Top 50 CCNA Interview Questions and Answers (2026 Update)

If you are preparing for a networking job or the CCNA 200-301 exam, these are the questions interviewers keep asking. This list of 50 CCNA interview questions and answers is grouped by topic, with short answers you can say out loud in an interview. It replaces our shorter top 15 CCNA interview questions post.

How to use these CCNA interview questions

Do not memorise word for word. Read the answer, then explain it in your own words and, where you can, draw it on paper. Interviewers for network engineer roles care more about how you reason than about perfect definitions. If you want structured practice, our CCNA 200-301 course includes live labs for every topic below.

Networking fundamentals

1. What is the OSI model?
A seven-layer reference model that describes how data moves across a network: physical, data link, network, transport, session, presentation and application. It gives engineers a common language for troubleshooting.

2. What is the difference between the OSI and TCP/IP models?
OSI is a seven-layer reference model. TCP/IP is the practical four-layer model the internet runs on: link, internet, transport and application.

3. What is the difference between TCP and UDP?
TCP is connection-oriented and reliable: it uses a handshake, acknowledgements and retransmission. UDP is connectionless and faster with no delivery guarantee, so it suits voice, video and DNS.

4. What is the TCP three-way handshake?
The client sends SYN, the server replies SYN-ACK, and the client answers ACK. After that the connection is established and data can flow.

5. What is the difference between a hub, a switch and a router?
A hub repeats traffic to every port at Layer 1. A switch forwards frames by MAC address at Layer 2. A router forwards packets between networks by IP address at Layer 3.

6. What are collision and broadcast domains?
Each switch port is its own collision domain. A broadcast domain is the set of devices that receive a broadcast; routers and VLAN boundaries split it.

7. What is a MAC address?
A 48-bit hardware address written as 12 hexadecimal digits. The first 24 bits identify the manufacturer (OUI) and the last 24 identify the device.

8. What is the difference between unicast, multicast and broadcast?
Unicast goes to one device, multicast goes to a group that joined it, and broadcast goes to every device in the broadcast domain.

9. What does ARP do?
Address Resolution Protocol maps an IPv4 address to a MAC address. A host broadcasts an ARP request and the owner of the IP replies with its MAC.

10. When do you use a straight-through cable and when a crossover cable?
Straight-through connects unlike devices, such as a PC to a switch. Crossover connects like devices, such as switch to switch. Modern ports use Auto-MDIX and detect this automatically.

Switching, VLANs and STP

11. What is a VLAN and why use it?
A VLAN is a logical broadcast domain created on a switch. It separates departments, improves security and reduces broadcast traffic without extra hardware.

12. What is the difference between an access port and a trunk port?
An access port carries one VLAN, untagged. A trunk port carries multiple VLANs between switches using 802.1Q tags.

13. What is the native VLAN?
The VLAN whose frames cross an 802.1Q trunk untagged. It must match on both ends, and it is best practice not to use VLAN 1 for it.

14. How does inter-VLAN routing work?
Devices in different VLANs need a Layer 3 device. You can use router-on-a-stick with sub-interfaces, or a Layer 3 switch with switch virtual interfaces (SVIs).

15. Why do we need Spanning Tree Protocol?
STP prevents Layer 2 loops and broadcast storms by blocking redundant links while keeping them ready as backups.

16. How is the root bridge elected?
The switch with the lowest bridge ID wins. The bridge ID is the priority (default 32768) plus the MAC address, so lowering the priority forces a chosen switch to become root.

17. What are the STP port states, and how is RSTP different?
Classic STP uses blocking, listening, learning and forwarding. Rapid STP (802.1w) uses discarding, learning and forwarding and converges much faster.

18. What are PortFast and BPDU Guard?
PortFast moves an access port straight to forwarding for end devices. BPDU Guard shuts that port down if a BPDU arrives, which protects against accidental loops.

19. What is EtherChannel?
It bundles several physical links into one logical link for more bandwidth and redundancy. Negotiation uses LACP (open standard) or PAgP (Cisco).

20. What is the difference between CDP and LLDP?
Both discover directly connected neighbours. CDP is Cisco proprietary, while LLDP is an open standard that works across vendors.

IP addressing and routing

21. What are the private IPv4 ranges?
10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. They are not routed on the internet and need NAT to reach it.

22. How many usable hosts are in a /26 network?
A /26 leaves 6 host bits, so 2^6 – 2 = 62 usable hosts. The formula is 2^n – 2, where n is the number of host bits.

23. What are the main differences between IPv4 and IPv6?
IPv4 uses 32-bit addresses and IPv6 uses 128-bit addresses. IPv6 has no broadcast, simplifies the header and was designed so NAT is not needed.

24. What are the common IPv6 address types?
Global unicast (2000::/3), link-local (FE80::/10), unique local (FC00::/7) and multicast (FF00::/8).

25. What is the difference between static and dynamic routing?
Static routes are configured by hand and do not adapt. Dynamic routing protocols such as OSPF learn routes automatically and react to changes.

26. What is administrative distance?
It ranks how trustworthy a route source is when several offer the same prefix; lower wins. Connected is 0, static is 1, eBGP is 20, OSPF is 110 and RIP is 120.

27. How does OSPF work?
OSPF is a link-state protocol. Routers flood link-state advertisements, build a topology database and run the SPF algorithm to choose the lowest-cost path. Area 0 is the backbone.

28. What are the OSPF neighbor states?
Down, Init, 2-Way, ExStart, Exchange, Loading and Full. A healthy neighbour ends in Full, or 2-Way with a non-DR router on a multi-access network.

29. What are the DR and BDR in OSPF?
On multi-access networks the designated router and backup designated router reduce the number of adjacencies. Election goes to the highest priority, then the highest router ID.

30. What is a default route?
A route to 0.0.0.0/0 that matches anything not in the routing table. It is typically used to send internet-bound traffic to an ISP.

31. How does a router choose between multiple matching routes?
It uses the longest prefix match first. If prefixes tie, it prefers the lowest administrative distance, then the lowest metric.

32. What is a first-hop redundancy protocol?
FHRPs such as HSRP, VRRP and GLBP give hosts a virtual gateway IP shared by two routers, so the network keeps working if one router fails.

IP services and operations

33. How does DHCP work?
DHCP follows four steps called DORA: Discover, Offer, Request and Acknowledge. The client ends up with an IP address, mask, gateway and DNS server.

34. What are the types of NAT?
Static NAT maps one private address to one public address. Dynamic NAT uses a pool. PAT (overload) maps many private addresses to one public address using port numbers.

35. What does DNS do?
It translates domain names into IP addresses. It mainly uses UDP port 53, and TCP for large responses and zone transfers.

36. Why is NTP important?
NTP keeps device clocks synchronised so logs from different devices line up, which matters for troubleshooting and security investigations.

37. What are SNMP and syslog used for?
SNMP lets a management system poll and receive traps from devices for monitoring. Syslog sends log messages with severity levels from 0 (emergency) to 7 (debug).

38. What is QoS?
Quality of Service prioritises important traffic such as voice over less sensitive traffic. It involves classification, marking (for example DSCP), queuing, policing and shaping.

39. What is ICMP and which tools use it?
ICMP carries error and control messages. Ping uses echo request and reply, and traceroute uses TTL-expired messages to show each hop.

40. What is the difference between running-config and startup-config?
Running-config is in RAM and is the active configuration. Startup-config is in NVRAM and loads at boot. Use copy running-config startup-config to save changes.

Security, wireless and automation

41. What is port security?
It limits which and how many MAC addresses can use a switch port. Violation modes are protect, restrict and shutdown.

42. What is the difference between standard and extended ACLs?
Standard ACLs filter by source IP only and are placed near the destination. Extended ACLs filter by source, destination, protocol and port and are placed near the source.

43. What is the implicit deny in an ACL?
Every ACL ends with a hidden deny-all entry. If a packet matches no permit rule, it is dropped.

44. What is the difference between RADIUS and TACACS+?
RADIUS uses UDP and combines authentication with authorization. TACACS+ is Cisco-developed, uses TCP, separates the three AAA functions and encrypts the whole payload.

45. What are DHCP snooping and Dynamic ARP Inspection?
DHCP snooping blocks rogue DHCP servers by trusting only certain ports. Dynamic ARP Inspection uses the snooping table to drop spoofed ARP messages.

46. What types of VPN should a CCNA know?
Site-to-site VPNs connect two networks, usually with IPsec. Remote-access VPNs connect a single user to the network. GRE tunnels carry other protocols but do not encrypt on their own.

47. How do 2.4 GHz and 5 GHz Wi-Fi differ, and what are WPA2 and WPA3?
2.4 GHz reaches further but has fewer non-overlapping channels and more interference. 5 GHz is faster with more channels but shorter range. WPA2 and WPA3 are Wi-Fi security standards, with WPA3 being newer and stronger.

48. Why is SSH preferred over Telnet?
SSH encrypts the session on TCP port 22. Telnet sends everything, including passwords, in clear text on TCP port 23.

49. What are SDN and network automation?
In software-defined networking a central controller manages the control plane while devices forward data. Automation uses REST APIs, JSON and tools like Ansible to configure many devices consistently.

50. What do the interface states up/up, up/down and administratively down mean?
Up/up is working. Up/down usually means a Layer 2 problem such as mismatched encapsulation. Down/down points to a Layer 1 issue such as a cable. Administratively down means someone ran shutdown.

Tips to answer CCNA interview questions well

• Start with a one-line definition, then give a short example.
• Mention the command or protocol you would use to verify it (for example show ip route or show vlan brief).
• Be honest when you do not know; explain how you would find out.
• Practise on a simulator or real lab so your answers come from hands-on work.

Next steps after CCNA

Once you are comfortable with these answers, plan your growth: see the Cisco certification path from CCNA to CCNP to CCIE, and check the CCNA course fees and certification costs in India before you register. Official learning material is also free on the Cisco Learning Network.

CCNA interview questions: FAQs

How many CCNA interview questions should I prepare?

Fifty good answers across switching, routing, IP services and security cover most interviews. Depth matters more than count.

Are these CCNA interview questions good for freshers?

Yes. They start with fundamentals and build up, so freshers can work through them in order, and experienced candidates can skip to routing and security.

Do I need hands-on practice for a CCNA interview?

Yes. Interviewers often ask how you would configure or troubleshoot something, so practise on Packet Tracer, GNS3 or a real lab.

What jobs can I get after CCNA?

Typical roles are network support engineer, NOC engineer, junior network administrator and help desk engineer, with a path to network engineer after some experience.

Ready to get interview-ready?

Join our CCNA 200-301 course for live trainer-led sessions and labs, or talk to a counsellor and we will map the right path for your goals.