Cisco 200-301: Cisco Certified Network Associate (CCNA)

Last checked October 22, 2026 against the official Cisco exam page.

1. Question 1IP Connectivity

   A router has routes to 10.1.0.0/16 and 10.1.2.0/24 in its routing table. A packet is destined for 10.1.2.50. Which route is used?

   1. A10.1.2.0/24, because the longest prefix match wins
   2. B10.1.0.0/16, because it is listed first
   3. CBoth routes are used at the same time
   4. DThe packet is dropped because two routes exist
   Show answer and explanationHide answer

   Correct answer: A

   Routers choose the route with the longest matching prefix, which here is the /24. Listing order does not decide the route, traffic is not split across these routes by default, and a valid match is not dropped.

2. Question 2Network Fundamentals

   Which OSI model layer is responsible for logical addressing and routing packets between networks?

   1. ALayer 3, the network layer
   2. BLayer 4, the transport layer
   3. CLayer 7, the application layer
   4. DLayer 2, the data link layer
   Show answer and explanationHide answer

   Correct answer: A

   The network layer handles logical IP addressing and routing between networks. Data link handles MAC-based delivery on a local segment, transport handles end-to-end delivery such as TCP and UDP, and application handles user protocols.

3. Question 3IP Services

   A network engineer must assign IP addresses automatically to client devices and provide the default gateway and DNS server settings. Which service provides this?

   1. ASyslog
   2. BDHCP
   3. CSNMP
   4. DNTP
   Show answer and explanationHide answer

   Correct answer: B

   DHCP assigns addresses along with options such as the default gateway and DNS servers. NTP synchronizes time, SNMP monitors devices, and Syslog collects log messages.

4. Question 4Security Fundamentals

   An administrator wants to limit remote management access to a router so that only staff in the management subnet can connect by SSH. Which configuration achieves this?

   1. AA login banner that asks staff to be careful and to report unauthorized access attempts to the network team
   2. BTelnet enabled on the VTY lines with transport input telnet and a shared password for the NOC night team
   3. CA default route to the internet via the edge router's WAN interface with a next-hop address on Gi0/0/1
   4. DAn access control list on the management lines that permits only the management subnet
   Show answer and explanationHide answer

   Correct answer: D

   An ACL applied to the VTY lines restricts which source addresses can open management sessions. Banners are advisory, Telnet is insecure, and a default route does not restrict access.

5. Question 5Network Access

   A switch port connects to an access point that should carry two VLANs, data VLAN 10 and voice VLAN 20. Which switchport mode should be configured on the port?

   1. ATrunk, carrying the allowed VLANs with 802.1Q tagging
   2. BAccess mode on VLAN 10 as the untagged data VLAN
   3. CRouted port with an IP address on the interface
   4. DDynamic auto negotiation with the allowed VLAN set to none
   Show answer and explanationHide answer

   Correct answer: A

   A trunk carries multiple VLANs over one link using 802.1Q tags, which fits a device that needs data and voice VLANs. An access port carries only one VLAN, routed ports do not carry VLAN tags, and dynamic auto with no VLANs allowed carries nothing useful.