CCNA interview questions and answers (2026): 29 questions with clear answers

These are the questions that come up again and again in interviews for junior network engineer, NOC and IT support roles. Each answer is short on purpose: learn the idea, then practise saying it in your own words. Interviewers can tell the difference between understanding and memorising.

Tip: If you do not know an answer, say how you would find out ("I would check the routing table with show ip route"). An honest, logical answer beats a confident guess. Our post on preparing for a network engineer interview covers the rest of the interview.

Fundamentals

1. What is the difference between a switch and a router?

A switch connects devices inside the same network and forwards frames using MAC addresses (Layer 2). A router connects different networks and forwards packets using IP addresses (Layer 3). A Layer 3 switch can do both.

2. Explain the OSI model in a sentence per layer.

Physical: cables and signals. Data link: frames and MAC addresses on the local link. Network: IP addresses and routing between networks. Transport: TCP or UDP and port numbers. Session, presentation and application: the conversation, formatting/encryption and the program itself (HTTP, DNS). Say you use it as a troubleshooting checklist, from the bottom up.

3. TCP or UDP: what is the difference?

TCP sets up a connection (three-way handshake), numbers the data and resends anything lost, so it is reliable but has more overhead. UDP just sends with no handshake or resends, which suits DNS lookups, voice and video where speed matters more than a missing packet.

4. What happens in the TCP three-way handshake?

The client sends SYN, the server replies SYN-ACK, and the client answers ACK. Only then does data flow. If you see SYNs with no reply in a capture, something (often a firewall) is blocking the port.

5. What is a VLAN and why use one?

A VLAN splits one physical switch into several separate Layer 2 networks. It keeps broadcast traffic smaller and separates groups such as staff, guests, phones and cameras, so a problem or attacker in one group cannot reach the others without passing a router or firewall.

6. Access port vs trunk port?

An access port carries one VLAN, untagged, to an end device such as a PC. A trunk carries many VLANs between switches (or to a router or server), adding an 802.1Q tag to each frame so the other side knows which VLAN it belongs to. The native VLAN is the one sent untagged on a trunk.

7. How do devices in different VLANs talk to each other?

Through a Layer 3 device: a router with sub-interfaces (router-on-a-stick) or, more commonly, a Layer 3 switch with an SVI (interface vlan) for each VLAN acting as the default gateway.

8. What does ARP do?

ARP finds the MAC address that belongs to an IP address on the local network. A device broadcasts "who has 192.168.1.1?" and the owner replies with its MAC. For addresses on other networks, the device ARPs for its default gateway instead.

9. What is the purpose of the default gateway?

It is the router a device sends traffic to when the destination is not on its own subnet. A wrong or missing gateway is a classic cause of "I can reach local devices but not the internet".

10. What is DHCP and what is the DORA process?

DHCP hands out IP settings automatically. DORA: Discover (client broadcasts), Offer (server proposes an address), Request (client asks for it), Acknowledge (server confirms). If DHCP fails, Windows gives itself a 169.254.x.x address.

11. What is DNS and which port does it use?

DNS turns names like fmtechub.com into IP addresses. It mainly uses UDP 53, and TCP 53 for large answers and zone transfers. If you can ping 8.8.8.8 but not a website name, suspect DNS.

12. What is NAT and PAT?

NAT translates private addresses to public ones at the edge. PAT (NAT overload) lets many inside devices share one public IP by tracking different port numbers. It is how almost every home and office reaches the internet.

Switching, routing and security

1. Subnet 192.168.10.0/26: how many subnets and hosts?

A /26 leaves 6 host bits: 64 addresses and 62 usable hosts per subnet. Splitting a /24 into /26s gives 4 subnets: .0, .64, .128 and .192. Show your working out loud; interviewers care about the method. Practise with the subnet calculator.

2. Static routing vs dynamic routing?

Static routes are typed in by hand: simple, predictable, no overhead, but they do not adapt if a link fails. Dynamic protocols such as OSPF learn routes automatically and re-route around failures, which suits larger or changing networks.

3. What is administrative distance?

It is how much a router trusts a source of routes when two sources offer the same network. Lower wins. Common Cisco values: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120.

4. How does OSPF choose the best path?

OSPF is a link-state protocol. Each router builds a map of the area and runs the SPF (Dijkstra) algorithm. The path with the lowest total cost wins; cost is based on interface bandwidth by default.

5. What must match for two routers to become OSPF neighbours?

Same area, same subnet and mask on the link, matching hello and dead timers, matching authentication, compatible network type and MTU, and unique router IDs. Mismatched timers or areas are the usual interview "gotcha".

6. What does Spanning Tree Protocol do?

STP stops Layer 2 loops when switches have redundant links. It elects a root bridge and blocks some ports so only one active path exists. If a link fails, a blocked port takes over. Rapid PVST+ converges much faster than classic STP.

7. What are PortFast and BPDU Guard?

PortFast lets an access port to a PC start forwarding immediately instead of waiting for STP. BPDU Guard shuts that port down if a switch is plugged into it, protecting the network from accidental loops.

8. Standard vs extended ACL?

A standard ACL filters on source IP only, so place it close to the destination. An extended ACL can match source, destination, protocol and port, so place it close to the source. Every ACL ends with an implicit "deny any".

9. What is port security on a switch?

It limits which or how many MAC addresses can use a port. If an unknown device connects, the port can protect, restrict (drop and log) or shut down, depending on the violation mode.

10. What is the difference between IPv4 and IPv6?

IPv6 uses 128-bit addresses written in hex, has no broadcast (it uses multicast), supports automatic addressing (SLAAC) and does not need NAT for address shortage. IPv4 uses 32-bit dotted-decimal addresses and relies heavily on NAT.

11. What are HSRP and VRRP for?

They give hosts a virtual default gateway shared by two or more routers. If the active router fails, the standby takes over the same virtual IP, so users keep working without changing settings. HSRP is Cisco-specific; VRRP is an open standard.

12. How would you secure a new switch?

Change default credentials and use enable secret, allow SSH only (no Telnet), shut unused ports and put them in an unused VLAN, set a non-default native VLAN, enable port security and BPDU Guard on access ports, add a login banner, keep the software updated and send logs to a syslog server.

Troubleshooting scenarios

1. A user cannot reach the internet. Walk me through it.

Start local and move outwards: check the cable or Wi-Fi, run ipconfig (is there a valid IP, not 169.254?), ping the default gateway, ping 8.8.8.8, then ping a name to test DNS, then tracert. Ask whether one user or many are affected; many users points to the network rather than the PC.

2. Two PCs in the same VLAN cannot ping each other. What do you check?

Both IPs in the same subnet with the right mask, the ports really in the same VLAN (show vlan brief), ports up/up, no port-security violation, and the Windows firewall blocking ICMP, which is very common and often the real answer.

3. An interface shows "up, line protocol down". What does it mean?

Layer 1 sees a signal but Layer 2 is not working: for example an encapsulation or keepalive mismatch on a serial link, or a problem with the far end. "Administratively down" simply means someone typed shutdown.

4. Which show commands do you run first on a Cisco switch?

show ip interface brief, show interfaces status, show vlan brief, show interfaces trunk, show mac address-table, show cdp neighbors and show logging. See our Cisco IOS cheat sheet.

5. Tell me about a network problem you solved.

Use the STAR method: Situation, Task, Action, Result. Choose a real example, even from a home lab, and explain how you narrowed it down step by step. Interviewers value a calm, logical process more than a perfect answer.

How to practise

• Explain one question a day out loud, as if to a non-technical friend.
• Build small labs in Packet Tracer or CML for VLANs, trunks, OSPF and ACLs.
• Keep our free IPv4 subnetting and Cisco IOS cheat sheets beside you while you practise.
• Read the notes on VLANs and trunks and the OSI model for deeper explanations.