Network engineer interview questions for freshers: 18 CCNA-level questions

What an entry-level network interview looks like

Most panels for NOC technician, network support and junior network engineer roles mix three parts. A technical round asks CCNA topics, often starting broad ("walk me through the OSI model") and drilling into whatever you mention. A scenario round gives you a broken network in words and asks how you would find the fault. A behavioural round asks how you handle pressure, mistakes and outages.

Two habits help in every round. First, say what you would check and why, in order, before giving the answer. Second, when you do not know something, say how you would find out: which show command, which log, which document. A senior engineer would rather hire someone who says "I would check show ip route and confirm" than someone who guesses confidently.

The CCNA 200-301 exam is 120 minutes of the same material in multiple-choice form. The interview version rewards the people who labbed it.

Fundamentals questions

Testing: a shared vocabulary for troubleshooting. Name the seven layers (physical, data link, network, transport, session, presentation, application) and give one example each: cables, Ethernet and switches, IP and routers, TCP and UDP, then application protocols such as HTTP and DNS. Map them to the four TCP/IP layers: link, internet, transport, application. Then say why it matters: you troubleshoot by layer, so you can say "Layer 2 is fine, the problem is routing."

Testing: arithmetic under pressure. Talk through it. A /26 leaves 6 host bits, so the mask is 255.255.255.192 and each subnet has 64 addresses, 62 usable after removing the network and broadcast addresses. The subnets start at .0, .64, .128 and .192. Host .100 falls between .64 and .127, so its network address is 192.168.10.64, its broadcast is 192.168.10.127, and usable hosts run .65 to .126. Expect a follow-up such as "I need 50 hosts per subnet, which prefix?" (a /26 again, since a /27 gives only 30 usable).

Testing: whether you know why both exist. TCP is connection-oriented: a three-way handshake (SYN, SYN-ACK, ACK), acknowledgements, retransmission, ordering and flow control. UDP sends without a handshake or delivery guarantee, so it has less overhead and lower delay. Web traffic over HTTPS and SSH use TCP. DNS queries usually use UDP, voice and video streams use UDP because a late packet is useless, and DHCP runs on UDP. A good extra: HTTP/3 runs over QUIC, which is built on UDP.

Testing: how Layer 2 and Layer 3 meet. ARP maps a known IPv4 address to a MAC address on the local segment. The host broadcasts "who has this IP?" and the owner replies with its MAC by unicast. Then the key point: if the destination is on another subnet, the host ARPs for its default gateway's MAC, not the remote host's. Mention that ARP has no authentication, which is why ARP spoofing works.

Switching questions

Testing: core switching. A VLAN splits one physical switch into separate Layer 2 broadcast domains, so the finance and guest networks do not see each other's broadcasts. An access port carries one VLAN untagged. A trunk carries many VLANs between switches or to a router, and IEEE 802.1Q inserts a tag into each frame to identify its VLAN. The native VLAN is sent untagged. Strong answers mention the failure modes: a native VLAN mismatch between two ends, or a VLAN missing from the allowed list on the trunk, both of which leave users connected but unable to reach anything.

Testing: understanding of Layer 2 loops. Redundant links between switches create loops, and Ethernet frames have no time-to-live, so broadcasts circulate forever, causing a broadcast storm and an unstable MAC address table. STP elects a root bridge (lowest bridge ID, made of priority and MAC address), then blocks redundant ports so one loop-free path remains, unblocking them if the active path fails. Mention that you would set root bridge priority deliberately rather than leave the election to whichever switch has the lowest MAC, and that Cisco switches run per-VLAN versions such as Rapid PVST+.

Testing: inter-VLAN routing. They need a Layer 3 device. Either a router with subinterfaces on a trunk (router-on-a-stick), or a Layer 3 switch with a switched virtual interface per VLAN acting as each VLAN's default gateway. Say which you have built in a lab.

Routing and services questions

Testing: design judgement. Static routes are configured by hand, use no protocol overhead and do not adapt when a link fails; they suit small networks, stub sites and a default route to an ISP. OSPF is a link-state protocol: routers share link information, each runs the shortest path first algorithm, cost is based on bandwidth, and it reconverges automatically after a failure. On Cisco devices the default administrative distance is 1 for a static route and 110 for OSPF, so a static route wins when both exist. A floating static route uses a higher administrative distance on purpose, as a backup that appears only if the dynamic route disappears.

Testing: route selection. Longest prefix match first: a packet for 192.168.1.10 uses a 192.168.1.0/24 route over a 192.168.0.0/16 route. Among routes to the same prefix from different sources, the lowest administrative distance is installed (a connected network is 0). Within one protocol, the lowest metric wins.

Testing: a service you will troubleshoot weekly. The client broadcasts Discover, the server answers with an Offer, the client sends a Request, and the server confirms with an Acknowledge. Clients send to UDP port 67 and servers reply to port 68. Broadcasts do not cross routers, so for a server on another subnet you configure ip helper-address on the client VLAN's gateway interface, which relays the request to the server as unicast. A client showing a 169.254 address never heard back.

Testing: how private networks reach the internet. Internal hosts use private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), which are not routed on the internet. NAT rewrites the private source address to a public one at the edge. Static NAT maps one private address to one public address, typically for a server. PAT, also called NAT overload, lets many inside hosts share one public address by tracking each session's source port. Most offices and homes use PAT.

Testing: practical security. Standard ACLs match source address only, so place them close to the destination to avoid blocking more than intended. Extended ACLs match source, destination, protocol and port, so place them close to the source to drop unwanted traffic early. Entries are checked top to bottom and the first match wins, and every ACL ends with an implicit deny, so an ACL with only deny lines blocks everything. Mention wildcard masks, and that you would test with a hit counter before trusting it.

Troubleshooting and NOC interview questions

Testing: the method, which is the most important answer in the interview. Scope first: one user or many, one server or all, and what changed recently. Then work up the layers. Physical: link light, show interfaces for status and error counters. Data link: correct VLAN on the access port, MAC address learned, port not err-disabled by port security. Network: correct IP, mask and gateway; ping the gateway; traceroute toward the server; check the routing table on each hop and any ACL in the path. Transport: is the service port open (test it with a TCP connection rather than ping, because ping proves nothing about the port), and is a firewall blocking it? Application: does the name resolve in DNS, and is the service running? Close by saying you would document the cause and the fix in the ticket.

Testing: NOC discipline. Confirm the alert is real and current, not a flap that has already recovered. Check impact: which site, how many users, is there a backup path carrying traffic. Check for a scheduled change or carrier maintenance. Open or update the incident ticket with times and evidence, follow the runbook, and escalate to the carrier or on-call engineer with interface output and logs attached. Update stakeholders at regular intervals even when nothing has changed.

Testing: whether you have actually labbed. Name real commands and what you read from them: show ip interface brief, show interfaces, show vlan brief, show interfaces trunk, show ip route, show ip ospf neighbor, show mac address-table, show running-config, plus ping and traceroute. Mention SNMP and syslog for monitoring, and any monitoring platform you have used in a lab.

Behavioural and one-year experience questions

Testing: calm and communication. Use situation, task, action, result. Strong answers show you stayed in your lane, kept a timeline, escalated early with evidence, communicated status, and joined the review afterwards. If you have no outage story yet, describe a lab failure you caused and fixed, then say plainly how you would apply that in production.

Testing: honesty and change discipline, a common question for candidates with a year of experience. Describe what you changed, how you noticed the problem, how you rolled back, and what you do differently now: a maintenance window, a written rollback plan, saving the config before and after. Interviewers distrust people who claim no mistakes.

Testing: fit and retention. Name a realistic path, such as NOC to network engineer, and the next certification, for example a CCNP core exam such as CCNP Enterprise. Tie it to this team's work so it sounds like growth here.

For the opening "tell me about yourself" answer, use our guide for IT interviews. If the role is closer to support than engineering, also read help desk interview questions.

How to prepare in the week before

1. Subnet five random addresses every day on paper, out loud, against a timer.
2. Rebuild one lab per day in Packet Tracer or Cisco Modeling Labs: VLANs with a trunk, OSPF, DHCP relay, PAT, an extended ACL. Break each one on purpose and fix it with show commands.
3. Write your troubleshooting order for question 13 on one card and rehearse it until it is automatic.
4. Prepare two behavioural stories, one about pressure and one about a mistake.
5. Prepare three questions for them: what the on-call rotation looks like, what monitoring and ticketing tools they use, and how NOC staff have moved into engineering.

If networking feels thin and you want a vendor-neutral refresher, Network+ covers the same ground with less Cisco command-line detail. The BLS puts the May 2025 median wage for computer network support specialists at $76,220 and for network and computer systems administrators at $99,130, which is useful context when the offer arrives; negotiating your first offer covers what to do with it.