200-301 — Implementing and Administering Cisco Solutions (CCNA)
Cisco

Implementing and Administering Cisco Solutions (CCNA) (200-301) Practice Questions

★★★★★★ 4.9 552 verified reviews
220 questions
2026-06-12 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Network Fundamentals (20%)
  • Network Access (20%)
  • IP Connectivity (25%)
  • IP Services (10%)
  • Security Fundamentals (15%)
  • Automation and Programmability (10%)

Sample Questions (22 of 220 shown)

Q1 Network Fundamentals
Which OSI layer is responsible for logical addressing and routing?
  1. Layer 2 - Data Link
  2. Layer 3 - Network
  3. Layer 4 - Transport
  4. Layer 7 - Application
✓ Correct Answer: B
Layer 3 (Network layer) handles logical addressing (IP addresses) and routing across networks. Layer 2 uses physical (MAC) addresses, Layer 4 manages end-to-end communication, and Layer 7 provides application services.
Q2 Network Fundamentals
A network engineer is troubleshooting a connectivity issue. The engineer confirms that the physical cable is connected and the link light is on, but the device cannot communicate on the network. At which OSI layer should the engineer focus next?
  1. Layer 1 — Physical
  2. Layer 2 — Data Link
  3. Layer 3 — Network
  4. Layer 7 — Application
✓ Correct Answer: B
Physical layer (Layer 1) is confirmed working — cable connected, link light on. The next step is Layer 2 (Data Link): check MAC address table, VLAN configuration, STP state, and duplex/speed settings. The bottom-up OSI troubleshooting approach is fundamental CCNA methodology.
Q3 Network Fundamentals
Which TCP/IP model layer is responsible for ensuring reliable, end-to-end communication and includes protocols such as TCP and UDP?
  1. Network Access Layer
  2. Internet Layer
  3. Transport Layer
  4. Application Layer
✓ Correct Answer: C
The Transport layer of the TCP/IP model is responsible for end-to-end communication. TCP provides reliable, connection-oriented delivery with flow control and error recovery, while UDP provides connectionless, best-effort delivery.
Q4 Network Fundamentals
What is the maximum cable length for a single segment of Cat 6a UTP cabling used for 10GBASE-T Ethernet?
  1. 55 meters
  2. 100 meters
  3. 150 meters
  4. 300 meters
✓ Correct Answer: B
Cat 6a (augmented) UTP cabling supports 10GBASE-T Ethernet at distances up to 100 meters. Cat 6 (non-augmented) also supports 10GBASE-T but only up to approximately 55 meters due to higher alien crosstalk at 10 Gbps frequencies. Cat 6a was specifically designed with improved shielding to eliminate this limitation.
Q5 Network Fundamentals
Which type of fiber optic cable uses a larger core diameter (typically 50 or 62.5 microns) and is commonly used for shorter distances within a campus?
  1. Single-mode fiber (SMF)
  2. Multimode fiber (MMF)
  3. Plastic optical fiber (POF)
  4. Dispersion-shifted fiber (DSF)
✓ Correct Answer: B
Multimode fiber (MMF) uses a larger core diameter (50 or 62.5 microns) allowing multiple light modes to propagate. It is less expensive and easier to terminate than SMF, but limited to shorter distances (up to 400-550 meters at 10 Gbps). Single-mode fiber uses a smaller core (8-10 microns) and can span tens of kilometers.
Q6 Network Fundamentals
A network technician needs to connect a switch to a router using a copper Ethernet cable. Both devices have auto-MDIX disabled. Which type of cable is required?
  1. Straight-through cable
  2. Crossover cable
  3. Rollover (console) cable
  4. Coaxial cable
✓ Correct Answer: A
Without auto-MDIX, traditional cabling rules apply. Switches use MDIX pinout, while routers use MDI pinout. Connecting unlike pin configurations (MDI to MDIX) requires a straight-through cable. Crossover cables connect like configurations (switch-to-switch, router-to-router). With auto-MDIX enabled (default on modern Cisco switches), any cable type works.
Q7 Network Fundamentals
How are network data transmissions calculated?
  1. goodput + traffic overhead = throughput
  2. goodput + latency = bandwidth
  3. throughput + goodput = bandwidth
  4. throughput + latency = goodput
✓ Correct Answer: A
Bandwidth is the capacity of the medium to carry data. Throughput is typically lower than bandwidth due to various factors. Goodput is the throughput minus the overhead from session establishment, acknowledgments, encapsulation, and retransmitted traffic.
Q8 Network Fundamentals
Which network topology provides the highest redundancy by connecting every device to every other device, but becomes impractical as the network scales?
  1. Star topology
  2. Bus topology
  3. Full mesh topology
  4. Ring topology
✓ Correct Answer: C
A full mesh topology connects every device to every other device, providing maximum redundancy. However, the number of links grows exponentially with the formula n(n-1)/2, making it impractical for large networks. For example, 10 devices require 45 links, but 100 devices require 4,950 links.
Q9 Network Fundamentals
Two students are discussing routers and one statement that is said between them is accurate. Which statement is that?
  1. A directly-connected network is automatically added to the routing table of an adjacency neighbor if both routers are Cisco routers.
  2. A gateway of last resort is added to the routing table when the router boots up.
  3. Remote networks can only be added after they are learned by routers through dynamic routing protocols.
  4. A default route provides a way for packets that do not match a specific route in the routing table to be forwarded.
✓ Correct Answer: D
A default route (gateway of last resort) provides a path for packets that do not match any specific route in the routing table. Directly connected networks are added when IP is configured on an active interface. Networks can be learned through static routes or dynamic protocols. A gateway of last resort is not automatically added at boot.
Q10 Network Fundamentals
What are two benefits of using virtualization? (Choose two.)
  1. The operating system of the virtual machine does not require licensing when it is virtualized.
  2. The virtual machine is no longer dependent on a specific hardware platform.
  3. Because all virtual operating systems are contained within a single virtual network, networking connections are simplified.
  4. The performance of a virtual machine is faster than the performance of the operating system running on physical hardware.
  5. Multiple virtual machines can be running simultaneously on a single physical device.
✓ Correct Answer: B, E
Virtualization benefits include: consolidating multiple guest operating systems on a single device, reduced power consumption, faster OS recovery, and hardware platform independence. VMs still require OS licensing, networking is not necessarily simplified, and VM performance is typically not faster than bare-metal.
Q11 Network Fundamentals
A network engineer is giving a tour of the company network operations center to a college class. Which statement correctly describes network infrastructure and network communication?
  1. Communication across the internet requires application of recognized technologies and standards.
  2. LANs are used to connect WANs around the world.
  3. A LAN connects small networks to large global networks.
  4. The internet is a worldwide collection of interconnected networks owned by an organization.
✓ Correct Answer: A
The internet is not owned by any individual or organization. Effective communication across the diverse internet infrastructure requires the application of consistent, recognized technologies and standards, along with the cooperation of numerous network administration entities.
Q12 Network Fundamentals
Students in a data networking class are reviewing materials. Which statement describes the operation of an access control method for shared network media?
  1. The controlled-based access method, used on legacy bus-topology Ethernet LANs, decided the order of each device to transmit.
  2. In the CSMA/CD method, when two devices transmit at the same time, a collision is detected and data is resent immediately.
  3. The CSMA/CA method attempts to avoid collisions by having each device informing others how long the media will be unavailable.
  4. In a contention-based multiaccess network, each node has its own time to use the medium.
✓ Correct Answer: C
CSMA/CA does not detect collisions but avoids them by waiting before transmitting. Each transmitting device includes the time duration needed, and all other wireless devices receive this information and know how long the medium will be unavailable.
Q13 Network Fundamentals
A group of network technicians is discussing IPv6 multicast processes. What is a feature of one type of IPv6 multicast address?
  1. A solicited-node multicast address is similar to the all-routers multicast address.
  2. It can be a source or a destination address.
  3. It has the prefix fe00::/8.
  4. The all-nodes multicast group has the same effect as an IPv4 broadcast address.
✓ Correct Answer: D
IPv6 multicast addresses can only be destination addresses, never source addresses, and have the prefix ff00::/8. The all-nodes multicast group (ff02::1) has the same effect as an IPv4 broadcast — it reaches all nodes on the local link.
Q14 Network Fundamentals
Which two 802.11 WLAN standards operate in both the 2.4 GHz and 5 GHz frequency bands? (Choose two.)
  1. 802.11g
  2. 802.11ax
  3. 802.11n
  4. 802.11b
  5. 802.11ac
✓ Correct Answer: B, C
802.11n (Wi-Fi 4) and 802.11ax (Wi-Fi 6) operate in both the 2.4 GHz and 5 GHz bands. 802.11b/g operate only in 2.4 GHz, and 802.11a/ac operate only in 5 GHz.
Q15 Network Fundamentals
A network administrator is designing an IPv4 addressing scheme and requires these subnets: 1 subnet of 100 hosts, 2 subnets of 80 hosts, 2 subnets of 30 hosts, 4 subnets of 20 hosts. Which combination of subnets and masks will provide the best addressing plan?
  1. 9 subnets of 126 hosts with a 255.255.255.128 mask
  2. 3 subnets of 126 hosts with a 255.255.255.192 mask; 6 subnets of 30 hosts with a 255.255.255.240 mask
  3. 3 subnets of 126 hosts with a 255.255.255.128 mask; 6 subnets of 30 hosts with a 255.255.255.224 mask
  4. 1 subnet of 126 hosts with a 255.255.255.192 mask; 2 subnets of 80 hosts with a 255.255.255.224 mask; 6 subnets of 30 hosts with a 255.255.255.240 mask
✓ Correct Answer: C
Subnets needing 100 and 80 hosts require 7 host bits (2^7 - 2 = 126 usable), using mask 255.255.255.128. Subnets needing 30 and 20 hosts require 5 host bits (2^5 - 2 = 30 usable), using mask 255.255.255.224. This gives the most efficient VLSM design.
Q16 Network Fundamentals
What is a characteristic of the REST API?
  1. It evolved into what became SOAP.
  2. It is the most widely used API for web services.
  3. It is used for exchanging XML structured information over HTTP or SMTP.
  4. It is considered slow, complex, and rigid.
✓ Correct Answer: B
REST accounts for over 80% of all API types used for web services, making it the most widely used. SOAP (not REST) uses XML and is considered more complex and rigid. REST is lightweight, stateless, and typically uses JSON.
Q17 Network Fundamentals
A host has the IP address 192.168.10.70/26. What is the network address of the subnet this host belongs to?
  1. 192.168.10.0
  2. 192.168.10.32
  3. 192.168.10.64
  4. 192.168.10.128
✓ Correct Answer: C
/26 means 255.255.255.192 — block size of 64. Subnets: .0-.63, .64-.127, .128-.191, .192-.255. Host .70 falls in the .64 subnet. Network address = 192.168.10.64, broadcast = 192.168.10.127, usable hosts = .65-.126.
Q18 Network Fundamentals
What action takes place when a frame entering a switch has a multicast destination MAC address?
  1. The switch will forward the frame out all ports except the incoming port.
  2. The switch forwards the frame out of the specified port.
  3. The switch adds a MAC address table entry mapping for the destination MAC address and the ingress port.
  4. The switch replaces the old entry and uses the more current port.
✓ Correct Answer: A
If the destination MAC address is a broadcast or multicast address, the switch floods the frame out all ports except the receiving port. This is fundamental Layer 2 switching behavior.
Q19 Network Fundamentals
A company has been assigned the network address 192.168.100.0/24 and needs to create 6 subnets with at least 25 hosts per subnet. Which subnet mask should be used?
  1. 255.255.255.224
  2. 255.255.255.240
  3. 255.255.255.192
  4. 255.255.255.128
✓ Correct Answer: A
To create 6 subnets, 3 bits must be borrowed from the host portion (2^3 = 8 subnets). This leaves 5 host bits, providing 2^5 - 2 = 30 usable hosts per subnet, which satisfies the requirement of at least 25 hosts. The resulting mask is /27 = 255.255.255.224.
Q20 Network Fundamentals
A frame that enters a switch fails the Frame Check Sequence. Which two interface counters are incremented? (Choose two.)
  1. input errors
  2. frame
  3. giants
  4. CRC
  5. runts
✓ Correct Answer: A, D
When a frame fails the FCS check, the switch increments both the input errors counter and the CRC counter. CRC errors are a subset of input errors. This indicates that the frame was corrupted during transmission.
Q21 Network Access
What is the purpose of VLAN trunking?
  1. To increase bandwidth
  2. To carry multiple VLAN traffic over a single link
  3. To encrypt data
  4. To assign IP addresses
✓ Correct Answer: B
VLAN trunking using 802.1Q carries traffic for multiple VLANs by tagging frames with VLAN IDs. This allows a single physical link between switches to transport traffic for all VLANs, rather than requiring a separate link per VLAN.
Q22 Network Access
What is the primary purpose of the Spanning Tree Protocol (STP) in a switched network?
  1. To provide load balancing across multiple paths
  2. To prevent Layer 2 loops by blocking redundant paths
  3. To enable communication between different VLANs
  4. To provide faster convergence than routing protocols
✓ Correct Answer: B
STP prevents Layer 2 loops by placing redundant paths in a blocking state, creating a loop-free logical topology. Only one active path exists between any two switches, but blocked paths can transition to forwarding if the active path fails.

You've viewed 3 of 220 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

The Cisco Certified Network Associate (200-301) exam, administered through Pearson VUE, validates foundational networking knowledge and hands-on skills required of associate-level network engineers. The exam covers six domains ranging from network fundamentals and IP connectivity to security and automation, serving as the entry point for Cisco's professional certification hierarchy.

Candidates are expected to have at least one year of hands-on experience with Cisco equipment, including basic router and switch configuration, IP addressing, and CLI navigation. While there are no formal prerequisites, completing the official CCNA training course through Cisco U. or the Cisco Networking Academy is highly recommended. The exam is ideal for aspiring network engineers, support technicians, and IT professionals transitioning into networking roles.

The 200-301 blueprint is organized into six weighted domains, with the heaviest emphasis on IP Connectivity (25%) and Network Fundamentals (20%). Key technical concepts include single-area OSPFv2 neighbor adjacencies, HSRP/VRRP FHRP operations, VLAN trunking with 802.1Q, STP path selection with Root Guard and Loop Guard, NAT/PAT configurations, Standard and Extended ACLs, and the rapidly evolving automation domain covering REST APIs, JSON parsing, and Infrastructure as Code tools like Ansible and Terraform. Because the exam enforces a strict No-Backtracking policy, candidates must carefully review each answer before proceeding.

For candidates preparing for the 200-301 exam, our practice materials cover all six weighted domains in the same proportions as the real test — from subnetting and OSPFv2 neighbor states through STP guard mechanisms and JSON API payload structures. Each online practice question includes a detailed answer explanation that walks through the CLI configuration or packet behavior reasoning, while the downloadable PDF packages the same question bank for offline review during commutes or lab sessions without stable internet.

Ready to test your networking knowledge? Start with our free 200-301 practice test online, or download the PDF to study at your own pace.

Official Exam Domains & Weighting

To successfully pass the 200-301 exam, candidates must master the following core domains:
  • Domain 1: Network Fundamentals (20%)
Covers network device roles (routers, L2/L3 switches, NGFW/IPS, APs, WLCs), topology architectures (2-Tier, 3-Tier, Spine-Leaf, SOHO), fiber and copper cabling, TCP vs UDP, IPv4 VLSM subnetting, IPv6 address types (Global, Unique Local, Link-Local) and EUI-64, virtualization fundamentals (hypervisors, VMs, containers, VRFs), and MAC address learning/aging/flooding/switching concepts.
  • Domain 2: Network Access (20%)
Focuses on VLAN implementation, inter-switch connectivity via trunk ports and 802.1Q Native VLAN, Layer 2 discovery protocols (CDP and LLDP), EtherChannel configuration with LACP, Spanning Tree Protocol (STP/RSTP) including Root/Designated port roles, path selection, and advanced STP features (Root Guard, Loop Guard, BPDU Filter), plus Cisco Wireless Architecture and WLC management.
  • Domain 3: IP Connectivity (25%)
Tests routing table components (routing protocol code, administrative distance, metric, next-hop), hop-by-hop packet forwarding, IPv4 and IPv6 static/default/network/host routing, single-area OSPFv2 configuration and neighbor adjacency verification, and First Hop Redundancy Protocols (HSRP and VRRP) operational concepts.
  • Domain 4: IP Services (10%)
Covers Network Address Translation (NAT: Static, Dynamic, PAT), NTP client/server modes, DHCP and DNS features including relay agents, SNMP and Syslog facilities/levels, QoS fundamentals (marking, classification, queuing, congestion management), and remote management via SSH and Telnet.
  • Domain 5: Security Fundamentals (15%)
Addresses key security concepts (threats, vulnerabilities, exploits, mitigation), security program elements, device access control via local passwords and AAA/RADIUS/TACACS+, Standard and Extended IPv4 ACLs, Layer 2 security features (DHCP Snooping, Dynamic ARP Inspection, Port Security), wireless security protocols (WPA, WPA2, WPA3), and VPN architectures (site-to-site, remote access).
  • Domain 6: Automation and Programmability (10%)
Introduces the impact of automation on network management, traditional vs controller-based SDN networks, cloud device management, REST-based APIs (CRUD, HTTP verbs, authentication), JSON encoding and syntax parsing, Infrastructure as Code tools (Ansible and Terraform), and modern AI/ML concepts including Generative AI and Predictive AI in enterprise networking.

What Our Customers Say 552 verified reviews

4.9 ★★★★★★ Based on 552 reviews
★★★★★★
Only used this for a week before my 200-301 exam and it was enough. Questions are very close to the real deal.
— Katherine W.
★★★★★
I had almost given up on 200-301 after failing twice. These questions pinpointed exactly what I was missing. Third time’s the charm!
— Noah S.
★★★★★★
I used this alongside video courses for 200-301 prep. The questions helped solidify what I learned from the lectures.
— Aria N.
★★★★★★
The 200-301 explanations are gold. I learned almost as much from reviewing wrong answers as from the correct ones.
— Julian M.
★★★★★★
Excellent 200-301 question bank! The explanations teach you the concepts, not just the answers. Well worth the price.
— Amanda P.
★★★★★★
Best 200-301 prep I’ve found online. The question pool is deep and the randomized practice mode keeps you on your toes.
— Mason T.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

The current v1.1 blueprint modernizes the curriculum by removing legacy configuration management tools (such as Chef and Puppet) and adding topics crucial to modern enterprises, such as Generative AI, Predictive AI, Machine Learning, Terraform, and advanced STP features (Root Guard, Loop Guard, BPDU Filter). The core networking domains (Routing, Switching, Subnetting) remain fundamentally critical. Our practice question bank is fully aligned with the v1.1 blueprint, ensuring you study only the topics that appear on the current exam.

Cisco enforces a strict "No-Backtracking" rule. You must answer each question sequentially. Once you press "Next," your response is permanently locked in, and you cannot return to review or change any previous answers at the end of the exam. Our online mock exam simulates this exact behavior — once you submit an answer, you cannot go back, helping you practice the time management skills needed for the real test.

The CCNA certification is valid for exactly 3 years. To recertify, you must fulfill one of the following criteria before your expiration date: (1) Pass any current Associate-level exam (re-taking the CCNA or taking a DevNet/CyberOps Associate exam), (2) Pass any one core or concentration professional-level exam (CCNP level), or (3) Earn 30 Continuing Education (CE) credits through official Cisco learning paths or activities on Cisco U. Our PDF question bank includes a recertification FAQ section to help you plan your certification lifecycle.

If you do not pass the 200-301 exam, you must wait a minimum of 5 calendar days, starting the day after the failed attempt, before you are allowed to retake the same exam. If you pass the exam, you are prohibited from retaking the exact same exam within 180 days. Our practice questions help you identify weak domains before you sit for the real exam, reducing the likelihood of needing a retake.

Our 200-301 mock exam enforces the same strict No-Backtracking rule as the real Pearson VUE test — once you submit an answer and move to the next question, you cannot return to change it. The mock exam also mirrors the real exam's mix of multiple-choice, drag-and-drop, and performance-based lab questions across all six domains, helping you build the time management skills needed to complete 100-120 questions within the 120-minute window. Detailed answer explanations after each question help you learn from mistakes immediately.

Yes, the complete 200-301 question bank is available as a downloadable PDF that mirrors the online practice test content. The PDF is organized by domain (Network Fundamentals, Network Access, IP Connectivity, IP Services, Security Fundamentals, and Automation), making it easy to focus your offline review on specific weak areas such as OSPFv2 configurations, STP guard mechanisms, or JSON/REST API concepts. The PDF format is ideal for reviewing CLI commands and subnetting problems without needing a live internet connection.

The v1.1 blueprint removes legacy configuration management tools (Chef and Puppet) and adds modern DevOps concepts including Terraform, Ansible, Generative AI, Predictive AI, and Machine Learning models in enterprise networking. Our practice questions for Domain 6 reflect this updated curriculum, covering REST API CRUD operations, JSON payload parsing, and Infrastructure as Code principles that are increasingly relevant for modern network automation roles. If you are preparing for the current 200-301 exam, make sure your study materials cover these v1.1 topics — our question bank is fully updated.