Network Kings

LIMITED TIME OFFER

$999 $499 only For All Access Pass Today! USE PROMO CODE : LIMITED

d :
h :
m
Claim Offer
Consult Us

Aakriti

Important OSPF Interview Questions and Answers

by
OSPF Interview Questions

Whether you are preparing for Cisco Certified Network Professional (CCNP) or Cisco Certified Internetwork Expert (CCIE) exam, OSPF is one of the most important topics to cover. Open Shortest Pathway First (OSPF) OSPF is the most important routing protocol in the networking domain followed by BGP and MPLS. 

In this blog, we have covered the most important OSPF interview questions and answers. This is a helpful guide for you if you’re preparing to crack a Network Engineer job position.  

OSPF is a significant topic in both CCNP ENCOR (the core exam) and CCNP ENARSI (the concentration exam). If you’re preparing for any of them, OSPF is an important topic to consider. 

Let’s begin with the basic to advanced OSPF questions to cover for you to crack OSPF interviews like a pro.  

high paying job
Get Certified and Double your Salary!
Prepare with Network Kings to hike your salary by 2x. Enroll now to learn live, directly from Industry Engineers.
Book Free Demo Session

Top 13 Most Asked OSPF Interview Questions with Answers - Interview Preprations

1. What is the OSPF routing protocol?

Open Shortest Pathway First (OSPF) is an Open Standard Link State routing protocol. It works with the help of Dijkstra algorithm to find the straight and the shortest paths. It finds the best path between the source and the destination router. It follows that by populating the routing table with resulting best paths. 

2. Who developed the OSPF?

The OSPF was developed by Internet Engineering Task Force (IETF). It was earlier developed as an Interior Gateway Protocol (IGP). The primary aim of a protocol is to move the packets within a large anonymous system or routing domain. 

OSPF is a network layer protocol.  

3. What are the main characteristics of OSPF?

Some of the most important characteristics of OSPF are as follows: 

  • OSPF is a classless routing protocol. 
  • It supports VLSM and CIDR. 
  • It allows the creation of areas and autonomous systems. 
  • It works on protocol number 89. 
  • It is a network layer protocol. 
  • It uses multicast address 224.0.0.5 and 224.0.0.6 for updating to a router in case of normal communication. 
  • It provides routing information to the TCP/IP model in the IP section. 
  • It works on the Dijkstra SPF (Shortest Path First) algorithm to look for the shortest path. 
  • It uses cost as a metric that is computed on the basis of the bandwidth of the link. 
  • It supports both IPv4 and IPv6. 
  • OSPF routers have an administrative distance of 110. 
  • It supports unlimited Hop count. 
  • It is more efficient in sending routing information than RIP (Routing information Protocol). 
  • OSPF forms neighbor relationships with adjacent routers in the same area. 
  • OSPF advertises the status of directly connected links using the Link State Advertisements (LSAs). 
  • It does not advertise the distance to connected networks. 
  • OSPF sends updates (LSAs) in the times when there is a change to one of its links. It only sends the change during the updating process. 

4. What is LSA in OSPF?

  • The LSAs (Link-State Advertisements) are used to exchange routing and topology information to other local routers by OSPF routers.  
  • While exchanging routes, the two neighboring routers send each other a list of all the LSAs in their respective topology database. 
  • The LSAs are exchanged between the two routers until all of them have the same database of topology data. 
  • Each router then checks its topology database and sends Link State Request (LSR) message requesting all LSAs that were not found in its topology table. 

5. What are the different LSA types in OSPF?

  • The different types of LSAs in OSPF are as follows: 

    • LSA Type 1: Router LSA 

    Each router generates a Type 1 LSA that lists its active interfaces, IP addresses, neighbors and the cost. LSA Type 1 is flooded only within an area. 

    • LSA Type 2: Network LSA 

    Type 2 LSA is sent out by the designated router (DR). It lists all the routers on the adjacent segment. Type 2 LSA are flooded only within an area. It contains all the DR information. 

    • LSA Type 3: Summary LSA 

    Type 3 LSAs are generated by Area Border Routers (ABRs) to advertise networks from one area to the other areas in Autonomous System. It contains the inter-area routes information. 

    • LSA Type 4: Summary ASBR LSA 

    The ABR generates the type 4 LSA. It contains routes to ASBRs. 

    • LSA Type 5: External LSA 

    External LSAs are generated by ASBRs. It contains routes to networks that are external to current AS. 

    • LSA Type 7: Not-So-Stubby Area LSA 

    Type 5 LSAs are not allowed by the stub areas. A Not So Stubby Area (NSSA) allows advertisement of Type 5 LSA as Type 7 LSAs. Type LSA is generated by an ASBR inside a Not So Stubby Area (NSSA) in order to describe routes redistributed into the NSSA. 

6. How to configure the OSPF routing protocol?

  • We use the following syntax to configure the OSPF routing protocol: router(config)# router ospf 10 

    router(config-router)# network 12.1.1.0 0.0.0.225 area 0 

    router(config-router)# network23.1.0.0 0.0.255.255 area 1 

    router(config-router)# exit 

    • Router ospf 10 command enables the OSPF process. Here “10” indicates the OSPF process ID. This process ID can be different on neighbor routers. Process ID allows multiple OSPF processes to run on the same router. 
    • The second command configures 12.1.1.0/24 network in area 0. 
    • The third command configures 23.1.0.0/16 network in area 1. 

7. Mention the network types in the OSPF.

  • The various types of networks in OSPF are: 

    • Point-to-point: 

    The data packets are sent between exactly two routers. 

    • Broadcast: 

    The data packets are sent from one router to multiple routers. 

    • Non-broadcast: 

    The network in this type of network supports access to many devices. But it does not allow the broadcast capability.

8. What is the difference between EIGRP and OSPF?

  • The differences between EIGRP and OSPF are as follows: 

    EIGRP  

    OSPF  

    The full form of EIGRP is Enhances Interior Gateway Protocol. It is a hybrid type protocol. 

    The full form of OSPF is Open Shortest Path First. It is a link-state protocol. 

    EIGRP needs very low CPU power and memory. 

    OSPF needs high processing power and memory. 

    It is based on Cisco Proprietary standards. 

    It is based on the IETF Open Standard. 

    The routing metrics consist of load, reliability, bandwidth and delay. 

    The routing metrics consist of interface bandwidth. 

    EIGRP allows summarization and filtering. These are possible anywhere in the network. 

    OSPF is possible only on ABR or ASBR. 

9. What are the various OSPF router types?

  • There are four different types of OSPF routers: 

    • Internal Routers (IR): 

    The Internal Routers are OSPF Routers whose interfaces belong to the same area. 

    • Backbone Routers (BR): 

    Backbone Routers are the OSPF Routers which act as Internal Router in Area 0. 

    • Area Border Routers (ABR): 

    Area Border Routers are the OSPF Routers that have interfaces in more than one area. 

    • Autonomous System Boundary Routers (ASBR): 

    Autonomous System Boundary Routers are the OSPF Routers that advertise external routes into the OSPF domain.

10. What is the role of topology and routing table used in OSPF?

  • The OSPF process is used to build and maintain three separate tables. These are as follows: 

    • Neighbor table: 

    The neighbor table consists of a list of all neighboring routers. 

    • Topology table: 

    The topology table consists of a list of all possible routers to all known networks within an area. 

    • Routing table: 

    The routing table consists of the best route for each known network. 

11. What are the issues resolved in OSPF by DR and BDR?

  • DR and BDR act as the central point for exchanging OSPF routing information. Every non-DR and non-BDR router exchanges routing information with only the DR and BDR.  DR and BDR solve the following problems in OSPF: 

    • Excessive LSA flooding on a broadcast segment 
    • High number of Adjacencies on the MA network 

12. What will be Hello/Dead timers in network having link capacity of >T1 and <=T1?

  • For link above T1, i.e., 1.544 Mbps, Hello=10 seconds, Dead= 40 seconds. 

    For link = or below, Hello=30 seconds, Dead=120 seconds. 

    Dead interval is exactly four times than Hello. Its value cannot be set manually. 

13. Can area 1 and area 2 exchange or advertise networks if they are not connected to area 0 (Backbone area)? What do we need to do to make it happen?

Area 1 and area2 can only exchange or advertise networks if they are connected to area 0, or else the exchange of inter area routes won’t happen. Use the concept of virtual link if it is not possible. 

OSPF Interview Questions

FAQs

Open Shortest Pathway First (OSPF) is an Open Standard Link State routing protocol. It works with the help of Dijkstra algorithm to find the straight and the shortest paths.

The four types of OSPF routers are: 

  • Backbone router 
  • Internal router 
  • Area Border Router (ABR) 
  • Autonomous System Boundary Router (ASBR) 

The main function of OSPF is to determine the shortest path between the source and the destination router. It is a link-state routing protocol which aims at moving the packet within a large autonomous system. 

OSPF routers need to go through several states before establishing a neighboring connection. Full state is one of them. 

In the full state, all the neighbor routers have a synchronized database and adjacencies have been established. 

OSPF is present in the Application Layer of the TCP/IP model.

The OSPF uses the Dijkstra SPF (Shortest Path First) algorithm to look for the shortest path.

OSPF uses multicast and unicast instead of broadcast for sending messages.

The formula used is: 

Cost = Reference Bandwidth/Interface Bandwidth 

What Is The Rapid Spanning Tree Protocol (RSTP) And How Does It Work?

by
RSTP Protocol
RSTP Protocol

The Rapid Spanning Tree Protocol (RSTP) is a network protocol that allows for the rapid recovery of failed links in a network. It is an open standard, originally developed by IEEE in the early 2000s. RSTP is based on the Spanning Tree Protocol (STP), but it significantly reduces the time it takes to recover from link failures.

The Spanning Tree Protocol (STP) is referred to  a network protocol that builds a loop-free logical topology for Ethernet networks. The STP was invented by Dr. Radia Perlman while working for Digital Equipment Corporation in 1985. STP is commonly used in bridged Ethernet local area networks (LANs). 

The RSTP was designed to be an improvement over the STP. The RSTP was defined in the IEEE 802.1w standard in 2001. RSTP is similar to STP in that it prevents loops in the network and allows for redundant paths. However, RSTP converges much faster than STP. 

In a traditional STP network, if a link fails, it can take up to 50 seconds for the STP algorithm to converge and re-route traffic. With RSTP, this time is reduced to less than 10 seconds. RSTP accomplishes this by using a more efficient algorithm, and by defining new port states that allow for faster recovery.

In this blog, we will take a closer look at the RSTP. We will explain what the RSTP is, how it works, and how it compares to the STP.

In the previous blog of our CCNA 200-301 series , we talked about the Security Program Elements in CCNA. I recommend you go through it before you jump to this blog. 

What is the RSTP Protocol?

The Rapid Spanning Tree Protocol (RSTP) is an open, IEEE-standard network protocol that is based on the Spanning Tree Protocol (STP). It is designed to provide rapid recovery from failures in network links by allowing the network to quickly converge and route traffic around the failure.

RSTP Tree

RSTP works by detecting the loss of a link and then rapidly electing which new link should be used to re-route traffic. 

In a traditional STP network, the election of this new link could take up to 50 seconds, but with RSTP, the time is reduced to less than 10 seconds. To achieve this rapid recovery, RSTP uses new port states and functions that allow for faster link failure detection and recovery. In addition, the RSTP algorithm is more efficient than the STP algorithm, and it also simplifies the topology of a network by using fewer protocol packets.

How is the RSTP Similar to the STP?

Here are some of the main similarities between the RSTP and STP:

  • RSTP serves the same purpose as STP, blocking specific ports to restrict Layer 2 loops.
  • RSTP elects a root bridge with the same rules as STP.
  • RSTP elects root ports with the same rules as STP.
  • RSTP elects designated ports with the same rules as STP(Spanning Tree Protocol).

How Does the RSTP Protocol Work?

The RSTP protocol is based on a link-state algorithm. This means that is it constantly listening and monitoring the network to detect any changes in the topology or link status. 

When a link failure is detected, the RSTP algorithm quickly reconfigures the network to route around the failed link. The RSTP protocol uses a set of defined port states and functions to enable it to rapidly detect link failures and reconfigure the network. 

The five defined port states are mentioned below: 

  • Blocking
  • Listening
  • Learning
  • Forwarding
  • Discarding

Each port state serves a specific purpose in the RSTP recovery process. For example, when a link fails the RSTP protocol assigns the failed port to the blocking state, which prevents it from participating in the forwarding of traffic for that period of time. 

Then, the RSTP protocol quickly elects which port should become the new root port and assigns it to the forwarding state, allowing it to take over the forwarding of traffic.

The Rapid Spanning Tree Port States

The various RSTP port states are given below in the table:

STP Port State

Send/Receive BPDUs

Frame Forwarding (Regular traffic)

MAC Address Learning

Stable/Transitional

Discarding

NO/YES

NO

NO

Stable

Learning

YES/YES

NO

YES

Transitional

Forwarding

YES/YES

YES

YES

Stable

  • If a port is administratively disabled (shutdown command), that is equal to discarding state.
  • If a port is enabled but blocking traffic to prevent Layer 2 loops, it means it is in the discarding state.

RSTP Link Types

RSTP distinguishes between three different ‘link types’.

  • Edge:

It is a port that is connected to an end host. It moves directly to forwarding without negotiating.

  • Point-to-Point:

It establishes a direct connection between two switches.

  • Shared:

It is an established connection to a hub. It should be operated in half-duplex mode.

The Benefits of Using the RSTP Protocol

The biggest benefit of using the RSTP protocol is its ability to quickly recover from link failures. With a traditional STP network, the time it takes to re-route traffic around a failure can be up to 50 seconds. With RSTP, this time is reduced to less than 10 seconds. This drastically reduces network disruptions and improves the overall performance of the network. 

In addition, since RSTP is an open, IEEE standard, it is supported by most network switches and routers. This makes it easy to implement and maintain in any network.

Some Final Thoughts

The Rapid Spanning Tree Protocol (RSTP) is a powerful, open standard that provides improved link-failure recovery time compared to the traditional Spanning Tree Protocol. 

It is a fully supported protocol and is easy to implement and maintain in a network. RSTP is especially beneficial in network environments that require near-instantaneous recovery from link failures.

I recommend you read about STP first in order to understand RSTP in a better way.

Stay tuned for more blogs for the CCNA 200-301 series!

Happy Learning!

Top 20+ Linux Interview Questions and Answers

by
Linux Interview Questions and answers
Linux Interview Questions and answers

Looking to ace your Linux interview? This guide provides common Linux interview questions and answers for experienced as well as for Freshers to help you prepare.  Linux is an open-source platform that has contributed to world-changing ideas. It is an Operating System popular for its efficiency and fast performance. Linux forms the basis of a successful tech career.

From networking to cybersecurity to cloud computing, Linux is used almost everywhere. From web developers to Network Engineers, everyone needs to know about Linux. This creates a massive demand for Linux experts in the industry.

If you are eyeing becoming a Linux Administrator or any other tech professional, Linux certification is the right path for you to begin with. In this blog, we have collected the most frequently asked Linux interview questions and answers.

Here, we have classified questions in the following sections:

  • Linux Interview Questions for Beginners
  • Linux Commands
  • Linux Networking Interview Questions

Let’s begin!

Linux Interview Questions and Answers for Beginners

1. What is Linux?

  • Linux is an Operating System that is popular for its efficiency and fast performance. 
  • It is based on Linux Kernel which is low-level system software that is used to manage hardware resources for users.
  • It is a Unix-like open-source Operating System that can be run on different hardware platforms.
  • It directly managed the hardware and resources of a system such as CPU, memory, and storage.
  • It also manages communication between software and hardware.
  • It can be installed on laptops, mobiles, computers, etc.
  • Some of the flavors of Linux OS are Ubuntu, SUSE Linux, Gentoo, Debian, etc.

2. What is Linux Kernel?

  • Linux Kernel is the core of the Operating System.
  • It is a bridge between software and hardware.
  • It is low-level system software that is used to manage hardware resources for users.
  • Kernel contacts the hardware to seek permissions.
  • Most Android phones have Linux kernels.

3. What are the features of the Linux OS?

The following are the most important features of the Linux OS:

  • Free and Open-Source:  Linux is available for free for community use. Anyone can use it.
  • Adaptable and flexible: Linux can operate for long periods without crashing and is safe. It is not affected by security threats.
  • More secure: Linux is more secure as it gives security using authentication features like password authentication, security auditing and file system access control.
  • Application Support: Linux has its own software repository. It means it has a place or storage location from where software can be extracted for users to download and install applications.
  • Multiprogramming System: On Linux, more than one application can run at the same time.
  • Supporters customized keywords: Linux supports the installation of multiple language keyboards.
  • GUI (Graphic User Interface): Linux is user-friendly. It provides an interface to interact with the system. It allows you to use GUI applications such as VLC, Firefox, etc.

4. What are the basic elements or components of Linux?

Linux is made up of five basic elements or components as mentioned below:

  • Kernel: The kernel is the heart or the main part of Linux. It is responsible for all the main activities of OS such as process management, device management, etc.
  • System Library: These are special programs/functions which allow application programs/system utilities to access features of the kernel without any code. 
  • System Utility: These are utility programs responsible to perform specialized and individual-level tasks. They allow users to manage the computer.
  • Hardware: It is the physical hardware. It includes items such as a mouse, keyboard, CPU, display, etc.
  • Shell: It is an environment where we can run our commands, shell scripts and programs. It is the interface between the user and kernel. It is used to execute commands.

5. What is meant by BASH?

  • BASH (Bourne Again Shell) is a Unix shell and command processor.
  • It is basically a command language interpreter.
  • It was written by Brian Fox for GNU OS.
  • It can be used instead of Bourne Shell and is free software.
  • It includes some additional features such as command-line editing that make it easier to use.
  • It is an interpreted and not a compiled process.
  • It can be run in the terminal window.
  • BASH can read commands from shell scripts.
  • It allows users to write commands and execute them.

6. What is LILO?

  • LILO (Linux Loader) is a bootloader for Linux.
  • It is used to load Linux into memory and start the OS.
  • It is also a boot manager that allows a dual boot of a computer.
  • Most Linux OS use LILO to boot the operating system into main memory to start operations.
  • It can act as a master boot program or secondary boot program.
  • It can perform various functions such as locating the kernel, identifying other supporting programs, loading memory and starting the kernel.
  • To install Linux OS, it is the best practice to install a special bootloader like LILO as it allows a fast boot of Linux OS.

7. What are the Process States in Linux?

Linux process could be found in many different states. The process enters these states from the beginning till the very end. 

Process states in Linux are given below:

  • New/Ready: A new process is created in this state and is ready to run.
  • Running: The process is executed in this state.
  • Blocked/Wait: The process waits for input from the user in this state. If it does not have resources to run such as memory, file locks, input, then it remains in a blocked or waiting state.
  • Terminated/Completed: The process completes the execution or termination by the OS in this state.
  • Zombie: The process is terminated but information related to the process is kept. This information is available in the process table in the zombie state.

Linux Commands Interview Questions

8. What are the Linux Directory commands?

The Linux directory commands are given as follows:

  • pwd: It is a built-in Linux command. It stands for ‘print working directory’. It tells the current working location, and working path starting with a / and directory of the user. In other words, it shows the full path to the directory the current user is in.
  • is: The is command lists out all the files in the directed folder.
  • cd: The cd command stands for ‘change directory’. It is used to change to the directory you want to work from the present directory. To access a particular directory, you can simply type cd followed by the directory name.
  • mkdir: The mkdir command is used to create a completely new directory.
  • rmdir: The rmdir command is used to remove a directory from the system.

9. How to open a command prompt when issuing a command?

Launch your terminal by pressing CTRL+ALT+T or by giving terminal in the menu search bar.

10. How to find out how much memory is Linux using?

You can find it out through a command shell. You can use the “concatenate” command: cat /proc/ meminfo for memory usage information.

11. What is netstat command?

  • The netstat (Network Statics) command is a networking tool used for troubleshooting and configuration.
  • It is used to show all network connections on a system.
  • Through netstat command, you can check whether the various aspects of TCP/IP are working and what connections are present.

12. How to check the default route and routing table?

You can use the following commands to display the default route and routing table:

$ route-n

$ nestat-rn

$ ip

13. How can you change the default run level in Linux?

You can change the default run level in Linux by using the init command.

14. What do you understand by the ping command?

  • Linux ping (Packet Internet Groper) command is used to check connection status between source and destination.
  • In other words, this command checks two things: if a network is available or not, if the host is reachable or not.
  • It can also be used to troubleshoot different connectivity issues, and verify connectivity at an IP-level to a second TCP/IP device.
  • You can use this command to test both the computer name and the IP address of the computer.

15. Which command can be used to count the number of characters in a file?

You can use the “wc” Linux command to count the number of characters in a file. The command “wc” stands for word count. This command is used to count the number of lines, words and characters in a text file.

16. What is meant by unmask?

Also known as user file-creation mask, unmask is a Linux command that allows you to set up default permissions for new files and folders that you create. In Linux OS, unmask command is used to set up default file and folder permission. 

It is also used by other commands in Linux that create files and directories. These commands are mkdir, tee, touch, etc.

Linux Networking Interview Questions

17. What are the benefits of using NIC teaming?

NIC (Network Interface Card) teaming has various advantages as given below:

  • Load Balancing
  • Failover
  • Increases uptime

18. What are the various network bonding modes used in Linux?

The following are the various network bonding modes used in Linux:

  • Mode-0 (balance-rr): It is the default mode and works on round-robin policy. It has fault tolerance and load balancing.
  • Mode-1 (active-backup): It works on active-backup policy. Only one node works at the time of failure of other nodes.
  • Mode-2 (balance-xor): It sets an XOR (exclusove-or) mode for providing load balancing and fault tolerance.
  • Mode-3 (broadcast): It works on broadcast policy. It provides a broadcast mode that is fault-tolerant and can be used for specific purposes only.
  • Mode-4 (802.3ad): It is based on IEEE 802.3ad standard which is also called Dynamic Link Aggregation mode. It creates aggregation groups that have the same speed and duplex settings.
  • Mode-5 (balance-tlb): It is also known as Adaptive TLB (Transmit Load Balancing). It offers the TLB mode for fault tolerance and load balancing. Traffic will be loaded based on each slave of the network.
  • Mode-6 (balance-alb): It is also called Adaptive Load Balancing. It offers ALB mode for fault tolerance and load balancing. It does not need any special switch support.

19. What is SSH? How can you connect to a remote server through SSH?

  • SSH stands for Secure Shell. 
  • It is a protocol that is used to securely connect to remote servers or systems. 
  • It allows two system to communicate.
  • It is the most common way to have access to remote Linux servers.
  • It usually transmits data over encrypted channels.
  • Therefore, it has a high security.
  • You need yo own a domain name and IP address in order to connect to a remote server through SSH.

20. What are the three standard streams in Linux?

Standard streams are I/O (Input and Output) communication channels between a program and its environment in Linux. Input and output are distributed across three standard streams in the Linux environment. 

Three standard streams in Linux are given below:

  • Standard Input (stdin)
  • Standard Output (stdout)
  • Standard Error (stderr)

21. Name the default ports used for DNS, SMTP, FTP, SSH, DHCP and squid.

Default ports that are used for different services are given below:

Service

Port

DNS

53

SMTP

25

FTP

20 (Data transfer), 21 (Connection established)

SSH

22

DHCP

67/UDP (dhcp server), 68/UDP (dhcp client)

Squid

3128

FAQs:

Linux is an Operating System that is popular for its efficiency and fast performance. It is based on Linux Kernel which is low-level system software that is used to manage hardware resources for users.

Since Linux is an open-source platform, anyone can run, study, change and redistribute the source code. Anyone can even sell copies of the modified code keeping in mind thst they sell under the same license.

Many devices work on Linux. These are android phones, cameras, watches, tablets, digital storage devices, Chromebooks, etc.

Linux is an open source Operating System which is made up of the kernel, base components of OS, tools, apps and services bundled along with it.

The following are the features of Linux:

  • Free and Open-Source
  • Adaptable and flexible
  • More secure
  • Application Support
  • Multiprogramming System
  • Supporters customized keywords
  • GUI (Graphic User Interface)

Top Most-Asked Ansible Interview Questions and Answers

by
ansible interview questions
ansible interview questions

Ansible is a powerful configuration management tool used by IT professionals worldwide. It is used to manage both small and large deployments with ease. Ansible is simple, agentless, and easy to use, making it the perfect tool for DevOps and system administrator tasks. If you are looking for a job that uses Ansible, you will likely be asked to answer Ansible interview questions. In this article, we will share with you the 16 most commonly asked Ansible interview questions with answers. These questions are divided into two categories – Ansible interview questions for beginners and Ansible interview questions for experienced professionals.

No matter your level of expertise, these Ansible interview questions will help you prepare for your next job interview.

Let’s begin with the most commonly asked Ansible interview questions and answers! 

Ansible Interview Questions and Answers for Beginners

1. What is Ansible?

Ansible is an open-source automation platform. It is used to automate IT tasks such as software provisioning, configuration management, application deployment, and ad-hoc task execution. With Ansible, you can manage a large number of hosts with a single command line, manage and connect to multiple servers simultaneously, and automate your infrastructure easily and reliably. 

Ansible comes with a wide range of built-in modules and integration support for popular IT Tools like AWS, Microsoft Azure and more. It is a simple, straightforward and highly efficient tool that helps you set up and manage your IT environment in a repeatable, reliable manner.

2. What is CI/CD and how is Ansible Related to It?

  • Continuous Integration (CI):

The full form of CI is continuous integration. It is used for efficiently running the development and deployment processes. This in return, leads to the formation of more reliable and cohesive software.

In CI, a developer develops software integrations that are uploaded almost daily at a scheduled time which results in multiple integrations every day.

  •  Continuous Delivery (CD):

CD, on the other hand, is known as Continuous Delivery (CI). It is a software development practice where code developed by a software developer is kept in a remote repository. This code can be taken to production at any time.

What is CI/CD and how is Ansible Related to It?

Ansible is a wonderful tool for CI/CD processes as it can provide a stable infrastructure for the target environment in order to carry out a smooth deployment process.

3. How Ansible works?

Ansible is a new-age automation tool. It consists of various chucks working together, which are mainly playbooks, modules, and plugins.

  • Playbooks referred to all the steps that are needed to complete a process. It defines the complete workflow and consists of plays which are small tasks. It is in a YAML file format.
  • Modules refer to small codes that get executed in a task. It acts as a starting point for making the tasks.
  • Plugins run on a main control machine for logging functions. These are special kinds of modules. 
How Ansible works?

There are two main types of servers in Ansible:

  • Controlling machines
  • Nodes

Controlling machines:

  • Ansible is installed in the controlling machines.
  • The controlling machine uses SSH protocols to deploy modules to nodes.

Nodes:

  • The nodes store modules in them for a temporary period of time.
  • It builds a JSON connection in order to communicate with the Ansible machine over the standard output.
  • These nodes are not managed by Ansible when there is no execution of a program or daemon since Ansible is an agent-less tool.
  • Hundreds of nodes can be handled by Ansible from a single system over an SSH connection.

4. Explain the architecture of Ansible.

The most important component of Ansible is the Ansible Automation engine or the Ansible Orchestration engine. It interacts with the user who is writing the Ansible playbook as well as the configuration management database in order to implement the Ansible orchestration.

Here is what the architecture of Ansible looks like:

ansible architecture

Here are all the components of the ansible automation engine in detail:

  • Inventory:

It is a list of nodes or hosts that consists of databases, IP addresses, servers, etc. that are needed to be managed.

  • APIs:

These are used for hosting and transporting public and private cloud services.

  • Modules:

Modules work in an optimal manner by connecting nodes and taking out scripts called ‘Ansible modules’. It manages files, system resources, libraries, etc. These modules can be installed on any machine.

  • Plugins:

Plugins alter the core functionality of Ansible. You can also write your own. 

  • Playbook:

It tells about all the tasks that need to be executed. These tasks are written in YAML format which explains the tasks and executes them through Ansible.

  • Hosts:

These are node systems that are automated by Ansible. These can also be automated by RedHat, Windows, Linux, etc.

  • Networking:

Ansible is agentless and it uses a simple and secure automation framework for IT operations and development. 

  • Cloud:

It is a network of remote servers which can store, manage and process data. These servers store data on a remote network without the use of a local server. 

  • CMDB:

It is referred to as Configuration Management Database (CMDB). It acts as a data warehouse for IT installations. 

5. What is meant by Ad Hoc commands? Quote an example.

These are simple one-line commands used to perform a specific task. These can be performed as individual tasks to run quick functions. They are an alternative to writing playbooks by a user. 

An example of an ad hoc command is given below as follows:

In order to delete a whole directory or file, this command can be run:

$ Ansible abc -m file -a “dest = /path/user1/new state = absent”

6. What is an Ansible task?

When you want to break configuration policies into smaller files, Ansible tasks are the perfect tool to do so. They can automate any process. Please note that these are simply a piece of code.

7. What is the difference between Ansible and Puppet?

Ansible

Puppet

Ansible is easy to set up.

Puppet is comparatively difficult to set up.

It is highly available.

It is highly available as well.

It is very easy to manage. It is less secure.

It is not easy to manage. It is less secure.

It has been made in Python. The configuration language is YAML.

The configuration language in Puppet is DSL (Puppet DSL).

It is more scalable.

It is less scalable as compared to Ansible.

The GUI of Ansible is not very interactive.

Its GUI is more interactive and very developed.

The self-support package costs around $5,000 for a year.

It costs $120 for every node in an enterprise.

8. How to keep secret data in a playbook?

Sometimes we have a task and we do not want to show the output or command that is run while using verbose mode or v-mode, we can then use the following code:

– name: secret task

shell: /usr/bin_a/do_something –value={{ secret_value01 }}

no_log: True

It can be used to keep verbose output

– hosts: all

no_log: True

9. What is meant by Ansible Galaxy?

It is a galaxy website. The users can share roles and they can even share roles with a command-line tool for installing, building, and managing roles.

You can access the best of the best Ansible features by using the Ansible galaxy. These features include:

  • Installing applications.
  • Server configuration.

Many people can share roles in Ansible Galaxy.

10. Can Ansible support AWS?

Ansible has many modules that can support AWS, such as:

  • Elastic Cloud Compute (EC2)
  • Virtual Private Cloud (VPC)
  • CloudWatch
  • DynamoDB
  • Autoscaling groups
  • ElastiCache
  • CloudTrail
  • Identity Access Manager (IAM)
  • Route53
  • CloudFormation
  • Simple Storage Service (S3)
  • Relational Database Service (RDS)

Ansible Interview Questions with Answers for Experienced Professionals

11. Explain modules in Ansible in detail.

Modules are referred to small pieces of code that perform a certain task in Ansible. They can automate a lot of tasks. When these commands run, they return values in JSON script. The input, however, depends on the type of module.

Modules are of two types:

  • Core modules:
  • These modules are special modules in Ansible that are maintained by the core Ansible team. 
  • They are always shipped with Ansible itself. 
  • If any issue occurs, they are fixed on a priority basis as compared to issues present in the extras repo. 
  • These modules are hosted by Ansible in GitHub. 
  • The Ansible-Modules-Core handles these in GitHub.
  • Extras Module:
  • These modules are special modules that are looked after and maintained by the Ansible community.
  • These are shipped with Ansible. These might be stopped in the future.
  • It is also believed that the most used and popular extras modules will be shifted to core modules in some time.
  • These are hosted by Ansible on GitHub.
  • On GitHub, these are present in the Ansible-Modules-Extras.

12. What is meant by Ansible Inventory? What are its types?

It is a file that is used to define hosts as well as groups of hosts. It contains all the commands, tasks and modules upon which these will be operated in a playbook.

There are two types of inventory files:

  • Static Inventory:

It is a list of managed hosts. It is present under a host group using either hostnames or IP addresses in a plain text file. The host names are enclosed in square brackets ([group name]). The managed host entries are then listed below the group name in their own line.

This is how hosts are listed using either hostnames or IP addresses:

[group name]

Host A ip_address

Host B ip_address

Host c ip_address

  • Dynamic inventory:

It is created by a script that is written in Python or any other programming language such as JavaScript or PHP using plug-ins. The inventory keeps on changing constantly as you add or remove servers in a cloud setup such as AWS. Therefore, dynamic inventory is of best use in a cloud environment where IP addresses change once a virtual server is stopped and started again.

The benefits of dynamic inventory are as follows:

  • They are perfect as they reduce human error because the information is collected using scripts.
  • There is little effort needed to manage inventories.

You can extract information about hosts in a dynamic inventory script by running the following code:

#  ./script — list

13. What are the variables in Ansible?

You can use a single command to execute tasks and playbooks on multiple different systems. These variables in ansible can be to manage differences between these systems. These variables can be created with standard YAML syntax, including lists and dictionaries.

Therefore, these variables in Ansible playbooks are very similar to the variables in a programming language such as Python. 

Here are some of the key features of variables in Ansible:

  • It allows you to use and assign a value to a variable. 
  • You can use it anywhere in the playbook. 
  • You must note that once you apply conditions around the value of the variables and then you can use them accordingly.
  • A variable name can only include numbers, letters and underscores. 
  • Playbook keywords and Python keywords are not valid variable names. 
  • It cannot begin with a number.

Some of the valid variable names are foo, foo_env, foo-port, foo5, and _foo.

The different types of variables in Ansible are:

  • Boolean variables
  • List variables
  • Dictionary variables

Example of a variable is as follows:

– hosts : <your hosts>

vars:

tomcat_port : 8080

14. How to upgrade Ansible?

You can easily upgrade ansible by using a single command:

Sudo pip install ansible ==<version-number>

15. How can you access shell environment variables?

You can create existing variables in the controlling machine by using the “env” lookup plugin. For example, you can enter the following command to access the value of the management machine’s home environment variable:

local_home:”{{lookup(‘env’,’HOME’)}}”

16. How can you create an encrypted file in Ansible?

In order to create an encrypted file in Ansible, you can use the ‘ansible-vault create’ command and pass the filename.

$ ansible-vault create filename.yaml

Then, you will be asked to create a password. You can confirm it by retyping.

After your password is confirmed, a new file will be created. It will get opened in an editing window. The editor for Ansible Vault is vi by default. You can add data here or you can save and exit.

This is how you can create an encrypted file.

Conclusion

Ansible is an invaluable tool for managing IT environments and deployments. As a result, being familiar with the tool and being able to answer Ansible interview questions successfully is integral for landing a job in IT. 

By reviewing the top most common Ansible interview questions, along with the provided answers, you can get a better sense of what to expect during your next interview and increase your chances of success. 

Good luck!

Top 20+ SD-WAN Interview Questions and Answers

by
SD-WAN Interview Questions and Answers
SD-WAN Interview Questions and Answers

Preparing for an interview can be a little nerve-wracking. But we got you. 

This blog consists of a detailed list of frequently asked SD-WAN questions and answers. If you have a month or even less than a month’s time to prepare for your dream interview, don’t worry.  

Nowadays, interviews are becoming a little tricky. Therefore, you need to have a good command over a subject to ace your interview.  

We have made a list of the top 20 questions regarding Cisco SD-WAN exam questions and answers. You can go through this exhaustive questionnaire to boost your interview prep. 

All kinds of important questions have been listed in this blog to help you with cracking your interview. 

Without further ado, let’s begin with our SD-WAN most-asked questions and answers.

#1 What is SD-WAN?

With a lot of businesses adopting SaaS (Software-as-a-Service) and IaaS (Infrastructure-as-a-Service) applications in multiple clouds, the old Wide Area Network (WAN) could not cope with the heavy traffic from multiple sites. This created a need for the new-age WAN. 

The Cisco SD-WAN is a software-defined approach to manage the WAN. With SD-WAN, you can use combinations of transport technologies such as 4G, MPLS, LTE, etc.

#2 Why is there a need for SD-WAN?

  • With the arrival of Cloud applications, a lot of organizations started using Cloud applications. 
  •  This caused a heavy explosion of traffic in the traditional WAN since it is limited to branches, enterprises and data centers.  
  • Also, an MPLS connection cannot cover long and remote distances. 
  • The SD-WAN is especially made for SaaS and IaaS applications. 
  • It can manage traffic and access applications from across the globe. 
  • SD-WAN uses a combination of transport services. 
  • It also takes care of the privacy of organizations sharing their data over servers. 

#3 What are the benefits of using Cisco SD-WAN?

Using SD-WAN, IT can provide the following advantages: 

  1. IT can deliver routing. 
  2. Threat management. 
  3. Efficient offloading of highly-priced circuits. 
  4. Simplification of WAN network management. 

Other benefits of SD-WAN for businesses include:

Better application experience: 

  1. SD-WAN is highly available with a wide range of services for critical enterprise applications. 
  2. Handles all types of network scenarios by creating hybrid active-active links. 
  3. Improved user experience. 
  4. Dynamically routed application traffic. 
  5. Uses economical and flexible broadband such as secure VPN connections (rather than expensive MPLS). 

More security: 

  1. Application-aware policies make SD-WAN reliable. 
  2. End-to-end segmentation and real-time access control. 
  3. Integrated threat protection. 
  4. Passage of traffic securely from broadband Internet to Cloud. 

Optimized Cloud connectivity: 

  1. Smooth extension of WAN to multiple public clouds. 
  2. Real-time optimized performance for Salesforce, Microsoft 365 and other SaaS applications. 
  3. Optimized workflows for cloud platforms like Amazon Web Services (AWS), etc. 

Simplified management: 

  1. A single, concentrated cloud-managed dashboard for configuring and managing WAN, cloud, and security. 
  2. Simplified management with vManage. 
  3. Detailed report generation of application and WAN performance. 

# 4 How do you manage and operate Cisco SD-WAN?

Cisco SD-WAN is managed centrally and has an orchestration layer at the heart of the solution. It is an operated solution with a cloud-hosted Graphic User Interface (GUI) management console called the vManage. It also has a provisioning platform called SD-WAN Controller. 

Cisco SD-WAN Controllers: 

  • They are the central brain of the SD-WAN Solution.  
  • They implement policies and connectivity between SD-WAN branches. 
  • They help in changing routing information, access control, segmentation, service chaining and extranets. 

Cisco vManage: 

  • Cisco vManage takes care of and manages the whole solution. 
  • With the help of vManage, IT Managers and Network Operators can automate the configuration, management, and operation of the whole SD-WAN fabric at one place. 
  • It is a highly visual and vivid experience to have. 

# 5 What is Cisco vManage?

Cisco vManage is the brain of the SD-WAN Solution. The whole Solution is managed by it. Cisco vManage provides a highly vivid experience that allows Network Administrators/ Operators to deploy, manage and automate networks and devices quickly across the SD-WAN fabric. 

In short, vManage can be summed up as: 

  • Highly visual interface for easy use. 
  • Pre-configured templates automate the deployment of most of the use cases. 
  • A step-by-step configuration guide to speed up the deployment of onboarding devices. 
  • Smooth user experience across Cisco Solutions. 

# 6 What is the vBond Orchestrator?

vBond is an orchestrator (automated configuration, coordination and management of computer systems) and a gatekeeper.  

  • The vBond automates the connectivity between vEdge routers and vSmart controllers. 
  • It ensures smooth SD-WAN fabric on-boarding. 
  • It consists of the information needed to verify vEdges that wish to join the SD-WAN fabric. 

# 7 How is Cisco SD-WAN deployed at branch offices and data center networks and or regional hubs?

  • Branch offices and regional hubs can be deployed and connected using either virtual or physical secure routers. 
  • Enterprise customers and service providers get services such as WAN optimization and firewall. 
  • They also get basic WAN connection for physical and virtual platforms across the branch, WAN or cloud as follows: 

Physical: 

  • Branch: Cisco IOS® XE and Viptela OS-based devices. 
  • Branch: Cisco Catalyst® 8300 Series Edge Platforms and Cisco 1000, 1100, or 4000 Series Integrated Services Routers (ISR) 
  • Branch, regional hub or data center: Cisco Catalyst 8500 Series Edge Platforms and Cisco ASR 1000 Series Aggregation Services Routers (ASR). 

Virtual: 

  • SD-Branch: Cisco 5000 Series Enterprise Network Compute System (ENCS) and Integrated Services Virtual Router (ISRv). 
  • Network Hub: Cisco Cloud Services Platform 5000, Catalyst 8000V Edge Software, and Cloud Services Router (CSR) 1000V Series. 

Public Cloud (IaaS): 

  • Amazon Web Services. 
  • Microsoft Azure. 
  • Google Cloud Platform. 

#8 Is Cisco SD-WAN Solution secure to use? What is the use of SD-WAN?

Yes, Cisco SD-WAN Solution is 100% secure to use. It is true because of the use of TPMs, pre-staged certificate installation and registration of devices.  

Traditional SD-WANs lack an effective built-in security protocol.  

How is SD-WAN a game changer? 

  • It not only improves application performance but improve connectivity, they also take care of the traffic. 
  • SD-WAN makes sure that the policy enforcement is smooth and consistent.  
  • SD-WAN provides a security-driven approach. Business organizations can use this approach to reach their performance goals. 
  • With SD-WAN, you do not need to worry about cyberattacks. 

#9 Is Network Segmentation supported by SD-WAN Solution and what are the benefits?

Yes, SD-WAN Solutions does support Network Segmentation. The main overlay network is a segment itself called VPN0. Each branch site can have its own Virtual Private Network (VPN). It can be called anything as VPN1 and VPN2. 

The benefits of the Network Segmentation are as follows: 

  • Increased security as the network is protected against outside attackers. 
  • It creates a secure separation between multiple application segments. 
  • Acquisitions can be collected on a parent network and yet they can be separated. 
  • The policies play a regulatory role. They keep a check on what applications a company can access. 
  • Guest Wi-Fi  

#10 Does SD-WAN support APIs?

Yes, SD-WAN supports APIs. The vManage works on APIs. 

#11 What is TLOC?

  1. TLOC stands for Transport Locator.  
  2. It is a point where a Cisco WAN edge device connects to a WAN transport. 
  3. It is used as a static identifier in a Cisco vEdge device. 
  4. TLOC routes separate transport locations. 
  5. TLOCs are the sites in an ‘overlay’ SD-WAN network that connect to a physical transport. 
  6. It is similar to a routing locator. 
  7. A TLOC is the only operation in the Overlay Management Protocol (OMP) domain that is seen by the underlay network. 
  8. TLOC consists of three components: 
  • IP  
  • Color 
  • Encapsulation type

#12 What does it mean if there is a DCONFAIL or a DTLS connection failure?

It is because of the connectivity problem between vEdge and controllers. 

#13 Can the Cisco SD-WAN Solution give optimization for SaaS or IaaS platforms like AWS, Office 365, Salesforce, Cisco Webex or Microsoft Azure?

The function of the Cisco SD-WAN fabric is to connect a user at a branch to various cloud applications in a smooth and easy way. Cisco is able to provide this service for Software-as-Service and Infrastructure-as-a-Service (IaaS) applications with Cisco Cloud OnRamp. 

This service is currently available with the SD-WAN solutions. 

The benefit of Cloud OnRamp: 

  • The Cisco Cloud OnRamp helps the SD-WAN fabric to continuously look after the performance of a specific application accessed by a branch. 
  • It does so through the paths allowed by that branch such as MPLS, Internet, and 4G LTE. 
  • This allows the SD-WAN to choose the best possible path by making real-time decisions based on the performance. 

#14 What is a Domain ID?

  • It is a logical classification of vEdge routers and vSmart controllers. 
  • It defines the span of control for a vSmart controller. 
  • Each domain is known by a unique integer called the Domain ID. 
  • You can only configure one domain in a Viptela Overlay Network. 
  • There is a complete sync of routing information among the vSmart controllers and vEdge routers within a domain. 
  • An organization can divide its network into domains for work purposes. 

#15 What is Site ID?

  • A site is a particular physical location in a Viptela Overlay Network. 
  • It can be a branch office, a campus or a data center. 
  • Each site has a unique integer called the Site ID. 
  • Each Viptela device at a site is known by the same Site ID. 
  • For example, in a data center, all vSmart controllers and vEdge routers are identified by the same Site ID. 
  • A branch office usually has a single vEdge router. 

#16 Explain in brief the Cisco SD-WAN Solution architecture.

A Cisco SD-WAN is made up of the following components: 

  1. Orchestration 
  2. Management 
  3. Control 
  4. Data planes 
  • The orchestration plane helps in the automatic onboarding of SD-WAN routers into the SD-WAN overlay. 
  • The management plane looks after central configuration and monitoring. 
  • The control plane maintains and builds the network topology and makes decisions on the flow of network. 

The data plane helps in forwarding the packages based on the decisions made by the control plane.

#17 Explain the SD-WAN Topology.

  • A topology usually consists of two sites and two public transport technologies (such as MPLS and LTE). 
  • The SD-WAN controllers, the vSmart controllers and the vBond orchestrator along with vManage are reachable through these transport technologies. 
  • Each site consists of vEdge routers that are directly connected to available transport technologies. 
  • Color represents an individual WAN transport. 
  • Different WAN transports are given different colors. This means different color for MPLS, LTE, business-Internet, etc. 
  • The vEdge routers make a Datagram Transport Layer Security (DTLS) or Transport Layer Security (TLS). 
  • The vEdge routers of one site securely connect with the vEdge routers of the other site with IPsec tunnels. 
  • The Bidirectional Forwarding Detection (BFD) protocol allows the detection of path failures or any loss. 

#18 What is VPN?

  • Virtual Private Network (VPN) provides segmentation in an SD-WAN network overlay. 
  • Each VPN is separated from one another. 
  • Each VPN has its own forwarding table. 
  • The VPN number is a 4-byte integer.  
  • It can be anywhere between 0 to 65530. 
  • VEdge devices and controllers have two VPNs by default called the VPN0 and the VPN512. 

VPN0: 

  1. VPN0 is a transport VPN. 
  2. It consists of interfaces that connect to the WAN transports. 
  3. This VPN forms secure DTLS/ TLS connections between vSmart and vBond controllers or to the vSmart. 

VPN512: 

  1. VPN512 is the management VPN. 
  2. It transports the out-of-band management traffic to and from the Cisco SD-WAN devices. 
  3. This VPN is absent on the overlay network. 

#19 How can a vEdge be brought into an overlay?

If a vEdge wants to join an overlay network, it needs to do the following two things: 

  • It needs to build a secure connection to the vManage to receive full configuration. 
  • It also needs to build a secure connection with vSmart controller to participate in an overlay network. 
  • The vEdge discovers the vManage and vSmart controller automatically. 
  • It is built by making a secure network to the vBond orchestrator. 

The following steps need to be followed to bring vEdge into an overlay: 

  1. The vEdge router will first authenticate the vBond orchestrator through an encrypted DTLS connection. 
  2. When authentication occurs, the vBond orchestrator sends the IP addresses of the vManage Network Management System (NMS) and the vSmart controllers. 
  3. The vEdge router starts building secure DTLS/ TLS connections with vManage and vSmart controllers.  
  4. It then breaks the connections with vBond orchestrator. 
  5. Once vManage NMS is authenticated, the vManage pushes the full configuration to the vEdge router (if available). 
  6. Then the vEdge tries to make a DTLS/ TLS connection to the vSmart controllers over each transport link. 
  7. After authentication, it makes an OMP session and learns the routes along with policies, TLOCs and encryption keys. 
  8. Then the vEdge router establishes an IPsec tunnel to TLOCs over each transport. 
  9. BFD will then begin to work over these connections. 

 

#20 What is a Zero Touch Provisioning (ZTP) process?

  • ZTP is an automatic provisioning process. 
  • It starts when the vEdge router is powered on for the first time. 
  • The vEdge will then attempt to connect to a ZTP server with the host name ztp.viptela.com 
  • It gets the vBond orchestrator information from there. 
  • Once the information is received, it can then make connections with vManage and vSmart controllers to get full configuration. 
  • It then joins the overlay network. 

#21 Name the device template components.

The device plate section includes system, logging, OMP, AAA, BFD, security, archive and NTP feature templates. 

Transport and management VPN: 

  1. This region contains the templates used to configure VPN0 and VPN512. 
  2. It includes BGP, OSPF, VPN interface, VPN interface GRE and VPN interface PPP feature templates. 

Service VPN: 

  1. This region consists of the templates used to configure the service VPNs. 
  2. It consists of the BGP, IGMP, Multicast, OSPF, PIM, VPN interface, VPN interface bridge, VPN interface GRE, VPN interface IPsec, VPN interface Natpool and DHCP server feature templates. 

Additional templates: 

  1. This region includes banners. 
  2. It consists of Simple Network Management Protocol (SNMP), bridge, localized policy and cellular feature templates. 

#22 What is the traffic symmetry of DPI?

  • Deep Packet Inspection (DPI) is used by Application-Aware routing. 
  • It is responsible for matching applications within the policy. 
  • It is important for the vEdge router to see the traffic in both directions in order for DPI to classify most application traffic. 
  • It is not so possible for the traffic to be directed to the same vEdge router in both the LAN-to-WAN direction. 
  • It is preferred to set up routing so that the traffic prefers one vEdge over the other. This is helpful to maintain symmetric traffic. 

That’s All About It!

This list of the SD-WAN interview questions is evergreen. I recommend you to go through these questions thoroughly. This would also allow you to brush up on your SD-WAN concepts. 

A lot of candidates appear for the SD-WAN interviews yet they fail because they have weak basic concepts. I have especially emphasized the basic concepts of SD-WAN. 

Follow these SD-WAN interview questions and answers to clear your SD-WAN interview like a pro.  

I wish you all the best!

Preparing for an interview can be a little nerve-wracking. But we got you. 

]This blog consists of a detailed list of frequently asked SD-WAN questions and answers. If you have a month or even less than a month’s time to prepare for your dream interview, don’t worry.  

Nowadays, interviews are becoming a little tricky. Therefore, you need to have a good command over a subject to ace your interview.  

We have made a list of the top 20 questions regarding Cisco SD-WAN exam questions and answers. You can go through this exhaustive questionnaire to boost your interview prep. 

All kinds of important questions have been listed in this blog to help you with cracking your interview. 

Without further ado, let’s begin with our SD-WAN most-asked questions and answers.

Security Program Elements in CCNA: What You Need to Know

by
Security Program Elements in CCNA
Security Program Elements in CCNA

Until now, we have learned about various types of network security attacks that are commonly manifested in computer network systems. We eventually studied Network security and how it works. 

In the previous blog of our CCNA 200-301 series , we talked about the solid AAA framework for network security. I recommend you go through it before you jump to this blog. 

In this blog, we will learn the important security program elements that make a user aware of the protection against network cyber attacks. 

A security program is an enterprise’s set of security policies and procedures. For the CCNA 200-301 exam, there are a few elements you have to be aware of.

We will learn about the various security program elements in this blog. Most importantly, we will discuss the CIA model and its elements. Without further ado, let’s get started!

Various Security Program Elements in CCNA

A security program is an enterprise’s set of security policies and procedures. The following are the main security elements:

1. User awareness programs:

  • User awareness programs are designed to make employees aware of potential security threats and risks.
  • Not all employees are cybersecurity experts. Someone who works in the Marketing department is probably not aware of all the cyber threats the company is facing. So, user awareness programs will help make those employees aware.
  • For example, a company might send out false phishing emails to make employees click a link and sign in with their login credentials.
  • Although these emails are harmless, employees who fall for false emails will be informed that it is a part of the user awareness program and they must be more careful about phishing emails.

2. User training programs:

  • User training programs are more formal than user awareness programs.
  • For example, dedicated training sessions educate users on corporate security policies, how to create strong passwords, and how to avoid potential threats.
  • These should happen when employees enter the company and also at regular intervals during the year.

3. Physical access control:

  • Another essential element of a security program is physical access control which protects equipment and data from potential attackers by only allowing authorized users into protected areas such as network closets or data center floors.
  • This is not just to prevent people from outside of the organization from gaining access to these areas. In fact, access should be limited to those who need access even in the company.
  • Multifactor locks can protect access to these restricted areas.
  • For example, a door that requires users to swipe a badge and scan their fingerprint to enter.
  • Permissions of the badge can easily be changed, for example, permissions can be removed when an employee leaves the company.
  • This allows for strict, centralized control of who is authorized to enter where.

CIA Model: The Three Pillars of Security

The most important principle covered in the CCNA Security program (and the entire security certification track) is the three pillars of security. It refers to the CIA model. The three pillars of security are:

  •  Confidentiality
  • Integrity
  • Availability

These three principles form the foundation of any security system and must be taken into account when implementing and maintaining secure networks. Let us understand each one of them one by one.

1. Confidentiality:

  • Confidentiality is the protection of information from an unauthorized access. 
  • The goal is to ensure that only those individuals who intended to have access to the information are the only ones who have access. 
  • Access control policies and data encryption techniques are used to achieve this. 

2. Integrity:

  • Integrity is the assurance that the data stored and transmitted over a network is accurate and untampered. 
  • Integrity is maintained by techniques such as cryptographic hashing, digital signatures, and data leakage prevention. 

3. Availability:

  • Availability is the assurance that the data is available when needed.
  • Availability is achieved through various techniques, such as load balancing and redundant servers. 
  • The network must be working and available all the time and it must be strong enough to handle cyber attacks.

Cisco Security Products and Technologies

Cisco Security Products and Technologies include a wide range of products and services that assist organizations in meeting their security objectives. These products and services include:

  •  network security appliances
  • endpoint security solutions
  • cloud-based security solutions

1. Cisco Security Appliances:

  • Cisco Security Appliances, such as the ASA, ISR, and FTD, provide organizations with perimeter defense and internal segmentation. 
  • These devices can be configured to provide stateful packet filtering, application access control, and encrypted tunnels. 
  • They can also provide identity-based access control, web filtering, and advanced access control lists. 

2. Cisco Endpoint Security:

  • Cisco Endpoint Security Solutions help ensure that endpoint devices, such as computers and mobile devices, are securely managed and not vulnerable to external and internal threats. 
  • These solutions include discovery and protection tools, remediation tools, and patch and vulnerability assessments. 
  • Cisco Identity Services Engine (ISE) is a network access control solution that provides the ability to control access to the network based on group membership and user identity. 

3. Cisco’s Cloud Security Solutions:

  • Cisco’s Cloud security solutions enable organizations to identify, detect, and defend against threats and attacks in the cloud. 
  • These solutions include Cisco Cloudlock, which provides cloud-based security and the ability to detect malicious activity in the cloud. 
  • Additionally, Cisco has a suite of cloud-based threat defense solutions, such as Cisco Firepower, Umbrella, and ThreatGrid, that can provide organizations with the latest in threat intelligence and response capabilities.

The Cisco Self-Defending Network

The Cisco Self-Defending Network (SDN) is a comprehensive framework for secure network architecture and policy design. The Cisco SDN is comprised of various components, such as:

  •  Cisco Security Agents
  • Firepower
  • Identity Services Engine

These are designed to provide end-to-end visibility and control over a network. 

The Cisco SDN also includes the Network Access Control (NAC) framework, which is a policy enforcement mechanism that prevents devices from accessing the network if they do not meet certain criteria. 

The Cisco Security Agent is an endpoint security solution that is designed to protect endpoints from malware, malicious insiders, and other types of threats. It also provides proactive protection against data leakage and unauthorized access.

The Cisco Firepower solution provides organizations with advanced threat intelligence and response capabilities. Cisco Identity Services Engine (ISE) enables organizations to manage and enforce access control policies through identity-based access control. 

The Cisco Security Lifecycle

The Cisco Security Lifecycle is a step-by-step process that organizations can use to implement and maintain secure networks. 

The lifecycle consists of five phases: 

  • Assess
  • Plan
  • Design
  • Implement
  • Operate

Each phase has its own set of activities and objectives. 

1. Assess Phase:

During the assess phase, organizations evaluate their current security posture and define their security objectives. This phase is also used for risk assessment and vulnerability management. 

2. Plan Phase:

The plan phase consists of creating detailed security policies and procedures. In this phase, organizations also develop and document security architecture and design, as well as their budget and timeline for implementation. 

3. Design Phase:

The design phase is when organizations begin to implement the solution they have developed in the plan phase. This phase includes tasks such as selecting hardware and software, configuring devices, and setting up policies and procedures. 

4. Implement Phase:

The implement phase is when organizations deploy their security solution and complete the actual installation. This phase also includes testing and validation of the security solution. 

5. Operate Phase:

The operate phase is when organizations maintain and monitor the security solution they have implemented. This phase includes tasks such as auditing and logging, as well as training and awareness programs. 

Conclusion

So far, we have covered what is meant by security program elements and the various security program elements. We also discussed the most important security model, the CIA model which covers the fundamentals of network security.

We also discussed various products and technologies that can be used to secure a network. In addition, the Cisco Self-Defending Network and the Cisco Security Lifecycle provide individuals with an understanding of what is required to effectively design, implement, and maintain secure networks. 

By understanding the fundamentals of network security and mastering the tools and techniques used to protect networks, you can achieve the CCNA certification, and become a certified network security engineer.

Stay tuned for upcoming informative blogs for our free CCNA series.

 

Top Most-Asked Microsoft Azure Interview Questions and Answers

by
Azure Interview Questions
Azure Interview Questions

Cloud computing is a booming industry in tech. Almost every other person wants to enter the cloud industry. You can land your dream job in the cloud with Microsoft Azure. 

Microsoft Azure is one of the leading cloud service providers. It is the second most widely used cloud service provider after Amazon Web Services (AWS). Microsoft Azure is used by almost 80% of Fortune 500 companies. 

In this blog, we have compiled the top most asked Microsoft Azure Interview questions with answers. This will make it easy for you to prepare for the interview round. If you have previously worked on a Windows server, Microsoft Azure is the best cloud service for you to learn!

For easy learning, we have divided this blog into the following 4 sections:

  • Microsoft Azure Interview Questions for Beginners
  • Microsoft Azure Interview Questions for 3 Years Experience
  • SQL Azure Interview Questions 
  • Microsoft Azure Interview Questions for 5 Years Experience

Without further ado, let’s begin with the questions!

Azure Interview Questions for Beginners:

1. What is cloud computing?

  • Cloud computing refers to the delivery of computing services – including servers, storage, networking, software, databases, analytics and intelligence over the Internet. 
  • It is done with a motive to provide faster innovation, resources and economies at scale.
  • You can take advantage of many cloud computing services via the Internet.
  • You do need to maintain your own servers, you can use the infrastructure provided and maintained by third-party vendors such as Microsoft, AWS, Google, etc.
  • You can pay these vendors on the basis of the amount of time you use their servers, popularly known as the ‘pay-as-you-go’ model.

2. What is PaaS, SaaS and IaaS?

  • PaaS: It stands for Platform as a Service. It allows you to get a platform to deliver without giving authorization to the OS software.
  • SaaS: It stands for Software as a Service. It does not have platform infrastructure software that can be used without direct purchase.
  • IaaS: It stands for Infrastructure as a Service. It allows you to get the hardware from the provider as the desired service that can be configured by the user.   

3. What are the Azure Cloud services?

  • Azure cloud services are a great example of Platform as a Service (PaaS).
  • It is the best to support applications that need high scalability, reliability and availability with cost-effective solutions.
  • These applications are hosted on virtual VMs and Azure.
  • Azure cloud services are used for deploying multi-tier web-based applications in Azure.
  • Azure services help in easier and flexible scalability of the application.
  • Each role of cloud service has its own purpose and its own configuration files.

4. What is Azure Resource Manager?

  • Azure Resource Manager is the deployment and management service for Microsoft Azure. 
  • You can create, update and delete resources in your Azure account with the help of the management layer.
  • This is quite a useful feature when you need to do various tasks such as managing access controls, locks and making sure that the resources are secure after deployment.

5. What is a worker’s role?

Applications that are hosted within worker roles work asynchronous, long-running, or continuous tasks without the need for any user interaction or input.

6. What do you mean by diagnostics in Windows Azure?

  • Windows Azure Diagnostic provides the facility to store diagnostic data.
  • Data is stored in two forms in Azure. Some data is stored in a table while other is stored in a blob.
  • The diagnostic monitor runs in Windows Azure and in the computer’s emulator for collecting data for a role instance.

7. What is a command task in Microsoft Azure?

A command task is an operational window that creates the flow of either single or multiple common while the system is running.

8. What is Azure Active Directory (Azure AD)?

  • Azure AD is a cloud-based Identity and Access Management service.
  • Through this service, employees of an organization can access external resources like Microsoft 365, the Azure portal, and thousands of other SaaS applications.
  • You can also access apps on your corporate intranet network ad also other cloud apps developed for your own organization.
  • The Azure AD is used by IT admins, App developers and Microsoft 365, Office 365, Azure, or Dynamics CRM Online subscribers.

9. What is Azure Service Level Agreement (SLA)?

  • The SLA is a contract that makes sure that two or more role instances of a role are deployed on Azure, access to that cloud service is for sure!
  • It also states that if the role instance process is not in the running state then the detections of such processes will take place.
  • If these guarantees are not satisfied at any time then Azure credits a percentage of monthly fees to the user depending on the price model of the corresponding Azure services.

10. What are the instance types presented by Azure?

There are different types of instances on the basis of different needs they are useful in:

  • General purpose: CPU to memory ratio is balanced. It provides low to medium traffic servers, small to medium databases. It is the best for testing and development. Largest instance size: Standard_D64_v3 256 GB Memory and 1600 GB SSD Temp Storage
  • Compute Optimized: High CPU to memory ratio. It is the best for medium traffic web servers, application servers, and network appliances. Largest instance size: Standard_F72s_V2 144 GB Memory and 576 GB SSD Temp Storage
  • Memory-Optimized: High memory to CPU ratio. It works the best for relational database servers, in-memory analytics and medium to large sized caches.  Largest instance size: Standard_M128m 3892 GB Memory and 14,336 SSD Temp Storage
  • Storage-Optimized: It provides high disk IO and throughput. It is the best suited for Big Data, NoSQL and SQL databases. Largest size instance: Standard_L32s 256 GB Memory and 5630 GB SSD Temp Storage
  • GPU: These are the virtual machines (VMs) that have the heavy graphic rendering and video editing. It helps with model training and developing inferences with deep learning. Largest instance size: Standard_ND24rs 448 GB Memory and 2948 GB SSD Temp Storage 4 GPUs and 96 GB Memory
  • High-Performance Compute: It provides Azure’s fastest and most powerful CPU virtual machine with optional high throughput interfaces. Largest instance size: Standard_L32s 224 GB Memory and 2000 GB Temp storage

Microsoft Azure Interview Questions for 3 Years Experience:

11. What are the various types of storage offered by Azure?

Azure Blob Storage:

Azure Blob (Binary Large Object) storage allows users to store unstructured data that can include pictures, music, video files, etc. along with metadata.

  • It makes sure that the latest version of object is updated when it is changed.
  • It provides maximum flexibility to fulfil user’s storage needs.
  • REST-based object storage provides unstructured data.

Azure Table Storage:

Table storage allows users to perform deployment with semi-structured datasets and a NoSQL key-value store.

  • It is used to build applications that need flexible data schema.
  • It follows a strong consistency model, focusing on enterprises.

Azure File Storage:

It is file storage that offers file-sharing capabilities accessible by the SMB (Server Message Block) protocol.

  • The data is protected by SMB 3.0 and HTTPS
  • Azure manages hardware and Operating System deployments
  • It improves on-premises performance and capabilities

Azure Queue Storage:

Queue storage offers messages queueing for large workloads

  • It allows users to build flexible applications and separate functions
  • It makes sure that the application is scalable and less prone to individual components failing
  • It allows queue monitoring that makes sure that the customer needs are met

12. What options are available for deployment environments provided by Azure?

Azure provides two deployment environments. They are as follows:

  • Staging environment:
    • This type of environment is used for validating the changes of our application before making them go live in the main environment.
    • The application is identified through GUID (Globally Unique Identifier) of Azure which has a URL: GUID.clpudapp.net
  • Production environment:
    • This is the main environment for the applications to go live and can be accessed by the target audience.
    • It can be accessed by means of DNS friendly URL: appName.cloudapp.net

13. What is cspack in Azure?

  • Cspack is a command-line tool.
  • It is used for building service package foles.
  • It also helps in preparing the application for deployment in Microsoft Azure or computer emulator.

Cspack tool is used to create .cscfg file which is a cloud service configuration file. It is mainly used to store the following:

  • Number of role instances for the deployment of each role in the project.
  • The thumbprint of the certificates.
  • User-defined configuration and settings.

14. How to create a VM in Azure CLI?

This is how you can create a VM in Azure command-line:

Az vm create ‘

— resource-group myResourceGroup ‘

–name myVM –image win2016datacenter ‘

– -admin-usename Azureuser ‘

– -admin-password myPassword12

15. How to secure Azure Functions?

You can secure Azure functions through the following:

  • Security Center
  • Log and monitor
  • HTTPS
  • Functions access keys
  • Authentication /authorization
  • Permissions
  • Secret management
  • Data validation
  • Set up usage quotas
  • Error handling
  • Store the data encrypted
  • Restricted CORS access
  • Disabled remote debugging
  • Deployment credentials
  • Disabled FTP
  • Secure scm endpoint
  • Continuous security validation
  • Network security

SQL Azure Interview Questions:

16. What is SQL Azure?

  • SQL Azure is a cloud-based relational database.
  • It is presented by Microsoft itself.
  • The service is based on SQL server technology.

17. How many replicas are maintained for each SQL Azure database?

Three replicas can be maintained for each SQL Azure database. One of them is a primary replica. It must be noted that when one replica goes down another replica is promoted.

18. What is SQL Server on Azure VM and what are its use cases?

With the help of SQL Server on Azure Virtual Machines (VMs), users can deploy full version of SQL server without managing any underlying infrastructure. The only difference in managing on-premise SQL Server and SQL Server on Azure VM from DBA point of view is that the virtual machine is now in Azure infrastructure cloud.

We can use the SQL Server on Azure VM in the following cases:

  • If we want complete control of SQL Server similar to on-prem SQL instance.
  • If we use features not supported by Azure SQL Database, Azure managed instance.
  • In cases of legacy applications migrations to Azure
  • In the cases of lift-and-shift cloud migrations
  • Extending on-prem Environments to the cloud
  • Development and Test Environments

19. When can the workload on SQL schedule get throttled?

If the database reaches the maximum size then the operations for insert, update, and create will get throttled. Yet, there are policies that do not allow the workload to exploit the shared physical server.

20. What are the limitations of SQL Azure database size at the time?

Currently, the maximum SQL Azure database size can be 250 GB (s0, s1, s2 and s3) or 500 GB (p1, p2, p3 and p6) or 4tb (p11 and p15).

Microsoft Azure Interview Questions for 5 Years Experience:

21. What is Azure App Service?

  • Azure App Service is a managed Platform-as-a-Service (PaaS) offering for developers that have a number of arrangement of abilities to the web, mobile and integration scenarios. 
  • Mobile apps in Azure App Service provide a very adaptable, universally accessible mobile application development platform for Enterprise Developers and System Integrators.

22. What is meant by Azure Scheduler?

Azure Scheduler helps us to implement certain background trigger events or activities like calling HTTPS/S endpoints or to present a message on the queue on any schedule.

With the help of using Azure Schedule, the jobs present in the cloud call services present within and outside of the Azure to execute those jobs on-demand that are routinely on a repeated regular schedule or start those jobs ar a future specified date.

23. What are the differences between the Azure Table Storage and the Azure SQL service?

The difference between Azure Table Storage and Azure SQL Service are as follows:

Table Storage Service

Azure SQL Table

1. It has a NoSQL type of storage on Azure.

1. It has a relational storage structure on Azure.

2. The data is stored in key-value format and is called Entity.

2. The data is stored in rows and columns combination in an SQL table.

3. The data schema is not enforced for storage.

3. The data schema is enforced for storing data. Error occurs if schema is violated.

4. The partition and row key combination are unnique for each identity.

4. With the help of primary or unique key, uniqueness can be defined.

5. There is no relationship between tables.

5. Relationship between tables can be created with the help of foreign keys.

6. The table storage service can be used gor storing log information or diagnostics data.

6. The Azure SQL table can be used for transaction-based applications.

 

24. What is dead letter queue?

Messages are placed on the dead-letter sub-queue by the messaging sstem in the following cases:

  • Dead-lettering for expired messages is set to true in a queue or subscription when a message expires.
  • When the max delivery count for a message is surpassed on a queue or subscription.
  • When a filter evaluation exception happens in a subscription and dead-lettering takes over on filtering evaluation exceptions.

25. What feature of Azure can stop the issue of high load on the application when there is no man support on the flow?

The issue can be stopped by using VM Scale sets. It is done so by defining proper configuration and conditions to provide a new VM when the load to the application increases.

  • Azure VM Scale Sets allows the developer to create and manage a group of VMs that are load balanced.
  • They scale sets can be configured to increase or decrease the count of VMs based on the application demand or on the basis of a pre-defined schedule.
  • Scale sets ensure high availability of applications. It lets developers to manage, update and configure large VMs centrally.
  • They also support the development of large-scale applications that support Big Data, compute and big workloads.
  • Azure scale sets can support up to 1,000 VMs. In case of custom VM images, the limit i 600 VMs.

FAQs:

Cloud computing refers to the delivery of computing services – including servers, storage, networking, software, databases, analytics and intelligence over the Internet. It is done with a motive to provide faster innovation, resources and economies at scale.

Microsoft Azure is Microsoft’s public cloud computing platform that provides a range of cloud services such as analytics, storage, compute and networking.

Azure mainly has fully managed relational, NoSQL and in-memory databases.

Azure AD is a cloud-based Identity and Access Management service. Through this service, employees of an organization can access external resources like Microsoft 365, the Azure portal, and thousands of other SaaS applications.

  • Azure cloud services are a great example of Platform as a Service (PaaS).
  • It is the best to support applications that need high scalability, reliability and availability with cost-effective solutions.
  • These applications are hosted on virtual VMs and Azure.

Azure SQL database is a fully managed Platform as a Service (PaaS) database engine.

  • SQL Azure is a cloud-based relational database.
  • It is presented by Microsoft itself.
  • The service is based on SQL server technology.
  • Cspack is a command-line tool.
  • It is used for building service package foles.

The Ultimate Guide to AAA Framework in Network Security

by
AAA framework
AAA framework

Information security has become one of the most important aspects of business in the modern world. With the rise of the internet and the increase in connected devices, businesses must be very careful in protecting their data. One of the most important tools in protecting data is the AAA framework.

AAA stands for Authentication, Authorization, and Accounting. It is a very important security framework for controlling and monitoring users of a computer system such as a network. Its major purpose is to manage networks and cybersecurity by keeping a track of the activities of users while they are connected to a network.

In this blog, we will provide a comprehensive guide to AAA in network security. We will cover the importance of the AAA framework, the types of AAA protocols, the benefits of AAA, and how to implement AAA in your own network security system.

Note: If you haven’t read the previous blog of our CCNA 200-301 series, I highly recommend you do so.

Why is AAA Important?

AAA is an important part of network security because it ensures that only authorized users can access the data that is being protected and that data is only used for authorized purposes. 

The AAA framework also provides a record of all the activities that have taken place on the network, which can then be used for security audits and investigations. The framework helps to ensure that any unauthorized access is detected and prevented. 

The AAA framework is also important because it provides data security. The use of authentication, authorization and accounting protocols helps to ensure that data is kept secure and only accessed by those who have been given permission to do so. 

The framework also provides a way to audit data usage and processes, which can help businesses to ensure data compliance.

What is AAA?

AAA stands for Authentication, Authorization, and Accounting. 

It is a framework for network security that provides a structure for businesses to follow in order to ensure the security of their network. It performs three major functions:

  • It is a framework that helps to ensure that only authorized users can access the protected data.
  • It makes sure that the data is only used for authorized purposes. 
  • It also keeps a record of all the activities that have taken place on a computer network.

The Three Components of AAA

Let us learn about the three main components of AAA.

  • Authentication:

Authentication is the process of cross-checking and authenticating the identity of a user. It involves using various methods such as passwords, biometrics, or tokens to verify that the user is who they say they are. 

It is the process of granting access to the network. It involves granting permissions to a user to view and manipulate certain data and resources. This can be done manually or automatically via a rules-based system.

  • Authorization:

Authorization is the process of granting access to the network. It involves granting permissions to a user to view and manipulate certain data and resources. This can be done manually or automatically via a rules-based system. 

It occurs after authentication. The AAA matches the user’s entered credentials to its database being an Identity and Access Management (IAM) tool. Therefore, it checks the username and password.

  • Accounting:

Accounting is the process of keeping a record of all activities that have taken place on the network. It occurs after the authorization process is done.

This includes all user activity and access to data and resources. It keeps a record of the following  metrics:

  • For how long the user logged in
  • The data he sent and received in that online session
  • It saves his Internet Protocol (IP) addresses
  • It also records the Uniform Resource Identifier (URI) he used
  • It also tracks the various services it accessed

These records can then be used to investigate suspicious activity and audit the network for compliance. 

Implementing AAA Framework

Implementing a AAA framework in your network security system can be a challenge. There are many different aspects that work into the process, such as:

  •  The various authentication methods
  • Setting up authorization rules
  • Setting up accounting protocols

Choosing the authentication method:

First, you will need to decide which authentication methods you will use. This will depend on the level of security you need and the type of data you are protecting. Possible authentication methods include passwords, tokens, biometrics, or a combination of all three. 

Setting up authorization rules:

Next, you will need to set up the authorization rules for granting access to the network. This involves deciding who has access to which data and resources, and how they are allowed to use them. 

Setting up accounting protocols:

Finally, you will need to set up an accounting system to keep a record of all activities that have taken place on the network. This includes all user activity and access to data and resources. This record can then be used to investigate suspicious activity and audit the network for compliance.

Types of AAA protocols

Enterprises generally use a AAA server to provide AAA services. For example, ISE (Identity Services Engine) is Cisco’s AAA server. 

These AAA servers typically support the following two AAA protocols:

RADIUS:

  • It is an open-standard protocol. 
  • It uses UDP ports 1812 and 1813.
  • It stands for Remote Authentication Dial-In User Service (RADIUS).
  • It carries out AAA functions for users that are accessing a remote network.
  • It also encrypts the AAA packets for maximum network security.

TACACS+:

  • It is a Cisco-proprietary protocol.
  • It uses TCP port 49.
  • It stands for Terminal Access Controller Access-Control System Plus (TACACS+).
  • It controls how the commands get authorized.
  • It provides a secret key that is only known by the TACACS+ server and the client.
  • The connection is allowed to be established only when a valid key is entered.

Diameter:

  • It does not work on the client/server model like RADIUS and TACACS+.
  • It is a newer and better version of RADIUS.
  • It supports the framework of the following devices:
    • Long-Term Evolution (LTE)
    • Multi-media networks such as Voice Over Internet Protocol (VoIP)
    • Mobile devices

Benefits of AAA Framework

The following are the benefits of the AAA framework:

  • The main benefit of the AAA is that it provides a comprehensive framework for network security. 
  • It helps to ensure that only authorized users can access the data that is being protected and that data is only used for authorized purposes. 
  • The AAA framework also provides a record of all the activities that have taken place on the network, which can then be used for security audits and investigations. 
  • Additionally, the framework makes it easier to keep data secure and to enforce data compliance. 
  • The use of the AAA framework also helps to improve the overall security of the network.
  • The various authentication, authorization, and accounting protocols help to ensure that unauthorized access to the network is detected and prevented. As a result, businesses can have peace of mind that their data is safe and secure.

Conclusion

AAA is an important part of network security. The AAA framework is an invaluable tool for businesses to ensure the security and compliance of their data.

It provides a framework for businesses to follow in order to ensure the security of their network. The framework helps to ensure that only authorized users can access the data that is being protected and that data is only used for authorized purposes. 

It also provides a record of all the activities that have taken place on the network, which can then be used for security audits and investigations. 

In the upcoming blog, we will learn about the security program elements. If you want to learn more about basic network security, you can check our previous blog.

Stay tuned for upcoming informative blogs for our free CCNA series.

 
 

CCNA INTERVIEW QUESTIONS & ANSWERS

by
CCNA Interview Questions and Answers
CCNA Interview Questions and Answers

Looking for the CCNA interview Questions to prepare for the CCNA interview? Well, you have landed to the very right place. Cisco Certified Network Associate popularly known as CCNA is a certification exam that qualifies IT professionals to perform various entry-level tasks within the IT industry. The CCNA certification deals with validating the skill, ability and expertise of an individual to fix, configure and troubleshoot networks. 

In this blog we have listed the most frequently asked CCNA interview questions and answers to ace your interview with confidence.

Download PDF

CCNA Interview Questions - for Beginners

#1. What is routing?

Routing is the process of finding the right path for transferring data from the original source to the destination. Routing is carried by using a device known as a route, which is a network layer device.

Cisco configure static routing.

#2. How many layers are there in an OSI reference model? Name them.

There are 7 layers in an OSI (Open Systems Interconnection) reference model. They are:

  1. Physical layer
  2. Data link layer
  3. Network layer
  4. Transport layer
  5. Session layer
  6. Presentation layer
  7. Application layer
Explain the OSI Reference Model.

#3. Explain HDLC.

HDLC (High-Level Data Link Control) is a group of communication protocols that usually provides reliable delivery of data frames over communication or network link.  It is a proprietary protocol for CISCO and is the default encapsulation operated within CISCO routers. It also ensures the error-free transmission of data and can provide both connection-oriented and connectionless services. 

#4. What is CDP?

CDP, short for “Cisco Discovery Protocol,” is a layer 2 protocol that works on a Media Access Control (MAC) address. CDP may be used to identify port numbers, iOS details, router models, device IDs, and switch models.

#5. What is BootP?

BootP, short for “Boot Program,” is a protocol that is mostly used to boot diskless work areas that are connected to one network. A diskless workstation may also use BootP to determine its IP address and the IP address of the server PC.

#6. What is the purpose for the Data Link layer?

The data link layer of the OSI model (Layer 2), prepares network data for the physical network. The data link layer is responsible for network interface card (NIC) to network interface card communications. Along with this the data link layer serves the following purposes:

 

  • Enables upper layers to access the media. 
  • Accepts data, usually Layer 3 packets (i.e., IPv4 or IPv6), and encapsulates them into Layer 2 frames.
  • Controls how data is placed and received in the media.
  • Exchanges frames between endpoints over the network media.
  • Performs error detection and rejects any corrupt frame.

#7. What does the LLC sublayer do?

Logical Link Control (LLC) is a sublayer usually providing the logic for the data link as it controls the synchronization, multiplexing, flow control, and even error-checking functions of DLL (Data Link Layer). DLL is divided into two sublayers i.e. LLC sublayer and MAC (Medium Access Control) sublayer.

#8. What is MTU?

A maximum transmission unit also called MTU defines the largest size of the packet that can be transmitted as a single entity in a network connection. The size of the MTU defines the amount of data that can be transmitted in bytes over a network.

#9. What is the role of the LLC sublayer?

The LLC sublayer stands for Logical Link Control. It can provide optional services to an application developer. One option is to provide flow control to the Network layer by using stop/start codes. The LLC can also provide error correction.

#10. What is OSPF? Describe it.

OSPF stands for Open Shortest Path First. It uses the Dijkstra algorithm and is a link-state routing protocol that is used to connect to a large number of networks without having any limitation on the number of hops.

#11. What is subnetting?

What is subnetting?

Subnetting is when smaller networks are created from a larger parent network. Each subnet is given an identifier or certain parameters within the network to indicate its subnet number.

#12. Give some benefits of LAN switching.

– allows full-duplex data transmission and reception

– media rate adaption

– easy and efficient migration

#13. Define ARP.

The Address Resolution Protocol is a communication protocol used for discovering the link layer address, such as a MAC address, associated with a given internet layer address, typically an IPv4 address. This mapping is a critical function in the Internet protocol suite.

#14. What is Spanning Tree Protocol?

Spanning Tree Protocol (STP)

Spanning Tree Protocol (STP) is a protocol which prevents layer 2 loops. STP enables switches to become more aware of each other so that they can negotiate a Loop-free path through the network. It chooses a reference point (Route Bridge) in the network and calculates all the paths that are no longer useful (known as redundant links) to that reference point. Then it selects one path to forward frames and blocks other redundant paths. When blocking happens, loops are prevented.

#15. Define Network Congestion.

Network congestion refers to a reduction in quality of service (QOS) that causes packet loss, queueing delay, or the blocking of new connections. It occurs when the traffic flowing through a network exceeds its maximum capacity meaning when a link or network node is handling data in excess of its capacity.

 

Effects of network congestion :

  • Queueing delay
  • Packet Loss
  • Slow Network
  • Blocking of new connections
  • Low throughput

Ways to fix network congestion :

  1. Divide your network into subnets that can be resized to meet traffic.
  2. TCP/IP settings should be adjusted to balance packet send/request speeds.
  3. Upgrade your Internet plan to allow for more devices and increased bandwidth.

#16. What is the difference between User Mode and Privileged Mode?

User Mode is commonly utilized for performing regular tasks on a CISCO router. For example, User Mode may be used to connect to remote devices or check the status of a router. 

Privileged Mode is used to perform higher-level tasks on the router such as debugging and making configurations. Privileged Mode also includes all of the options that are available for use in User Mode.

#17.What is a MAC address?

A MAC address is the abbreviation for a Media Access Control address. This address is the identification used to depict a media access control layer in a network’s architecture. It’s most commonly stored in the ROM and is different for each device.

#18. What is EIGRP?

EIGRP stands for Enhanced Interior Gateway Routing Protocol; it is a routing protocol designed by Cisco Systems.  It is available on a router to share routes with other routers within the same autonomous system. Unlike other routers like RIP, EIGRP only sends incremental updates, decreasing the workload on the router and the amount of data that needs to be transferred.

EIGRP protocol consists of :

  • Bandwidth
  • Load
  • Delay
  • Reliability
  • MTU
  • Maximum Transmission Unit

#19. What are the different memories used in a CISCO router?

Different memories used  in a CISCO router are:

– NVRAM stores the startup configuration file.

– DRAM stores the configuration file that is being executed.

– Flash Memory – stores the Cisco IOS.

#20. What is the function of the Application Layer in networking?

The Application Layer supports the communication components of an application and provides network services to application processes that span beyond the OSI reference model specifications. It also synchronizes applications on the server and client.

Check Live Free Webinar

CCNA Interview Questions - for Experts

Qus1:-What does cat stands for in networking?

 Ans :- Cat stands for “CATEGORY“. Which started from Cat1 (Category1) and now extend up to Cat7 (Category 7). Improved version/category of cable improve the quality of data transmission and make enhancement in bandwidth .provide more stability.

Cat 1 ? used for voice only

Cat 2 ? used for voice telephone & data communication, maximum?bandwidth?is 4?Mbit/s.?Cat?2 cable contains 4 pairs of wires, or 8 wires total.

Cat 3 – used for voice & data communication .Category?3 cable, commonly known as?Cat 3?or?station wire .carry data up to 10?Mbit/s.

Cat 4 – It is used in telephone networks which can transmit voice and data up to 16?Mbit/s

Cat 5 – The cable provides performance of up to 100?MHz and Cat?5 is also used to carry other signals such as?telephony and?video.Cat5 does not support exact 100 MHz . but Cat5e provide exact 100 MHz bandwidth.

Cat 6 ? It increase the performance of up to 250?MHz compared to 100?MHz for Cat?5 and Cat?5e.

Cat7– ?Ethernet cable is the newest cable category, operating at speeds of 10 Gb/s at 100 meters of cable and transmitting frequencies up to 600 Mhz.

cat stands for in networking

Qus2 :- What is APIPA

Ans :- Automatic Private IP addressing with this , A DHCP client can automatically configured an IP address & subnet mask when no DHCP server is available .

It was random address ranging of Class B from 169.254.0.1 to 169.254.255.254 . default subnet mask of 255.255.0.0

Qus3 :- Private IP Address Range of IPV4

Ans :- 3 group of Private IP addresses —-

Class A ? 10.0.0.0 to 10.255.255.255.254

Class B ? 172.16.0.0 to 172.31.255.254

Class C ? 192.168.0.0 to 192.168.255.254

Qus3 :- Private IP Address Range of IPV4

Qus4 :- Broadcast Domain and Collision Domain

Ans :-

HUB? Single Broadcast Domain and Single Collision Domain

SWITCH? Single Broadcast Domain and Multiple Collision Domain. But can also separate Broadcast Domain by using VLAN’s

ROUTER? Multiple Broadcast and Multiple Collision Domain

Qus5:-What is cat stands for in networking?

Ans:-?A?collision domain?is a network segment with two or more devices sharing the same bandwidth (where there is a chance of collision)

A?broadcast domain?is a logical division of a computer network, in which all nodes can reach other by broadcast at the data link layer.

Qus6:- OSI and TCP/IP Model

Ans:- OSI stands for Open System Interconnection developed by International Standard Organization ISO . It is just a reference model.

Consist 7 layers which has bottom to top approach ?

  • Application Layer
  • Presentation Layer
  • Session Layer
  • Transport Layer
  • Network Layer
  • Data Link Layer
  • Physical Layer

TCP/IP came 10 years before then OSI Model and it actually works in real scenarios.

Consist 4 layers —

  • Application Layer
  • Transport Layer
  • Internet layer
  • Network Interface layer/Link Layer /Network Link Layer
OSI and TCP/IP Model

Qus7:- Port numbers of TCP and UDP Protocole

Ans:- Server provide their services on the basis of port numbers .we have two types of connections ?

Transmission control protocol (TCP) & User datagram Protocol (UDP)

TCP ? Connection Oriented

  • File Transfer Protocol (FTP) ? 21
  • Hypertext Transfer Protocol (HTTP) — 80
  • Hypertext Transfer Protocol Secure (HTTPS)– 443
  • Secure Shell -22
  • Telnet ? 23
  • Simple Network Management Protocol (SNMP? 161/162
  • SMTP – 25
  • DNS-53
  • Internet Message Access Protocol (IMAP)? 143
  • Border Gateway Protocol (BGP) — 179

UDP ? Connection Less

  • Domain Name System (DNS) ? 53
  • Dynamic Host Configuration Protocol (DHCP) ? 67/68
  • Trivial File Transfer Protocol (TFTP) ? 69
  • Network Time Protocol (NTP) ? 123
  • Simple Network Management Protocol (SNMP) ? 161/162

Qus8:- What is Firewall ?

Ans : – Firewall is a network security device or network security systemwhich help to provide security to intranet (private Network) . So, that not any unauthorized user can enter into their area .we can also apply security on routers (networking device) as well but only for some extend. Routers provide very less security (Layer 3 device, work on Internet Layer).

Firewall separate the internal (private) & external (public) network.It establishes a barrier between a trusted internal network and untrusted external network.

Firewalls can be either hardware or software or combination of both.

Types of firewall —

network firewalls?or?host-based firewalls

list of some company who provide?Network Security Services&?Appliances

firewall networking

Qus9:- What is Router ?

Ans:- Router is L3 -Network Layer device . it basically use for routing purpose . every router has it’s own brain . they choose the best path from source to destination by checking the information/best suitable path in their routing information table(RIB).

Types of Routing ?

  • Static Routing
  • Default Routing
  • Dynamic routing
  • Interior gateway routing protocol
  • Distance vector routing

    RIP,RIPV2

    Link state routing

    OSPF ,IS-IS

    Advance Distance vector routing

    EIGRP (extended version of IGRP)

  • Exterior gateway routing protocol
  • BGP

Qus10:- Difference between OSPF multicast address 224.0.0.5 and 224.0.0.6?

Ans:- 224.0.0.5 – AllSPFRouters: Used to send OSPF messages to all OSPF routers on the same network. The AllSPFRouters address is used for Hello packets. The DR and BDR use this address to send Link State Update and Link State Acknowledgment packets.

224.0.0.6 – AllDRouters: Used to send OSPF messages to all OSPF DRs (the DR and the BDR) on the same network. All OSPF routers except the DR use this address when sending Link State Update and Link State Acknowledgment packets to the DR.

Qus11: - AD value of Dynamic Routing Protocols -- RIP, EIGRP &OSPF.

Ans :-Admistrative Distance (AD) Value of RIP is 120 with maximum of 15 hop count as linear .Broadcast address of RIPV1 is 255.255.255.255 and it doesn’t carry the subnet mask value .Multicast address of RIPV2 is 224.0.0.9 and it does support subnetting .RIP Timers are ? update timer ? 30 sec , invalid timer/hold down timer ? 180 sec and last one flush timer is 240 seconds .

AD value of EIGRP is 90 and multicast address is 224.0.0.10.It maintain the 3 tables ? Teighbor table , topology table and Routing table .

Packet types are ?

  • Hello pkt ? 5 sec
  • Update pkt ?15 sec
  • Query
  • Reply
  • Acknowledgment

It uses Reliable Transport Protocol with 88 protocol number

AD value of OSPF is 110 and multicast address is 224.0.0.5 &224.0.0.6 .It maintain the 3 tables ? Neighbor table , Database table and Routing table .

Packet types are ?

  • Hello pkt
  • DBD (Data Base Description)
  • LSR (Link State Request)
  • LSU (Link State Update)
  • LSA (Link State Acknowledgment)

Less AD value is always reliable/preferable. 

AD value of Dynamic Routing Protocols -- RIP, EIGRP &OSPF.

Qus12:- How many States are there in OSPF ?

Ans:-OSPF has to go through 7 states in order to become neighbors. There are 8 states in OSPF.

  • DOWN
  • INIT
  • 2-WAY
  • ExSTART
  • EXCHANGE
  • LOADING
  • FULL

Qus13:- Maximum HOP Count in RIP, EIGRP and OSPF

Ans:-RIP , EIGRP and OSPF all three are Dynamic Routing Protocol .

  • RIP Maximum hop count value is 15 as linear
  • EIGRP Maximum hop count value is 255
  • OSPF can use unlimited number of hop counts, but it is recommended to use
  • Maximum up to 100 hop count.

Qus14:- Which protocol support equal and unequal load balancing?

Ans : – EIGRP support Equal and Unequal load balancing , RIP and OSPF only support Equal load balancing .

Qus15:- Router-ID selection in OSPF

Ans :- the highest IP address of the active physical interface of the router is Router-ID .

If logical interface loopback is configured ,the highest IP address of the logical interface is Router-ID .

Physical interface can down any time but logical not .

If we add one more loopback 20.1.1.1 higher than 1.1.1.1, here 20.1.1.1 will become your Router-ID

Qus16 :- EIGRP work on which algorithm and it's metric calculation

Ans:- EIGRP work on Defusing Update Algorithm (DUAL)

Metric Calculation formula —

  • 10^7/(Min Bandwidth)
  • Sum of delays/10
  • Metric =( Bandwidth + Delay)*256

Qus17:- Working of Switch

Switch is an interconnecting device with 16 or 24 ports in common. All other devices are connected to these ports. Whenever any machine sends packet to any other machine, source machine send packet to switch, switch then forwards it to destination machine. Each packet which comes to switch contains source and destination physical address in it, on basis of which switch forwards packet to other machine. Switch always sent packet based on destination MAC address. Its process is as follows:

(process also known as Switching)

1. When switch receives a packet from any device, it checks for its destination MAC address.

2. Then switch compares destination MAC address with its MAC Address Table for corresponding MAC address.

a. If MAC Address is found, packet is sent out to port against which MAC Address was matched.

b. If entry is not found, Unknown unicasts (when the switch doesn’t have a port mapping for a destination mac address in the frame) are treated like broadcasts by Layer Two devices, and are flooded out of all ports except the port on which the frame originated.

Now question comes, how does switch knows on which port destination machine is connected? — For this switch uses one table in its cache memory called MAC Address table or Forwarding Table in which switch stores that at which port which machine is connected by storing its physical address (MAC Address). So table contains two columns (Physical Address and Port Number) and rows equal to number of ports in switch.

When switch is turned ON, by default there is no entry in MAC address table, as communication starts, based on devices involved entries are created in table.

Working of Switch

Qus18:- Working of Address Resolution Protocol (ARP)

ARP is a layer 2 protocol, used for obtaining MAC address of any devices within a network. Host machines use ARP protocol to obtain MAC Address. ARP protocol in conjunction with Layer 3 IP Protocol addressing (IP Address).

Host machine uses ARP because when machine needs to send packet to another device, destination MAC address is needed to be written in packet sent, so host machine should know the MAC Address of destination machine. Operating Systems also maintain ARP Table (MAC Address Table).

To obtain MAC address, ARP performs following process: (ARP request by host machine)

1. Source machine generate ARP REQUEST packet with source MAC address (of this machine), source IP address (of this machine) and destination IP address and forwards this packet to switch.

2. Switch receives the incoming packet and reads the source MAC address and checks its MAC address table, if entry for packet at incoming port is found then it checks its MAC address with the source MAC address and updates it, if entry not found then switch add and entry for incoming port with MAC address.

3. All ARP REQUEST packets are broadcasted in network, so switch broadcast ARP REQUEST packet in network, because destination for ARP packet will be 255.255.255.255. (Broadcast are those packets which are sent to everyone in network except the sender, only in network to which it belongs, it cannot span multiple networks)

4. All devices in network receives ARP packet and compare their own IP address with the destination IP address in that packet.

5. Only the machine which matches the both will reply with ARP reply packet. This packet will have source IP of this machine (which was destination machine in previous packet, as now its replying this machine will be the source machine) , source MAC address, destination MAC address (same as source MAC address in REQUEST packet) and destination IP address (same as source IP address in REQUEST packet).

6. Then switch reads the ARP reply message and add entry in its MAC Address Table for port number on which it has received packet by reading its source MAC address field and forwards that packet to destination machine (source machine in REQUEST packet) as its MAC is indestination MAC address.

7. Further host machine add destination machine entry into its ARP table. This using ARP resolution switch and other devices in network obtain MAC address of any other device in a network. Remember ARP works on broadcast, so it works only in single network.

Qus19:- Difference between access link and trunk link ?

Ans :-Access link ? access link carry only one VLAN information .It does not tag the frame . Mainly this link is established in between computer/PC/Node and Switch.

Trunk Link ? trunk link carry information of multiple VLAN’s. It tags the frame. So, that receiving switch would know which VLAN’s information it has carried and transfer/pass that information accordingly.Mainly this link is established in between the Switches.

Qus20 :- Native VLAN

Ans :- Native VLAN is the only VLAN which is not tagged in the trunk. Native VLAN frames are transmitted unchanged .by default VALN 1 is the NATIVE VLAN. if your switch receives a frame with no VLAN information , it assumes this frame belongs to the NATIVE VLAN .

Types of VLANs ?

  • Default VLAN

  • Native VLAN

  • DATA VLAN

  • VOICE VLAN

  • PRIVATE VLAN

  • MANAGEMENT VLAN

Qus 21: – If on 2 switches different VLAN’s are configured and have access link between the switches. Can the PC’s ping each other?

Ans :- They both can ping each other.The issue is that the switch interlink are both access ports. An access port will not send or accept tagged traffic. Hence when SW1 sends PC1’s traffic over the link, the tag is removed. When that packet comes into SW2’s fa0/8 interface, that interface is part of vlan 20. SW2 will allow that frame to flow to PC2. The same happens vice-versa.

Qus22: - Trunking protocols

Ans : – There are two trunking protocols ?

ISL and IEEE DOT1Q/802.1Q

ISL ? Inter Switch Link is Cisco proprietary protocol. That is 30 bytes in length. It add 30 bytes info in it’s frame that obviously increase the size of frame. Even cisco also recommend to use IEEE 802.IQ for encapsulation.

IEEE DOT1Q/802.1Q ? It is open standard .defined by IEEE . All vendor support this .it add 4 byte tag to the original frame .it doesn’t tag frames that belong to native VLAN.

Trunking protocols

Qus23 :- Why VTP is needed ? Their modes and which mode use extended vlan ?

Ans :- Virtual Trunking Protocol use for propagate VLAN Database . Database creates in Vlan.dat file and store in flash memory.

VTP Modes ?

Client Mode ? can not use extended vlan .

Server Mode ?can not use extended vlan , by default VTP is in server mode

Transparent Mode ? can use extended vlan ranges from <1006-4096>

Off Mode ? VTP Off

Qus24 :- DHCP

Ans :- DHCP stands for Dynamic host configuration protocol , It assign IP addresses to node/computer/PC automatically .It work on Discover offer request acknowledgment DORA process. It is a UDP connectionless and support port number 67/68 .

Qus25:- PC/Computer/Node doesn't not have an IP address how it will contact DHCP server?

Ans :- PC/Computer/node will send request to all the connected devices via broadcast but only the DHCP server will accept this request and assign IP address from pool to the system . It works on “DISCOVER OFFER REQUEST ACKNOWLEDGMENT (DORA) “Process.

Qus26:- What is NAT?

Ans :- “ Network Address Translation“ It is a process where a network device , usually a firewall , assign a public address to a computer (or group of computers )inside a public network (intranet).

The main use of NAT is to limit the no. of public addresses an organization or company must use for both economy and security purpose.

It allow multiple private IP addresses to represent into by a smaller number of public IP addresses.

Types of NAT

  • Static NAT
  • Dynamic NAT
  • Port Address Translation PAT

Qus27:- In Ether Channel /Port Channel /Link Aggregation, two switches are connected. On one switch lacP is running and on another switch pagP is running. Will they be able to establish communication?

Ans :-
“NO” all ports in an ether channel must use the same protocol , you can not use two protocols on two ends . In other words pagP and lacP are not compatible so , both ends of a channel must use the same protocol .

Qus28:- Main difference between Standard and Extended Access- list? How packet filtering is done?

Ans :- Access-List provide L3 security. There are of 2 types ACL’s

  1. Numbered
  2. Named
  • Numbered Standard Access list range is from 1-99
  • It blocks a network, host and subnet.
  • All services are blocked
  • Implement closest to the destination
  • Packet filtering is based on only source IP address.
  • Numbered Extended Access list range is from 100-99.
  • Can block a network, host, subnet and services.
  • Can block any specific service as per requirement
  • Implement closest to the source
  • Packet filtering is based on source, destination address and protocol and port number.

“Named Access-List mainly preferable because it has editing feature”

Qus29:- IPV4 and IPV6 address types

Ans : – IPV4 —

  • Broadcast
  • Multicast
  • Unicast

IPV6 ?

  • Multicast
  • Unicast
  • Anycast ? Good feature in IPV6

“IPV6 is 128 bit long , having 8 octets/blocks . Each block contain 16 bits . It got implemented to reduce address shortage in IPV4” IP address is given to every device in the network and it is used to identify the device with in the network.

Qus30:- STP States and how Root Bridge, Root port and Designated Port got select?

Ans : – Spanning Tree Protocol is a loop prevention technique defined by IEEE 82.1d .Switches run STP by default , Switches use spanning tree algorithm STA to decide which port should be shut down.

STP States ?

  • Disable
  • Blocking
  • Listening
  • Learning
  • Forwarding

The selection of Root Bridge is based on Bridge_ID , Bridge_ID consist bridge priority and MAC address .by default priority is 32768. If all switches have same priority then root bridge selection will be based on MAC address. Bridge_ID go in BPDU packet. Every switch share Bridge protocol data unit (BPDU) after 2 seconds.

All ports of Root Bridge are designated ports

The ports that are connected directly with Root Bridge become root port.

Convergence time of STP is 32 seconds

Basics of networking

12 Most Important Check Point Firewall Interview Questions and Answers

by
Check Point Interview Questions and Answers for Freshers:
Check Point Interview Questions and Answers for Freshers:

In this blog, we have combined the top-most important Check Point Interview Questions with answers for you. These questions have been put together from basic to advanced levels firewall. This way, it will be easy for you to grasp the concepts.

Let’s begin with the questions without further a do.

What is Check Point?

Check Point is the world-class leader in providing combined hardware and software products for IT security. It includes network security, cloud security, endpoint security data security and security management. You can land a number of security jobs with Check Point firewall. These include:

  • Network Security Engineer
  • System Engineer
  • System Administrator
  • Security Analyst
  • Network Security Operations Engineer
  • Network Security Specialist
  • Network Security Administrator
  • Technical Specialist

Check Point Interview Questions and Answers for Freshers:

1. What is the 3-tier architecture of Check Point firewall?

The three-tier architecture tells us how checkpoint components are interrelated and how these components work together. Each component plays its own defined set of tasks. 

The three components of the Check Point firewall are:

  1. Smart Center Server
  2. Security Gateway
  3. Smart Console

These components play various roles that can be placed together or independently. 

The following are the roles and features of the Security Management Server:

  • The Smart Center Server stores policies.
  • It distributes policies to gateways or multiple gateways.
  • It acts like a Log Server.
  • It stores users, groups and permission database.
  • It can be installed on Windows, Linux and GAiA OS.
  • It maintains and stores the NGX databases.
  • Certificates can be created for users and administrators for authentication purposes.
  • It stores network-object definitions, user definitions, security policies and log files for firewalled gateways.

The following are the roles and features of the Security Gateway:

  • NGX Security Gateway checks out for all inbound and outbound packets on a gateway.
  • Packets are only processed by a higher protocol-stack layer when the security gateway verifies the packets according to the security policy.
  • It is responsible to protect the network.
  • Firewall is based on stateful inspection.
  • Security Gateway Role can be installed on Windows, Linux and GAiA OS.
  • NGX saves system resources and processing time.
  • It saves time by processing packets in an operating system’s kernel.

The following are the roles and features of the Smart Console:

  • Smart Console is a GUI package.
  • It comes in .exe format.
  • It can be installed on Windows. It is not for GAiA OS.
  • It is available for clients in GUI packages such as Smart Dashboard, SmartView Tracker, SmartView Monitor, and Smart Update.

2. What are the main components of the Check Point solution?

The following are the components of the Check Point solution:

  • Internal and External Networks
  • Security Gateway
  • Security Dashboard
  • Security Management Server
  • Internal Network

3. What is anti-spoofing?

Anti-spoofing is an important feature of the Check Point firewall. It protects the users from the attackers who generate IP Packet with a fake or spoof source address. It tells whether the traffic is legal or not. If the traffic is not legal the firewall blocks that traffic at the interface of the firewall. 

4. What is the difference between Stand-alone Deployment and Distributed Deployment.

Check Point firewall can be deployed as a standalone system or a distributed system. The difference between the two is as follows:

 

Stand-alone Deployment

Distributed Deployment

Installation location

Both Security Management Server and Security Gateway are installed on the same platform.

Each component is installed on a separate platform.

Degree of recommendation

Check Point does not recommend this deployment, except for small businesses. 

Check Point highly recommends such deployments.

Configuration

Each stand-alone server node is set up through Profile Management Tool or zpmt command. Additional servers are added through the administrative console or scripting.

Each deployment management node is set up through Profile Management tool or zpmt command. Additional servers are added through Profile Management Tool or the zpmt command.

Administrative isolation

Each standalone server node is a separate administrative domain.

All nodes in the cell are in the same administrative domain.

Multiple servants with application servers

Yes

Yes

Clustering 

It is not available

It is available

Operational isolation

You can start and stop servers independently. Each server has an independent, unshared Java Naming and Directory Interface (JNDI) namespace.

You can start and stop servers independently. The Java Naming and Directory Interface (JNDI) is shared among all servers in the cell. 

5. What is Stealth Rule in Check Point firewall?

Stealth Rule protects Check Point firewall from any direct access traffic. Its rule should be placed on the top of the Security rule base. The administrator denies all the traffic to access the Check Point firewall.

6. What is the Cleanup rule in the Check Point firewall?

The cleanup rule is the last of all the security rules. It is used to drop all traffic that does not match with above rule and logged. This rule is mainly created for log purposes. The administrator denies all the traffic and enables log in this log.

Check Point Interview Questions and Answers for Experienced:

7. What is VPN?

Most of the Internet traffic does not include encryption. An attacker can break in and change data as it flows over a network. Here comes the role of the Virtual Private Networks (VPNs). The role of the VPNs is as follows:

  • VPNs provide a private, encrypted connection between two points. 
  • They do not state those two points.
  • They mask your device’s IP address.

VPN can be used for the following purposes:

  • Site-to-Site VPN:

This type of VPN allows secure communication between two geographically different sites. For example, Intranet-based site-to-site, and multiple connected LANs that make a WAN.

  • Remote Access VPN:

This type of VPN connects remote users to a corporate network securely. For example, a large company with hundreds of salespersons in the field need a Remote Access VPN.

  • Cloud VPN (VPN-as-a-Service):

This type of VPN is hosted on a cloud-based infrastructure. This cloud infrastructure allows the packets from the client to enter the Internet rather than using the client’s local address. For example, a secure VPN for WFH (work from home) environments.

8. What is the difference between ESP and AH IPSec Protocol?

Authentication Header (AH) Protocol

Encapsulating Security Payload (ESP) Protocol

AH provides confidentiality, authenticity and integrity.

It also provides integrity protection except for the outermost IP header.

It authenticates the outer IP header and the IP packet as a whole.

It authenticates only the IP datagram portion of the IP packet.

It does not provide encryption options.

It provides an encryption option.

AH is faster than ESP as it does not perform encryption.

ESP is slower than AH. 

It will not work through a NATed network as it hashes both the payload and header of a packet.

It uses a hash algorithm for data integrity. It works normally through a NATed device. 

It provides a mechanism for Sender Data Origin Authentication. It can’t provide data Confidentiality/Encryption.

It provides Data Authentication and Data Privacy/Encryption. It ensures both confidentiality and integrity for Packet Payload.

9. What is Asymmetric Encryption?

Asymmetric encryption, which is also known as public-key cryptography is a process that makes use of a pair of related keys -a public key and a private key. It uses these keys to encrypt and decrypt a message and protect it from unauthorized access or use.

There are two types of keys in asymmetric encryption. These are:

  • Public keys:

The public key can be exchanged securely with communication partners. It is used to encrypt data.

  • Private keys:

The private key must be confidential. It is used to decrypt data.

10. What is NAT?

  • NAT stands for Network Address Translation. 
  • NAT is a Firewall Software Blade’s feature. 
  • It provides greater security by replacing/translating IPv4 and IPv6 addresses.
  • It hides internal IP addresses from the Internet to protect the identity of a network.
  • A firewall can change both the source and destination IP addresses of a packet.
  • Firewall translates the new IP addresses back to the original IP addresses as packets return from the external computer.

11. What types of connections does a firewall allow on the perimeter?

The following are the types of connections that a firewall allows on the perimeter:

  • Particular external connections
  • Outgoing connections to the Internet
  • Connections to DNS Server
  • Connections from the Internal networks to the external network
  • Outgoing connections to the Internet

12. What is the Security Zone?

  • Security Zone helps you to create a strong Access Control Policy that controls the traffic between parts of the network. 
  • It represents a part of the network. For example, the internal network or external network.
  • Different security zones are used by networks to protect resources and stop malware on networks.
  • The following are the pre-defined security zones:
    • Wireless Zone: The network is accessible through wireless connections by users and applications.
    • External Zone: Unsecured networks. For example, the Internet and external networks.
    • DMZ Zone: Demilitarized Zones (DMZ) are also called perimeter networks. It contains servers accessible from insecure sources (Internet/ external sources).
    • Internal Zone: The sensitive data that needs protection and is accessed only by authenticated users.