CCNA Practice Labs and Interview Questions

# CHAPTER 19

CCNA Practice Labs and Interview Questions #

1. Introduction #

2. Learning Objectives #

• Confidently answer advanced behavioral and technical networking interview questions.

• Perform mental subnetting calculations without a calculator.

• Diagnose and propose solutions for complex, multi-layer network outages.

• Recall critical Cisco CLI configuration and verification commands instantly.

• Demonstrate a structured, logical approach to architectural design.

3. Core Technical Interview Questions #

Q1: "Explain what happens at Layer 2 and Layer 3 of the OSI model when a PC sends a ping to a server on a different subnet." *How to answer (The Gold Standard):* At Layer 3, the PC generates an IP packet with its own Source IP and the server's Destination IP. These IP addresses *never change* during the journey. Because the destination is on a different subnet, the PC knows it must send the packet to its Default Gateway (the router). At Layer 2, the PC encapsulates the IP packet into an Ethernet Frame. The Source MAC is the PC's network card. The Destination MAC is the *Router's interface MAC address*. When the router receives the frame, it strips the Layer 2 MAC header, looks at the Layer 3 IP to make a routing decision, and builds a brand new Layer 2 MAC header to send the packet to the next hop.

Q2: "You have a branch office connected to Headquarters via OSPF. The OSPF link goes down, and you lose connectivity. How would you architect a backup solution using only static routes?" *How to answer:* I would implement a Floating Static Route. I would configure a static route pointing to a backup internet connection, but I would manually set the Administrative Distance (AD) to something higher than OSPF's default AD of 110 (e.g., AD 200). While OSPF is healthy, the AD 200 route remains hidden. When the OSPF link drops, the dynamic route disappears, and the router automatically injects the backup Static Route into the routing table.

4. Subnetting Whiteboard Challenge #

The Scenario: You are given the IP block 172.16.0.0 /23. You need to carve out a subnet that can support exactly 60 hosts for the HR department.

The Question: What is the most efficient CIDR subnet mask to use, and what is the Network ID and Broadcast Address of the first available subnet?

The Solution:

1. 1. A subnet for 60 hosts requires 6 bits of host space (2^6 = 64).

1. 2. 32 total bits - 6 host bits = 26 network bits. We need a /26 subnet mask (255.255.255.192).

1. 3. A /26 gives a block size of 64.

1. 4. The first Network ID is 172.16.0.0.

1. 5. The first Broadcast Address is 172.16.0.63.

1. 6. The usable range is .1 to .62.

5. CLI Rapid-Fire Drills #

Drill 1: Secure the Device

• Set the hostname to Core-Switch-1.

• Set the encrypted privileged mode password to CiscoSecure.

enable
configure terminal
hostname Core-Switch-1
enable secret CiscoSecure

Drill 2: Configure a Trunk

• Configure GigabitEthernet0/1 to act as a trunk port allowing all VLANs to a router.

interface GigabitEthernet0/1
switchport mode trunk

Drill 3: The Panic Button

• You just made a change that broke the network, and you are locked out of SSH. What do you hope you didn't type yet?

6. Troubleshooting Scenario Labs #

Scenario 1: The Broken Ping *The Setup:* PC-A (192.168.1.10/24) cannot ping PC-B (192.168.2.10/24). *The Diagnostics:*

• You log into PC-A. ipconfig shows the Default Gateway is 192.168.1.1. You can ping 192.168.1.1 successfully.

• You log into the Router. show ip route displays both the 1.0 and 2.0 networks as Directly Connected.

• You log into PC-B. You notice its Default Gateway is configured as 192.168.2.254, but the router's interface IP for that subnet is actually 192.168.2.1.

Scenario 2: The ACL Nightmare *The Setup:* You applied an Extended ACL inbound on the router's WAN interface to block a specific hacker IP (203.0.113.50). The exact command used was: access-list 100 deny ip host 203.0.113.50 any. Instantly, the entire company lost internet access. *The Solution:* You forgot the Implicit Deny. Because there was no permit statement at the end of the list, the router blocked the hacker, and then blocked everything else. You must append access-list 100 permit ip any any to the ACL.

7. Preparing for the Technical Assessment #

1. 1. State your methodology: "I will use a bottom-up approach."

1. 2. Layer 1/2 Verification: "First, I would verify physical connectivity and switch MAC learning."

1. 3. Layer 3 Verification: "Next, I would verify the IP configuration, default gateway, and routing tables."

1. 4. Isolate: "I would use traceroute to find the exact point of failure."

8. Summary #

9. Next Chapter Recommendation #