CertArea
All Cisco exams

Free 200-301 practice test: 30 questions with answers

30 original questions for Cisco Certified Network Associate (CCNA), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions
Real exam
120 min

200-301 exam guide: topics, cost and format

All 30 200-301 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

IP Connectivity (5 questions)

  1. Question 1

    A router has routes to 10.1.0.0/16 and 10.1.2.0/24 in its routing table. A packet is destined for 10.1.2.50. Which route is used?

    1. A10.1.2.0/24, because the longest prefix match wins
    2. B10.1.0.0/16, because it is listed first
    3. CBoth routes are used at the same time
    4. DThe packet is dropped because two routes exist
    Show answer and explanation
    Correct answer: A

    Routers choose the route with the longest matching prefix, which here is the /24. Listing order does not decide the route, traffic is not split across these routes by default, and a valid match is not dropped.

  2. Question 2

    A router must forward traffic for a destination network that is not in its routing table and that it does not know how to reach. Which route is used?

    1. AThe loopback route
    2. BThe default route, 0.0.0.0/0
    3. CThe MAC address table
    4. DA host route for the broadcast address
    Show answer and explanation
    Correct answer: B

    The default route is used when no more specific route matches, which sends the traffic toward the next-hop gateway. Host routes, loopbacks and MAC tables do not handle unknown destinations.

  3. Question 3

    Which routing protocol is an open standard that uses link-state information and Dijkstra's algorithm to calculate shortest paths within an autonomous system?

    1. ABGP
    2. BRIP version 1
    3. COSPF
    4. DStatic routing only
    Show answer and explanation
    Correct answer: C

    OSPF is a link-state interior gateway protocol that uses Dijkstra's algorithm to compute shortest paths. BGP is an exterior protocol between autonomous systems, RIP version 1 is distance-vector, and static routing does not use a protocol.

  4. Question 4

    A network engineer wants to see which routes an OSPF router has learned and the best path for each. Which command provides this view?

    1. Ashow mac address-table
    2. Bshow vlan brief
    3. Cshow cdp neighbors detail
    4. Dshow ip route
    Show answer and explanation
    Correct answer: D

    show ip route displays the routing table, including routes learned from OSPF and the selected best path. MAC address tables, VLAN lists and CDP neighbor information do not show the routing table.

  5. Question 5

    Two routers exchange routes with each other over a serial link. Which router setting is needed so that each router learns the other's connected networks dynamically?

    1. AA NAT overload statement
    2. BA VLAN trunk between the routers
    3. CA routing protocol enabled on both routers for the participating interfaces
    4. DA DHCP pool on each router
    Show answer and explanation
    Correct answer: C

    A routing protocol enabled on the interfaces lets routers advertise and learn networks dynamically. VLAN trunks, DHCP pools and NAT do not exchange routes between routers.

Network Fundamentals (5 questions)

  1. Question 6

    Which OSI model layer is responsible for logical addressing and routing packets between networks?

    1. ALayer 3, the network layer
    2. BLayer 4, the transport layer
    3. CLayer 7, the application layer
    4. DLayer 2, the data link layer
    Show answer and explanation
    Correct answer: A

    The network layer handles logical IP addressing and routing between networks. Data link handles MAC-based delivery on a local segment, transport handles end-to-end delivery such as TCP and UDP, and application handles user protocols.

  2. Question 7

    Which transport protocol provides reliable, ordered delivery with acknowledgements and retransmissions?

    1. ATCP
    2. BUDP
    3. CICMP
    4. DARP
    Show answer and explanation
    Correct answer: A

    TCP establishes a connection, acknowledges data, reorders segments and retransmits losses. UDP sends without these guarantees, ICMP carries control messages, and ARP resolves IPv4 addresses to MAC addresses.

  3. Question 8

    A host needs to find the MAC address that corresponds to a known IPv4 address on the same subnet. Which protocol performs this lookup?

    1. ADNS
    2. BDHCP
    3. CNTP
    4. DARP
    Show answer and explanation
    Correct answer: D

    ARP maps an IPv4 address to a MAC address on the local network. DNS maps names to addresses, DHCP assigns addresses, and NTP synchronizes time.

  4. Question 9

    A network administrator wants to reduce collisions and allow full-duplex communication between two switches. Which feature should be used on the link?

    1. AFull-duplex operation with a point-to-point connection
    2. BA hub between the switches
    3. CHalf-duplex with a shared collision domain
    4. DSimplex transmission on one wire
    Show answer and explanation
    Correct answer: A

    A point-to-point switch link in full-duplex mode has no collisions because each side can send and receive simultaneously. A hub creates a shared collision domain, and half-duplex and simplex modes do not give simultaneous two-way traffic.

  5. Question 10

    Which IPv4 address is a private address defined by RFC 1918 that is commonly used inside organizations?

    1. A8.8.8.8
    2. B192.168.10.5
    3. C169.254.1.1
    4. D224.0.0.5
    Show answer and explanation
    Correct answer: B

    192.168.0.0/16 is one of the RFC 1918 private ranges. 8.8.8.8 is a public address, 169.254.x.x is link-local, and 224.0.0.5 is a multicast address.

IP Services (5 questions)

  1. Question 11

    A network engineer must assign IP addresses automatically to client devices and provide the default gateway and DNS server settings. Which service provides this?

    1. ASyslog
    2. BDHCP
    3. CSNMP
    4. DNTP
    Show answer and explanation
    Correct answer: B

    DHCP assigns addresses along with options such as the default gateway and DNS servers. NTP synchronizes time, SNMP monitors devices, and Syslog collects log messages.

  2. Question 12

    Hosts in a private subnet must reach the internet, and the public address on the router must be shared by many internal hosts. Which feature provides this translation?

    1. AStatic routing with no translation
    2. BNAT overload (PAT)
    3. CA VLAN trunk
    4. DSpanning Tree Protocol
    Show answer and explanation
    Correct answer: B

    NAT overload, also called PAT, maps many internal addresses to one public address using different port numbers. Static routing does not translate addresses, VLAN trunks carry VLAN tags, and STP prevents loops.

  3. Question 13

    A server must be reachable from the internet at a fixed public address that maps to its private address inside the network. Which NAT type is used?

    1. AStatic NAT
    2. BDynamic NAT with a pool of one address for all users
    3. CPAT only
    4. DPort-based VLAN
    Show answer and explanation
    Correct answer: A

    Static NAT creates a permanent one-to-one mapping between a private and public address, which lets the server be reached from outside. Dynamic pools assign addresses temporarily, PAT maps many hosts to one address, and VLANs do not translate addresses.

  4. Question 14

    Which protocol allows network devices to synchronize their clocks with a reliable time source so that logs have accurate timestamps?

    1. ASNMP
    2. BFTP
    3. CSMTP
    4. DNTP
    Show answer and explanation
    Correct answer: D

    NTP synchronizes device clocks to reliable time sources, which keeps log timestamps accurate. SNMP monitors devices, FTP transfers files, and SMTP sends email.

  5. Question 15

    A network administrator needs to forward router log messages to a central server for review. Which protocol is commonly used?

    1. ADHCP
    2. BARP
    3. CSTP
    4. DSyslog
    Show answer and explanation
    Correct answer: D

    Syslog sends log messages from network devices to a central collector. DHCP assigns addresses, ARP maps addresses, and STP manages loops.

Security Fundamentals (5 questions)

  1. Question 16

    An administrator wants to limit remote management access to a router so that only staff in the management subnet can connect by SSH. Which configuration achieves this?

    1. AA login banner that asks staff to be careful and to report unauthorized access attempts to the network team
    2. BTelnet enabled on the VTY lines with transport input telnet and a shared password for the NOC night team
    3. CA default route to the internet via the edge router's WAN interface with a next-hop address on Gi0/0/1
    4. DAn access control list on the management lines that permits only the management subnet
    Show answer and explanation
    Correct answer: D

    An ACL applied to the VTY lines restricts which source addresses can open management sessions. Banners are advisory, Telnet is insecure, and a default route does not restrict access.

  2. Question 17

    A security policy requires that device management use encrypted sessions and that stored passwords are protected. Which configuration meets this requirement?

    1. ASSH for management and the service password-encryption command
    2. BTelnet on VTY lines for management and plain-text enable and line passwords
    3. CHTTP server enabled for management with no enable password on TCP port 80
    4. DSNMPv1 read-only access with a public community string on UDP port 161
    Show answer and explanation
    Correct answer: A

    SSH encrypts management sessions, and service password-encryption obscures stored passwords in the configuration. Telnet and HTTP send data in clear text, plain-text passwords are exposed, and SNMPv1 with a public community is weak.

  3. Question 18

    A network engineer wants to ensure that an access switch port that is connected to an end user does not forward BPDUs that could change the spanning tree topology. Which feature should be enabled?

    1. AA trunk port with all VLANs allowed
    2. BPortFast with BPDU guard on access ports
    3. CA routed port with no switching
    4. DAn EtherChannel with LACP on a single link
    Show answer and explanation
    Correct answer: B

    PortFast brings access ports up quickly, and BPDU guard shuts the port if a BPDU arrives, which protects the spanning tree topology. Trunks, routed ports and single-link bundles do not provide this protection.

  4. Question 19

    Which two actions reduce the risk of unauthorized access to a switch's console and management interfaces? (Choose two.)

    1. ASet strong passwords and use AAA or local user accounts for logins
    2. BLeave the console open with no password for easier recovery
    3. CUse HTTP for the web interface with no encryption
    4. DDisable unused management services and restrict them with ACLs
    5. EShare one administrator password among all staff
    Show answer and explanation
    Correct answer: A, D

    Strong authentication through AAA or local accounts limits who can log in, and disabling unused services with ACLs reduces the attack surface. Open consoles, unencrypted web access and shared passwords all make unauthorized access easier.

  5. Question 20

    Which security concept describes giving users and devices only the access they need to perform their job?

    1. AFull administrative access
    2. BLeast privilege
    3. COpen access with logging
    4. DShared accounts for convenience
    Show answer and explanation
    Correct answer: B

    Least privilege limits access to what is required, which reduces the impact of a compromise. Full administrative access, open access and shared accounts all expand risk.

Network Access (5 questions)

  1. Question 21

    A switch port connects to an access point that should carry two VLANs, data VLAN 10 and voice VLAN 20. Which switchport mode should be configured on the port?

    1. ATrunk, carrying the allowed VLANs with 802.1Q tagging
    2. BAccess mode on VLAN 10 as the untagged data VLAN
    3. CRouted port with an IP address on the interface
    4. DDynamic auto negotiation with the allowed VLAN set to none
    Show answer and explanation
    Correct answer: A

    A trunk carries multiple VLANs over one link using 802.1Q tags, which fits a device that needs data and voice VLANs. An access port carries only one VLAN, routed ports do not carry VLAN tags, and dynamic auto with no VLANs allowed carries nothing useful.

  2. Question 22

    Which command shows which VLANs exist on a switch and which access ports belong to each VLAN?

    1. Ashow vlan brief
    2. Bshow running-config | include hostname
    3. Cshow ip route
    4. Dshow cdp neighbors
    Show answer and explanation
    Correct answer: A

    show vlan brief lists configured VLANs, their names, status and the ports assigned to each. Routing tables, hostname lines and neighbour lists do not show VLAN membership.

  3. Question 23

    Two switches are connected with a trunk, and both have native VLAN 1 on the trunk, but one switch uses native VLAN 99. What is the likely result?

    1. ABoth switches automatically negotiate and agree on VLAN 99 as the native VLAN for the trunk
    2. BThe switches share one MAC table, so the mismatch has no effect
    3. CA native VLAN mismatch that is reported and can misdirect untagged traffic
    4. DThe trunk port changes into an access port on VLAN 1 after the mismatch occurs
    Show answer and explanation
    Correct answer: C

    A native VLAN mismatch is reported by the switches and can cause untagged frames to be placed in the wrong VLAN. The switches do not agree automatically, the port mode does not change, and the MAC tables are independent.

  4. Question 24

    A switch is connected to another switch, and a loop is created by a redundant link. Which protocol prevents the loop by blocking redundant ports?

    1. AOpen Shortest Path First
    2. BVirtual Router Redundancy
    3. CSpanning Tree Protocol (STP)
    4. DDynamic ARP Inspection
    Show answer and explanation
    Correct answer: C

    STP builds a loop-free topology by blocking redundant ports and unblocking them if a link fails. OSPF is a routing protocol, HSRP provides gateway redundancy, and DHCP snooping protects against rogue DHCP servers.

  5. Question 25

    An administrator wants to bundle several physical links between two switches into one logical link for more bandwidth and redundancy. Which technology should be used?

    1. AEtherChannel with LACP
    2. BA VLAN trunk with no bundling
    3. CPort security on each link
    4. DNAT overload
    Show answer and explanation
    Correct answer: A

    EtherChannel bundles physical links into one logical link, and LACP negotiates the bundle. A trunk alone does not combine links, port security limits MAC addresses, and NAT translates addresses.

Automation and Programmability (5 questions)

  1. Question 26

    A company wants to manage many routers with the same configuration changes, using a controller that exposes a northbound API. Which approach describes this model?

    1. AEach router is configured manually one at a time through its own CLI
    2. BFixed static routes with no SNMP management plane
    3. CSoftware-defined networking with a centralized controller
    4. DA flat Layer 2 network with no central controller
    Show answer and explanation
    Correct answer: C

    SDN separates the control plane into a central controller that programs devices through APIs, which makes large-scale changes consistent. Manual per-device configuration does not scale, and static routing and flat networks do not describe controller-based management.

  2. Question 27

    Which data format is commonly used by REST APIs on network devices to exchange structured configuration data in a human-readable form?

    1. ARAID
    2. BCSMA/CD
    3. CJSON
    4. DICMP
    Show answer and explanation
    Correct answer: C

    JSON is a common human-readable format for REST API payloads. RAID is a storage technology, ICMP is a network control protocol, and CSMA/CD is an Ethernet access method.

  3. Question 28

    An engineer wants to retrieve the current status of an interface from a device through an API using HTTP methods. Which HTTP method is appropriate for reading data?

    1. AGET
    2. BPATCH
    3. CPOST
    4. DDELETE
    Show answer and explanation
    Correct answer: A

    GET retrieves data without changing the resource. DELETE removes a resource, PATCH partially updates it, and POST typically creates or submits data.

  4. Question 29

    A configuration management tool applies the same desired state to many devices each time it runs, and the result is the same no matter how many times it runs. What is this property called?

    1. ALatency
    2. BOversubscription
    3. CIdempotence
    4. DFragmentation
    Show answer and explanation
    Correct answer: C

    Idempotent operations produce the same result when repeated, which is why configuration tools can safely re-run them. Latency, fragmentation and oversubscription are unrelated network terms.

  5. Question 30

    Which two statements about configuration management and automation are correct? (Choose two.)

    1. AAutomation reduces the chance of human error for repetitive changes
    2. BManual changes on each device are the most consistent approach at scale
    3. CVersion control of configuration files makes changes traceable and reversible
    4. DAutomation removes the need for testing before production changes
    5. EConfiguration files should be shared through unencrypted email
    Show answer and explanation
    Correct answer: A, C

    Version control gives traceability and rollback, and automation reduces mistakes in repetitive tasks. Manual changes are less consistent at scale, automation still needs testing, and sending configurations by unencrypted email exposes secrets.