bandwidth. The default reference can make Fast Ethernet and Gigabit both cost 1, so many networks change the reference bandwidth.

Common states are Down, Init, 2-Way, Exstart, Exchange, Loading, and Full. Full means the OSPF database is synchronized.

The successor is the best route. The feasible successor is a loop-free backup route that can be used immediately if the successor fails.

A floating static route has a higher administrative distance than the main route. It stays inactive until the primary route disappears.

The routing table stores best routes. The router uses longest prefix match first, then administrative distance, then metric if needed.

BGP is the internet routing protocol between autonomous systems. CCNA engineers may see it on ISP edge, multi-homed internet, data center, or SD-WAN networks.

show ip route
show ip route ospf
show ip ospf neighbor
show ip ospf interface brief
show ip eigrp topology

DORA means Discover, Offer, Request, Acknowledge. The client asks for an IP, the server offers one, the client requests it, and the server confirms the lease.

A relay forwards DHCP requests from one subnet to a DHCP server on another subnet. On Cisco, configure ip helper-address on the gateway interface.

The client asks a recursive resolver. If not cached, the resolver queries root, TLD, and authoritative servers, then returns the final record to the client.

Static NAT maps one private IP to one public IP. Dynamic NAT maps private IPs to a public pool. PAT or NAT overload lets many inside hosts share one public IP using ports.

An NTP client receives time. An NTP server provides time. A device can sync from an upstream server and also serve time to downstream devices.

HTTP 80 TCP, HTTPS 443 TCP, SSH 22 TCP, DNS 53 UDP/TCP, DHCP 67/68 UDP, SNMP 161/162 UDP, SMTP 25 TCP, FTP 20/21 TCP.

SNMP monitors network devices. v1 and v2c use plain community strings. SNMPv3 supports authentication and encryption and is the preferred production version.

Syslog sends device logs to a central server. Cisco severity levels go from 0 emergency to 7 debugging.

logging host 192.168.1.100
logging trap informational
service timestamps log datetime msec

FTP uses port 21 for control and port 20 or dynamic ports for data. Active mode can break through firewalls because the server connects back to the client. Passive mode is usually firewall-friendlier.

QoS controls traffic priority. Best effort treats all traffic equally. IntServ reserves resources per flow. DiffServ marks traffic with DSCP and is the common enterprise model.

A leased line is dedicated private bandwidth. MPLS is a provider-managed private WAN. Broadband is cheaper shared internet, often used with SD-WAN.

GRE creates a virtual tunnel over IP and can carry multicast. It is often combined with IPsec when routing protocols need to run across encrypted WAN links.

IPsec secures IP traffic. AH provides authentication without encryption. ESP provides encryption and integrity and is the common real-world choice.

Transport mode protects only the payload. Tunnel mode protects the entire original IP packet inside a new packet and is used for site-to-site VPNs.

PPPoE runs PPP over Ethernet and is common on DSL links. It uses authentication and lowers usable MTU to 1492 because of overhead.

SD-WAN uses central policy and live link quality to choose paths per application. Traditional WAN usually uses static routing decisions and manual configuration.

DMVPN lets spoke sites build direct VPN tunnels to each other when needed, instead of sending all traffic through the hub. It uses NHRP, GRE, and IPsec.

Site-to-site VPN connects two networks through gateways. Remote access VPN connects one user device to the company network through a client or browser.

MTU is the largest packet a link can carry. Tunnels add headers, so large packets may need fragmentation. MSS clamping helps avoid black-hole issues.

HSRP lets two routers share a virtual gateway IP and MAC. One is active and one is standby. If active fails, standby takes over.

802.11b/g use 2.4 GHz with lower speed. 802.11n adds MIMO and 2.4/5 GHz. 802.11ac improves 5 GHz performance. 802.11ax, Wi-Fi 6/6E, adds OFDMA, BSS coloring, and 6 GHz support.

CSMA/CD detects collisions on half-duplex Ethernet. CSMA/CA avoids collisions in wireless by listening first and using random backoff.

2.4 GHz has better range but more interference and fewer clean channels. 5 GHz has more channels and higher speed but shorter range.

WEP and WPA/TKIP are weak. WPA2 with AES is common. WPA3 is stronger. Enterprises should use WPA2/WPA3 Enterprise with 802.1X where possible.

An autonomous AP is managed individually. A controller-based AP is managed by a WLC using CAPWAP, which simplifies RF, roaming, policy, and firmware operations.

SSID is the wireless network name. BSS is one AP radio and its clients. BSSID is the MAC address for that specific AP radio/SSID instance.

802.1X uses a supplicant, AP, and RADIUS server to authenticate users individually. Common EAP methods include EAP-TLS and PEAP.

Interference comes from overlapping channels, nearby APs, microwaves, Bluetooth, and poor power planning. Use proper channel design, site surveys, and 5 GHz/6 GHz where suitable.

A site survey checks coverage, interference, signal strength, and AP placement. It is important for new deployments, high-density areas, and troubleshooting.

With central switching, client traffic tunnels to the WLC. With FlexConnect/local switching, traffic exits locally at the branch AP, which saves WAN bandwidth.

A standard ACL filters mainly by source IP. An extended ACL filters by source, destination, protocol, and ports. Every ACL ends with an implicit deny.

A firewall permits or denies sessions based on policy and state. An IPS inspects traffic for attacks and blocks malicious traffic inline.

AAA means Authentication, Authorization, and Accounting: who you are, what you can do, and what you did.

RADIUS is commonly used for user network access and uses UDP. TACACS+ is common for device administration, uses TCP 49, and supports command authorization.

MAC flooding is stopped with port security. VLAN hopping is reduced by disabling DTP and changing the native VLAN. ARP spoofing is reduced with DHCP Snooping and Dynamic ARP Inspection.

Use SSH, AAA, strong enable secret, SNMPv3, disabled unused ports, DHCP Snooping, DAI, BPDU Guard, PortFast on access ports, and proper management VLANs.

Port security limits allowed MAC addresses. Shutdown disables the port, restrict drops and logs, protect drops silently.

Confidentiality protects data from unauthorized access. Integrity protects data from tampering. Availability keeps systems usable when needed.

Symmetric encryption uses one shared key and is fast. Asymmetric encryption uses public/private keys and is slower but solves secure key exchange and digital signatures.

A VPN creates an encrypted tunnel. It needs encryption, integrity checking, peer authentication, key exchange, and anti-replay protection.

You can troubleshoot bottom-up, top-down, or divide-and-conquer. In interviews, explain where you start based on symptoms, then move layer by layer.

It shows physical and protocol state, errors, drops, bandwidth, duplex, reliability, and counters. CRC errors often point to physical or duplex problems.

Ping tests IP reachability with ICMP. Traceroute shows the path and where packets may stop by using TTL expiry responses.

It gives a fast view of interface names, IP addresses, physical status, and line protocol status.

Check DNS, then ping an internet IP, verify default route, NAT, ACLs, WAN interface, and whether the router itself can reach the internet.

Use ARP to find the MAC, then use the MAC address table to find the switch port. Follow uplinks switch by switch if needed.

CDP shows directly connected Cisco devices, including hostname, platform, IP, and ports. Disable it on untrusted links.

If changes are unsaved, reload to return to startup-config. If saved or locked out, use console access, backups, or password recovery depending on the problem.

Running-config is active in RAM. Startup-config is saved in NVRAM and loads after reload. Save changes with copy running-config startup-config.

show ip interface brief
show interfaces status
show ip route
show vlan brief
show interfaces trunk
show mac address-table
show ip ospf neighbor
show ip nat translations
show arp
show cdp neighbors detail

IPv6 was created because IPv4 addresses were running out. IPv6 uses 128-bit addresses, written in hexadecimal groups.

Global unicast is internet-routable. Link-local starts with FE80 and stays on the local link. Unique local is private. Multicast starts with FF. Loopback is ::1.

SLAAC lets a host build its own IPv6 address using router advertisements and a local interface ID. IPv6 uses NDP instead of ARP.

SDN separates control from forwarding and uses a controller to manage policy centrally. Traditional networking configures each device more independently.

Northbound APIs connect applications to the controller. Southbound APIs connect the controller to network devices.

A REST API uses HTTP methods like GET, POST, PUT, PATCH, and DELETE. Network tools use REST APIs to read state and push changes without CLI scraping.

NETCONF commonly uses SSH and XML with strong configuration operations. RESTCONF exposes YANG data through HTTPS and is easier for beginners using JSON.

Ansible uses YAML playbooks to automate devices over SSH or APIs. It is agentless and useful for repeatable network configuration and checks.

JSON is lightweight and common in REST APIs. XML is more verbose and common in NETCONF. Both describe structured data.

Good next steps include CCNP Enterprise, CCNP Security, CCNP Data Center, cloud networking, Python basics, Ansible, Terraform, GNS3, Cisco CML, and real lab practice.