Top CCNA Interview Questions & Answers (2026)

The laptop compares the server's IP with its own address and mask and sees it is off-subnet, so the packet has to go to the default gateway. Its ARP cache is empty, so it broadcasts an ARP request for the gateway's IP and the gateway replies with its MAC. The laptop builds a frame with the gateway's MAC as destination and the server's IP as destination IP. The switch forwards it using its MAC table. The gateway strips the frame, decrements TTL, finds the longest prefix match, and because the server's subnet is directly connected, ARPs for the server. It sends a new frame with its own MAC as source. IPs stay the same end to end; MACs change at every hop, unless NAT is involved.

There is a strict order. First, longest prefix match always wins: a /24 beats a /16 no matter which protocol learned the /16. Only when two sources offer the identical prefix does administrative distance decide which one goes into the routing table: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120. Inside a single protocol, the lowest metric wins, such as OSPF cost, which is derived from interface bandwidth. If metrics tie, the router can load-balance across the equal-cost paths. To confirm what is really happening I run show ip route with the specific destination address, which shows the chosen entry and where it came from.

OSPF routers send hellos, by default every 10 seconds on Ethernet with a 40-second dead interval. To become neighbors they must agree on area ID, subnet and mask, hello and dead timers, authentication and area type, and they need different router IDs. They move through Init and 2-Way, elect a DR and BDR on broadcast segments, exchange database descriptions and reach Full. The classic failures are a mismatched area or timer, the interface accidentally made passive, an ACL dropping 224.0.0.5, duplicate router IDs, or an MTU mismatch, which leaves them stuck in ExStart or Exchange. I start with show ip ospf neighbor and show ip ospf interface on both sides, then debug ip ospf adj if it is still unclear.

Spanning Tree stops Layer 2 loops when there are redundant links. Switches elect a root bridge by lowest bridge ID, priority first then MAC, each switch picks its best path to the root, and redundant ports block. Without it, Ethernet frames have no TTL, so a loop becomes a broadcast storm and MAC table flapping within seconds. On access ports I run PortFast so PCs come up immediately, plus BPDU Guard. If the desk switch sends BPDUs, or a user patches two of its ports back into the wall and our own BPDUs come back, the port goes err-disabled instead of the loop taking down the floor. I also set root priority deliberately so the oldest switch in the building does not win the election.

Inside we use private RFC 1918 addresses, which are not routable on the internet, so the edge router or firewall translates them. With PAT, also called NAT overload, every inside host is translated to the same public address with a unique source port. The device keeps a translation table mapping inside address and port to the public address and port, so replies are matched back to the right user. Static NAT is a fixed one-to-one mapping, used when something inside must be reachable from outside. If nobody gets out, I check ip nat inside and ip nat outside are on the right interfaces, the ACL matches the inside subnets, there is a default route, and then look at show ip nat translations.