Cisco CCNA 200-301 Practice Exam

What the Cisco CCNA 200-301 exam covers

• Network Fundamentals148 questions
• Network Access137 questions
• IP Connectivity175 questions
• IP Services70 questions
• Security Fundamentals105 questions
• Automation and Programmability70 questions

Free Cisco CCNA 200-301 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 689.

1. Question 1Network Fundamentals

   A host sends a TCP SYN segment to a server. The server responds with a TCP SYN-ACK. What does the host send next to complete the connection establishment?

   • ASYN
   • BRST
   • CACKCorrect
   • DFIN
   ✓ Correct answer: C

   TCP uses a three-way handshake to establish a connection: the initiating host sends SYN, the server replies with SYN-ACK (acknowledging the client's SYN and sending its own), and finally the client sends ACK to acknowledge the server's SYN. Only after this third message does the connection move to the ESTABLISHED state and data transfer can begin.

   Why the other options are wrong

   • ASYN is the first message sent by the initiating host, not the third - sending another SYN after receiving SYN-ACK would restart the handshake rather than complete it.
   • BRST is a reset flag used to abruptly terminate or reject a connection, not to complete a normal three-way handshake.
   • DFIN is used to initiate graceful connection teardown after data transfer is complete, not to establish the connection.
2. Question 2Network FundamentalsSelect all that apply

   A network designer is planning the IP addressing scheme for a new branch office. The branch will have multiple departments that must be isolated at Layer 3. Which TWO of the following are characteristics of IPv4 private address ranges defined in RFC 1918? (Choose two.)

   • A10.0.0.0 to 10.255.255.255 provides approximately 16.7 million host addressesCorrect
   • BPrivate addresses are routable across the public internet
   • C172.16.0.0 to 172.31.255.255 is a valid private rangeCorrect
   • D169.254.0.0 to 169.254.255.255 is a RFC 1918 private range
   • E192.168.0.0 to 192.168.255.255 provides a Class A-sized address block
   ✓ Correct answer: A, C

   RFC 1918 defines three private IPv4 ranges: 10.0.0.0/8 (about 16.7 million addresses), 172.16.0.0/12 (which spans 172.16.0.0 through 172.31.255.255, about 1 million addresses), and 192.168.0.0/16 (about 65,536 addresses). The 10.0.0.0/8 block size and the 172.16.0.0-172.31.255.255 span are both accurate descriptions of these ranges. Private addresses are not routed across the public internet by ISPs, and 169.254.0.0/16 is the APIPA/link-local range defined in RFC 3927, not RFC 1918.

   Why the other options are wrong

   • BPrivate addresses are routable across the public internet is the opposite of their defining characteristic - ISPs filter RFC 1918 addresses and they are intentionally non-routable on the global internet, requiring NAT to communicate externally.
   • D169.254.0.0 to 169.254.255.255 is a RFC 1918 private range is incorrect - this is the Automatic Private IP Addressing (APIPA) or link-local range defined by RFC 3927, which is separate from the three RFC 1918 private ranges.
   • E192.168.0.0 to 192.168.255.255 provides a Class A-sized address block is wrong - this range is a /16 block providing only 65,536 addresses, far smaller than the roughly 16.7 million addresses in a Class A space; 10.0.0.0/8 is the Class A-sized private range.
3. Question 3Network Access

   A network engineer at a media company is setting up a trunk link between two Cisco switches. She configures the trunk on Switch A but forgets to configure the trunk on Switch B. Switch B's port remains in access mode with the default VLAN 1. What is the expected result when traffic from VLAN 10 is sent from Switch A?

   • AVLAN 10 tagged frames from Switch A will be dropped by Switch B because it is in access modeCorrect
   • BSwitch B will create VLAN 10 automatically
   • CAll VLANs will pass through untagged
   • DSwitch B will automatically negotiate a trunk and carry all VLANs across it
   ✓ Correct answer: A

   When a trunk port sends 802.1Q-tagged frames to a port configured in access mode, the receiving access port does not understand VLAN tags and will drop frames tagged with a VLAN ID other than its own access VLAN. Since Switch B's port is in access mode for VLAN 1, it discards the VLAN 10-tagged frames arriving from Switch A's trunk port, resulting in no connectivity for VLAN 10 devices.

   Why the other options are wrong

   • BSwitch B will create VLAN 10 automatically is incorrect - Cisco switches do not dynamically create VLANs when they receive tagged frames; VLANs must be explicitly configured or propagated via VTP.
   • CAll VLANs will pass through untagged is incorrect - an access mode port does not strip tags from incoming trunk traffic and forward it; it simply drops frames with unrecognized tags.
   • DAn access port does not negotiate; DTP would have to be active on both ends for a trunk to form.
4. Question 4IP Connectivity

   OSPF is a link-state protocol. What does it run to build its routing table?

   • AA periodic full routing-table broadcast
   • BThe DUAL finite-state machine that EIGRP uses
   • CThe SPF (Dijkstra) shortest-path calculationCorrect
   • DA hop-count check against a limit of 15
   ✓ Correct answer: C

   Each OSPF router floods link-state advertisements to build an identical topology database, then runs the Dijkstra SPF algorithm to compute the shortest path to every network. The metric is cumulative cost derived from interface bandwidth. This link-state approach avoids the loops of periodic distance-vector updates.

   Why the other options are wrong

   • APeriodic full-table broadcasts describe distance-vector protocols like RIP, not OSPF.
   • BDUAL is EIGRP's algorithm; OSPF uses Dijkstra SPF.
   • DA 15-hop limit is a RIP characteristic, not OSPF's path calculation.
5. Question 5Security Fundamentals

   Which protocol is used between a network device and a AAA server to provide centralized authentication, and uses TCP port 49?

   • ATACACS+Correct
   • BLDAP
   • CKerberos
   • DRADIUS
   ✓ Correct answer: A

   TACACS+ (Terminal Access Controller Access-Control System Plus) is a Cisco-developed protocol that communicates over TCP port 49 and provides centralized authentication, authorization, and accounting for network devices. Unlike RADIUS, TACACS+ encrypts the entire payload of each packet and separates its three AAA functions into independent transactions, making it the preferred choice for device administration in Cisco environments.

   Why the other options are wrong

   • BLDAP (Lightweight Directory Access Protocol) is a directory service query protocol used to look up user accounts, but it is not a AAA protocol and does not use TCP port 49.
   • CKerberos is a ticket-based authentication protocol used heavily in Microsoft Active Directory environments but does not operate on TCP port 49 and is not the standard AAA protocol used between Cisco devices and a AAA server.
   • DRADIUS (Remote Authentication Dial-In User Service) is also a centralized AAA protocol but uses UDP ports 1812 (authentication) and 1813 (accounting), not TCP port 49, and encrypts only the password field rather than the full packet.
6. Question 6Automation and Programmability

   A Python script interacting with a Cisco device's REST API receives an HTTP response with status code 401. What does this status code indicate?

   • AThe requested resource was not found
   • BThe server encountered an internal error
   • CThe request was successful
   • DThe request requires authentication credentialsCorrect
   ✓ Correct answer: D

   HTTP status code 401 Unauthorized is returned by a server when the incoming request does not include valid authentication credentials (or includes none at all). For REST APIs, this typically means the API token, username/password, or OAuth token is missing or invalid. The client must authenticate before the server will process the request. This is distinct from 403 Forbidden, where credentials are valid but the user lacks permission.

   Why the other options are wrong

   • AThe requested resource was not found describes HTTP 404 Not Found - a 404 means the URI does not map to an existing resource, not an authentication problem.
   • BThe server encountered an internal error describes HTTP 500 Internal Server Error - this indicates a server-side fault unrelated to the client's credentials or authorization.
   • CThe request was successful describes HTTP 200 OK or 201 Created - a 401 response explicitly means the request was rejected due to missing or invalid authentication, not that it succeeded.
7. Question 7Network FundamentalsSelect all that apply

   Which two statements correctly describe the difference between a hub and a switch operating on a LAN? (Choose two.)

   • AA switch creates a separate collision domain per port, while a hub places all ports in one collision domainCorrect
   • BA switch makes forwarding decisions based on destination MAC addresses, while a hub repeats signals out all portsCorrect
   • CA hub operates at Layer 3 and routes packets between separate subnets, while a switch only bridges at Layer 2
   • DA hub maintains a MAC address table, while a switch floods all traffic
   ✓ Correct answer: A, B

   Switches are intelligent Layer 2 devices that build a MAC address table and forward frames only to the destination port, giving each port its own collision domain and supporting full-duplex. Hubs are simple physical-layer repeaters that broadcast incoming signals out all other ports, forming a single shared collision domain.

   Why the other options are wrong

   • CA hub is a Layer 1 repeater with no addressing logic at all, so it routes nothing.
   • DThis is reversed; the switch maintains the MAC address table, and the hub is the device that floods all traffic.
8. Question 8Network Access

   Which CAPWAP tunnel carries client data traffic between a lightweight access point and a wireless LAN controller?

   • AThe CAPWAP control tunnel on UDP port 5246
   • BThe CAPWAP data tunnel on UDP port 5247Correct
   • CA GRE tunnel on IP protocol 47
   • DAn LWAPP tunnel on TCP port 12222
   ✓ Correct answer: B

   CAPWAP establishes two tunnels between a LAP and the WLC: a control tunnel on UDP 5246 for management messages and a data tunnel on UDP 5247 that encapsulates wireless client data frames back to the controller.

   Why the other options are wrong

   • AUDP 5246 is the CAPWAP control channel used for management/control messages, not client data.
   • CCAPWAP uses UDP, not GRE; GRE (IP protocol 47) is not the standard CAPWAP transport.
   • DLWAPP is the predecessor protocol to CAPWAP and is deprecated; CAPWAP does not use TCP 12222 for data.
9. Question 9IP Services

   In QoS, which per-hop behavior (PHB) is marked with DSCP value 46 and is intended for low-latency traffic such as voice?

   • ADefault (DSCP 0)
   • BAssured Forwarding 41 (DSCP 34)
   • CExpedited Forwarding (DSCP 46)Correct
   • DClass Selector 6 (DSCP 48)
   ✓ Correct answer: C

   EF (DSCP 46) provides low loss, low latency, and low jitter, making it the standard marking for real-time voice (RTP) traffic. It is given priority queuing treatment on QoS-enabled devices.

   Why the other options are wrong

   • ADSCP 0 is best-effort default forwarding with no priority.
   • BAF41 (DSCP 34) is typically used for interactive video, not voice EF treatment.
   • DCS6 (DSCP 48) is reserved for network control traffic such as routing protocols.
10. Question 10Automation and Programmability

    Which characteristic distinguishes a pull-based configuration management model such as Puppet from a push-based model such as Ansible?

    • APull-based agents periodically request configuration from a central serverCorrect
    • BPull-based tools require no central server at all
    • CPull-based tools always connect to nodes over SSH without agents
    • DPull-based tools use YAML playbooks executed on demand
    ✓ Correct answer: A

    Puppet typically uses an agent that runs on each managed node and periodically contacts the Puppet master to retrieve and apply the latest catalog. This differs from Ansible's push model, where a control node pushes configuration to targets over SSH on demand.

    Why the other options are wrong

    • BPull-based tools like Puppet rely on a central master/server that agents contact.
    • CAgentless SSH-based operation describes Ansible's push model, not a pull-based agent model.
    • DYAML playbooks run on demand describe Ansible's push approach, not Puppet's pull model.

Who this Cisco CCNA 200-301 practice exam is for

This practice set is for anyone preparing for the Cisco CCNA 200-301 exam - from first-time candidates building a foundation to experienced Cisco practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Cisco CCNA 200-301 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Cisco CCNA 200-301 exam.

Related Cisco resources

• Cisco CCNA 200-301 study guideKey concepts
• Cisco practice examsAll Cisco
• Certification pathWhere this fits
• Best CCNA Practice Exams (2026)Comparison
• Network Fundamentals practice questions148 questions
• Network Access practice questions137 questions
• IP Connectivity practice questions175 questions
• IP Services practice questions70 questions
• Security Fundamentals practice questions105 questions
• Automation and Programmability practice questions70 questions
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Cisco CCNA Automation (200-901 CCNAAUTO) practice examRelated
• Cisco CCNP Automation (350-901 AUTOCOR) practice examRelated
• Cisco CCNP ENARSI (300-410) practice examRelated

Cisco CCNA 200-301 practice exam FAQ