Cisco CCNA 200-301 Practice Exam

What the Cisco CCNA 200-301 exam covers

• Network Fundamentals148 questions
• Network Access137 questions
• IP Connectivity175 questions
• IP Services70 questions
• Security Fundamentals105 questions
• Automation and Programmability70 questions

Free Cisco CCNA 200-301 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 705.

1. Question 1Network Fundamentals

   Which layer of the OSI model is responsible for logical addressing and routing of packets between networks?

   • ANetwork layerCorrect
   • BTransport layer
   • CData Link layer
   • DSession layer
   ✓ Correct answer: A

   The Network layer (Layer 3) is responsible for logical addressing using IP addresses and making routing decisions to forward packets between different networks. Routers operate at this layer to determine the best path for data to travel across network segments. This layer enables communication between devices on different networks using IP-based addressing schemes.

   Why the other options are wrong

   • BTransport layer is incorrect because it manages end-to-end communication and flow control, not logical addressing and routing.
   • CData Link layer is incorrect because it uses MAC addresses for local network delivery within a segment, not IP-based routing.
   • DSession layer is incorrect because it manages dialogue control and session establishment, not packet routing.
2. Question 2Network FundamentalsSelect all that apply

   A network designer is planning the IP addressing scheme for a new branch office. The branch will have multiple departments that must be isolated at Layer 3. Which TWO of the following are characteristics of IPv4 private address ranges defined in RFC 1918? (Choose two.)

   • A10.0.0.0 to 10.255.255.255 provides approximately 16.7 million host addressesCorrect
   • BPrivate addresses are routable across the public internet
   • C172.16.0.0 to 172.31.255.255 is a valid private rangeCorrect
   • D169.254.0.0 to 169.254.255.255 is a RFC 1918 private range
   • E192.168.0.0 to 192.168.255.255 provides a Class A-sized address block
   ✓ Correct answer: A, C

   RFC 1918 defines three private IPv4 ranges: 10.0.0.0/8 (about 16.7 million addresses), 172.16.0.0/12 (which spans 172.16.0.0 through 172.31.255.255, about 1 million addresses), and 192.168.0.0/16 (about 65,536 addresses). Both option A and option C correctly describe characteristics of these ranges. Private addresses are not routed across the public internet by ISPs, and 169.254.0.0/16 is the APIPA/link-local range defined in RFC 3927, not RFC 1918.

   Why the other options are wrong

   • BPrivate addresses are routable across the public internet is the opposite of their defining characteristic - ISPs filter RFC 1918 addresses and they are intentionally non-routable on the global internet, requiring NAT to communicate externally.
   • D169.254.0.0 to 169.254.255.255 is a RFC 1918 private range is incorrect - this is the Automatic Private IP Addressing (APIPA) or link-local range defined by RFC 3927, which is separate from the three RFC 1918 private ranges.
   • E192.168.0.0 to 192.168.255.255 provides a Class A-sized address block is wrong - this range is a /16 block providing only 65,536 addresses, far smaller than the roughly 16.7 million addresses in a Class A space; 10.0.0.0/8 is the Class A-sized private range.
3. Question 3Network Access

   A network technician at a university is configuring a trunk link between a core switch and a distribution switch. She notices VLAN 1 traffic is being sent untagged across the trunk. She wants to change the native VLAN to VLAN 999 for security purposes. Which command should she use on the trunk interface?

   • ASwitchport access vlan 999
   • BSwitchport trunk native vlan 999Correct
   • CSwitchport native vlan 999
   • DVlan 999 native
   ✓ Correct answer: B

   To change the native VLAN on an 802.1Q trunk port in Cisco IOS, the interface-level command 'switchport trunk native vlan <vlan-id>' is used. This tells the switch to send and receive untagged frames on that trunk as belonging to the specified VLAN instead of the default VLAN 1. Changing the native VLAN to an unused VLAN like 999 is a security best practice to mitigate VLAN hopping attacks.

   Why the other options are wrong

   • Aswitchport access vlan 999 assigns a port to an access VLAN and is only applicable to access mode ports - it does not configure the native VLAN on a trunk port.
   • Cswitchport native vlan 999 is not valid Cisco IOS syntax - the correct full command requires the keyword 'trunk' between 'switchport' and 'native': 'switchport trunk native vlan 999'.
   • Dvlan 999 native is not a recognized Cisco IOS command - VLAN configuration in the global 'vlan <id>' context sets the VLAN name or state, not the native VLAN assignment on a trunk interface.
4. Question 4IP Connectivity

   Which OSPF packet type is used to discover and maintain OSPF neighbor relationships?

   • ALink-State Acknowledgment (LSAck)
   • BDatabase Description (DBD)
   • CLink-State Update (LSU)
   • DHelloCorrect
   ✓ Correct answer: D

   OSPF uses five packet types, and the Hello packet serves the specific purpose of neighbor discovery and keepalive maintenance. Routers send Hellos at the Hello interval (10 seconds on broadcast/point-to-point, 30 seconds on NBMA by default) to the multicast address 224.0.0.5. If a neighbor's Hello is not received within the Dead interval (4x Hello), the adjacency is torn down and the topology database is updated.

   Why the other options are wrong

   • ALink-State Acknowledgment (LSAck) is used to reliably confirm receipt of LSU packets - it plays no role in neighbor discovery or keepalive functions.
   • BDatabase Description (DBD) packets are exchanged during the ExStart and Exchange states to summarize each router's LSDB so peers can determine which LSAs to request - they are not used for ongoing neighbor maintenance.
   • CLink-State Update (LSU) packets carry actual LSAs and are used to flood topology changes through the OSPF domain - they do not discover neighbors or maintain adjacencies.
5. Question 5Security Fundamentals

   An administrator creates the following ACL entry: 'access-list 110 deny tcp 192.168.1.0 0.0.0.255 any eq 23'. What traffic does this entry block?

   • AAll TCP traffic to port 23 from any source
   • BHTTP traffic from the 192.168.1.0/24 network
   • CSSH traffic from the 192.168.1.0/24 network
   • Dtelnet traffic from the 192.168.1.0/24 network to any destinationCorrect
   ✓ Correct answer: D

   The ACL entry 'access-list 110 deny tcp 192.168.1.0 0.0.0.255 any eq 23' uses an extended ACL (numbered 110). It matches TCP traffic sourced from the 192.168.1.0/24 subnet (wildcard 0.0.0.255), destined to any address ('any'), on destination port 23. Port 23 is the well-known port for Telnet, so this entry specifically denies all Telnet sessions initiated from the 192.168.1.0/24 network to any host.

   Why the other options are wrong

   • AAll TCP traffic to port 23 from any source would be the effect if the source were 'any any', but the ACL explicitly limits the source to the 192.168.1.0/24 subnet, not all sources.
   • BHTTP traffic from the 192.168.1.0/24 network uses port 80, not port 23 - the ACL targets only port 23 (Telnet) and would not block HTTP.
   • CSSH traffic from the 192.168.1.0/24 network uses TCP port 22, not port 23 - this ACL entry does not affect SSH sessions.
6. Question 6Automation and Programmability

   QuantumEdge Networks is automating device provisioning using Cisco DNA Center. What term describes the process where a new network device automatically discovers the controller and receives its configuration without manual intervention?

   • AConsole provisioning
   • BStatic configuration
   • CManual bootstrapping
   • DZero-touch provisioning (ZTP)Correct
   ✓ Correct answer: D

   Zero-touch provisioning (ZTP) is the process by which a newly deployed network device - with no prior manual configuration - automatically contacts a controller (such as Cisco DNA Center via the PnP protocol) over the network, receives its configuration, software image, and policies, and comes online without any engineer needing to connect a console cable or pre-stage the device. This drastically reduces deployment time and human error for large-scale rollouts.

   Why the other options are wrong

   • AConsole provisioning requires a technician to physically connect to the device's console port and manually enter configuration commands - this is the opposite of the automated, hands-free process described.
   • BStatic configuration means configuration is manually typed or pre-loaded on a device with fixed parameters - it does not involve automatic controller discovery or hands-free deployment.
   • CManual bootstrapping involves a human administrator performing the initial setup steps, such as setting an IP address and credentials before any automation can take over - it is not an automatic, zero-intervention process.
7. Question 7Network Fundamentals

   Which protocol and port number combination is used by the Trivial File Transfer Protocol (TFTP), commonly used to back up Cisco device configurations?

   • AUDP port 69Correct
   • BTCP port 21
   • CTCP port 22
   • DUDP port 161
   ✓ Correct answer: A

   TFTP is a lightweight, connectionless file transfer protocol that runs over UDP port 69. It is commonly used to transfer IOS images and configuration files to and from Cisco devices because of its simplicity.

   Why the other options are wrong

   • BTCP port 21 is the FTP control connection, not TFTP.
   • CTCP port 22 is used by SSH for secure remote access.
   • DUDP port 161 is used by SNMP for network management queries, not file transfer.
8. Question 8Network Access

   A switch port configured with 'switchport port-security maximum 1' and 'switchport port-security mac-address sticky' learns one MAC address. What does the 'sticky' keyword cause the switch to do with that address?

   • AAdd the dynamically learned MAC address to the running configurationCorrect
   • BPermanently store the MAC in the startup configuration even without saving
   • CDiscard the address when the port goes down
   • DForward the address to a RADIUS server for validation
   ✓ Correct answer: A

   With 'sticky', the first MAC learned on the port is written into the running configuration as a static secure MAC address. This avoids manually typing each MAC, but the address is only saved permanently if the administrator copies the running config to the startup config.

   Why the other options are wrong

   • BThe sticky MAC is added to the running config only; it is not automatically written to startup config unless the configuration is saved.
   • CSticky addresses persist in the running config across link flaps; they are not discarded when the port goes down.
   • DPort security with sticky MACs is local to the switch and does not involve a RADIUS server; that describes 802.1X authentication.
9. Question 9IP Services

   After running 'show ip nat translations', an administrator sees an entry with an Inside global address but no Inside local address listed. What does this typically indicate?

   • AA static NAT entry that has not yet matched trafficCorrect
   • BAn outside-to-inside translation failure
   • CA DHCP lease expiration
   • DA duplicate IP address conflict
   ✓ Correct answer: A

   Static translations created with 'ip nat inside source static' are installed in the translation table as soon as they are configured. Until traffic flows, the dynamic protocol/port columns may be blank, but the configured global-to-local mapping is shown.

   Why the other options are wrong

   • BA translation failure would not create a table entry at all.
   • CDHCP leases are unrelated to the NAT translation table.
   • DAn IP conflict is detected by ARP/DHCP, not shown as a NAT translation entry.
10. Question 10Automation and ProgrammabilitySelect all that apply

    Which two statements correctly contrast traditional CLI-based device management with controller-based (SDN) management? (Choose two.)

    • AController-based management centralizes the control plane while devices retain their data planeCorrect
    • BTraditional management configures each device individually using box-by-box CLI sessionsCorrect
    • CController-based management eliminates the data plane from all network devices
    • DTraditional management uses a single northbound API to push intent to all devices
    ✓ Correct answer: A, B

    In an SDN/controller-based model the control plane logic is centralized on a controller that programs the distributed data planes of the forwarding devices, whereas the traditional model requires an administrator to log into and configure each device individually through its own CLI.

    Why the other options are wrong

    • CDevices still keep a data plane to forward traffic; only control-plane decision-making is centralized.
    • DNorthbound APIs and intent-based push are features of controller-based management, not traditional CLI management.

Related Cisco resources

• Cisco CCNA 200-301 study guideKey concepts
• Cisco practice examsAll Cisco
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Cisco CCNP Security SCOR (350-701) practice examRelated
• Cisco CCST Cybersecurity (100-160) practice examRelated
• Cisco Cybersecurity Associate (200-201 CBROPS) practice examRelated

Cisco CCNA 200-301 practice exam FAQ