What is the CCNA 200-301 exam?

The Cisco CCNA 200-301 is an associate-level networking certification exam. It covers network fundamentals, switching, routing, security, IP services, and automation. The exam is 120 minutes, approximately 100–120 questions.

A VLAN (Virtual Local Area Network) is a logical grouping of network devices that separates broadcast domains on a single switch. VLANs are defined by IEEE 802.1Q and configured with access ports (single VLAN) and trunk ports (multiple VLANs).

What is the administrative distance of OSPF?

OSPF has an administrative distance of 110. Lower AD values are preferred: Connected=0, Static=1, EIGRP=90, OSPF=110, RIP=120. AD is used to select between routes learned from different protocols.

What are the RFC 1918 private IPv4 addresses?

The private IPv4 ranges are: 10.0.0.0/8 (Class A), 172.16.0.0/12 (Class B), and 192.168.0.0/16 (Class C). These are not routed on the public internet and require NAT for internet access.

How many usable hosts are in a /26 subnet?

A /26 subnet has 64 total addresses (2^6 = 64). Minus the network address and broadcast address, there are 62 usable host addresses. The subnet mask is 255.255.255.192.

What is OSPF and how does it work?

OSPF (Open Shortest Path First) is a link-state routing protocol that uses Dijkstra's algorithm. Routers exchange LSAs to build a complete topology map. It uses cost as its metric, supports multi-area design with area 0 as the backbone, and has an administrative distance of 110.

Cisco CCNA 200-301 Practice Questions 2026

Question 01 of 150

What does OSI stand for?

Explanation: OSI (Open Systems Interconnection): 7-layer conceptual model for how network protocols communicate. Developed by ISO (International Organization for Standardization). Used as reference model — TCP/IP is the actual implementation.

Question 02 of 150

What are the 7 layers of the OSI model (bottom to top)?

Explanation: Mnemonic: 'Please Do Not Throw Sausage Pizza Away' (Physical, Data Link, Network, Transport, Session, Presentation, Application). OR bottom-up: 'All People Seem To Need Data Processing.'

Question 03 of 150

At which OSI layer does a switch operate?

Explanation: Switches operate at Layer 2 (Data Link) — using MAC addresses. Layer 3 switches can also route (Layer 3). Hubs: Layer 1. Routers: Layer 3. Firewalls: Layer 3-7.

Question 04 of 150

At which OSI layer does a router operate?

Explanation: Routers operate at Layer 3 (Network) — they forward packets based on IP addresses. They separate broadcast domains. Use routing tables and routing protocols (OSPF, EIGRP, BGP).

Question 05 of 150

What is the purpose of the MAC address?

Explanation: MAC address: 48-bit (6 bytes), hexadecimal (e.g., 00:1A:2B:3C:4D:5E). First 24 bits: OUI (vendor ID). Last 24 bits: unique identifier. Used within the same local network segment for frame delivery.

Question 06 of 150

What is the difference between a hub and a switch?

Explanation: Hub: single collision domain — all devices compete. Switch: each port = separate collision domain. Switches build MAC address tables (CAM table). All switch ports still in same broadcast domain by default.

Question 07 of 150

What is a collision domain?

Explanation: Collision domain: shared medium where CSMA/CD applies. Hub: one collision domain for all ports. Switch: separate collision domain per port (full-duplex eliminates collisions). Modern switched networks: collisions rare.

Question 08 of 150

What is a broadcast domain?

Explanation: Broadcast domain: all devices receive broadcasts. Router: separates broadcast domains (creates new ones). VLANs: separate broadcast domains logically within a switch. By default: all switch ports in same broadcast domain.

Question 09 of 150

What is a VLAN?

Explanation: VLAN: segmentation without physical separation. Defined in IEEE 802.1Q. Trunk ports carry multiple VLANs (tagged). Access ports carry single VLAN (untagged). Benefits: security, performance, simplified management.

Question 10 of 150

What is 802.1Q?

Explanation: 802.1Q (dot1q): VLAN tag inserted into Ethernet frame header. 12-bit VLAN ID field: supports 4094 VLANs (0 and 4095 reserved). Trunk ports: carry multiple VLANs. Native VLAN: untagged traffic on trunk.

Question 11 of 150

What is STP (Spanning Tree Protocol)?

Explanation: STP (IEEE 802.1D): prevents bridging loops (broadcast storms). Root bridge election: lowest bridge ID (priority + MAC). Port states: Blocking, Listening, Learning, Forwarding, Disabled. RSTP (802.1w): faster convergence.

Question 12 of 150

What is the purpose of ARP?

Explanation: ARP: host broadcasts 'Who has 192.168.1.1? Tell 192.168.1.5.' Target host replies with its MAC address. ARP cache: stores recent IP-to-MAC mappings. Gratuitous ARP: announces own IP/MAC. Proxy ARP: router responds on behalf of hosts.

Question 13 of 150

What is the subnet mask 255.255.255.0 in CIDR notation?

Explanation: 255.255.255.0 = 24 bits set to 1. CIDR notation: /24. Network portion: first 24 bits. Host portion: last 8 bits. Number of usable hosts: 2⁸ - 2 = 254.

Question 14 of 150

How many usable host addresses are in a /27 subnet?

Explanation: A /27 has 32 total addresses (2⁵ = 32). Minus 2 (network + broadcast) = 30 usable host addresses.

Question 15 of 150

What is the default gateway?

Explanation: Default gateway: the router's IP address on the local subnet. Hosts send traffic destined outside their subnet to the default gateway. Configured statically or via DHCP. Without default gateway: can only reach local subnet.

Question 16 of 150

What is DHCP?

Explanation: DHCP process: DORA — Discover (broadcast), Offer (server), Request (client), Acknowledge (server). DHCP server: assigns IP from pool. Lease time: address allocated for a duration. DHCP relay agent: for multi-subnet DHCP.

Question 17 of 150

What is DNS?

Explanation: DNS: UDP port 53 (queries), TCP port 53 (zone transfers). Hierarchy: root servers → TLD servers (.com, .org) → authoritative servers. Types: A record (IPv4), AAAA (IPv6), MX (mail), CNAME (alias).

Question 18 of 150

What is NAT?

Explanation: NAT types: Static (one-to-one), Dynamic (pool), PAT/NAT overload (many-to-one using ports). Inside local (private) → Inside global (public). RFC 1918 private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

Question 19 of 150

What are the private IPv4 address ranges?

Explanation: RFC 1918 private ranges: Class A: 10.0.0.0 - 10.255.255.255 (/8). Class B: 172.16.0.0 - 172.31.255.255 (/12). Class C: 192.168.0.0 - 192.168.255.255 (/16). Not routed on internet. Used internally.

Question 20 of 150

What is the loopback address in IPv4?

Explanation: Loopback: 127.0.0.1 (or entire 127.0.0.0/8). Used to test the TCP/IP stack on local device. 'Ping 127.0.0.1' tests if IP is working. Also: 127.0.0.1 = localhost. Never routed to network.

Question 21 of 150

What TCP port does HTTPS use?

Explanation: HTTPS: TCP port 443. HTTP: TCP port 80. HTTPS: HTTP over TLS/SSL. Certificate validates server identity. All web traffic should use HTTPS (encrypted).

Question 22 of 150

What is the difference between TCP and UDP?

Explanation: TCP: three-way handshake (SYN, SYN-ACK, ACK). Flow control, congestion control. Error recovery. UDP: no connection, no guarantee. Applications: DNS/DHCP (UDP). HTTP/S, FTP, SSH, Telnet (TCP). VoIP/video streaming (UDP — latency > reliability).

Question 23 of 150

What is the three-way TCP handshake?

Explanation: Three-way handshake: Client sends SYN. Server responds SYN-ACK. Client sends ACK. Connection established. After data: FIN-ACK exchange (four-step teardown). Ensures both sides ready before transmitting.

Question 24 of 150

What is OSPF?

Explanation: OSPF: link-state. Areas: area 0 = backbone. Multi-area reduces overhead. Metric: cost (reference bandwidth/interface bandwidth). Convergence: fast. Supports VLSM. OSPF packet types: Hello, DBD, LSR, LSU, LSAck.

Question 25 of 150

What is the OSPF hello interval and dead interval on a broadcast network?

Explanation: Default OSPF timers on broadcast (Ethernet): Hello = 10 seconds. Dead = 40 seconds (4 × Hello). On point-to-point serial: Hello = 10s, Dead = 40s. Non-broadcast: Hello = 30s, Dead = 120s. Must match to form adjacency.

Question 26 of 150

What is the administrative distance (AD) of OSPF?

Explanation: AD values: Connected=0, Static=1, EIGRP=90, OSPF=110, RIP=120, BGP external=20. Lower AD = more trusted. AD used to select between routes from different routing protocols.

Question 27 of 150

What is BGP?

Explanation: BGP (BGP4): exterior gateway protocol. ASN (Autonomous System Number). iBGP (within AS), eBGP (between AS). Policy-based routing. No automatic metric — attributes: AS path, local preference, MED. Very complex.

Question 28 of 150

What is a default route?

Explanation: Default route: 'gateway of last resort.' 0.0.0.0/0 matches everything. Typically: points to ISP router. Configured: 'ip route 0.0.0.0 0.0.0.0 [next-hop]'. Propagated to other routers via routing protocols.

Question 29 of 150

What is the difference between static and dynamic routing?

Explanation: Static: simple, predictable, no bandwidth overhead. Best: small networks, default routes, stub networks. Dynamic: scalable, automatic, adapts to topology changes. Best: medium-large networks. Both used together in practice.

Question 30 of 150

What is IPv6?

Explanation: IPv6: 128 bits (vs 32 IPv4). Written: 8 groups of 4 hex digits. Abbreviations: remove leading zeros, replace consecutive all-zero groups with '::' (once). No broadcast — uses multicast and anycast. Built-in IPsec. SLAAC for auto-configuration.

Question 31 of 150

What is an IPv6 link-local address?

Explanation: Link-local: fe80::/10. Every IPv6-enabled interface gets one automatically. Used for: neighbor discovery, OSPF adjacencies, default gateway. Not routed beyond the link. Scope: single link only.

Question 32 of 150

What is SSH?

Explanation: SSH: encrypted CLI access to routers and switches. Uses public key cryptography + symmetric encryption. Configure: generate RSA keys, set transport input ssh, create local user. Telnet sends credentials in clear text — never use in production.

Question 33 of 150

What is an ACL?

Explanation: ACL types: Standard (source IP only, applied close to destination), Extended (source+destination IP + ports + protocol, applied close to source). Implicit deny: all traffic not explicitly permitted is denied. Applied: in or out on interface.

Question 34 of 150

What is the purpose of NAT PAT?

Explanation: PAT: also called NAT overload. One public IP serves entire network. Uses source port numbers to track connections. Home routers use PAT. Translation table: private IP + port ↔ public IP + port. Scales to thousands of simultaneous connections.

Question 35 of 150

What does DHCP snooping do?

Explanation: DHCP snooping: trusted ports (connected to legitimate DHCP servers), untrusted ports (client-facing). Blocks: DHCPOFFER and DHCPACK from untrusted ports. Binding table: maps MAC, IP, VLAN, port, lease time. Prevents IP spoofing.

Question 36 of 150

What is dynamic ARP inspection (DAI)?

Explanation: DAI: validates ARP packets against DHCP snooping binding table. Drops ARP packets with invalid IP-to-MAC mappings. Configured on trusted/untrusted ports (same as DHCP snooping). Prevents man-in-the-middle attacks using ARP poisoning.

Question 37 of 150

What is port security?

Explanation: Port security: maximum MAC addresses per port. Violation actions: Shutdown (default, err-disable), Restrict (drops + SNMP log), Protect (drops, no notification). Sticky MAC: dynamically learned MACs saved to running config.

Question 38 of 150

What is WPA2?

Explanation: WPA2: IEEE 802.11i. AES-CCMP encryption (vs WPA's TKIP). Two modes: Personal (PSK — pre-shared key), Enterprise (802.1X authentication with RADIUS server). WPA3: newer, stronger (SAE, 192-bit security). WEP: broken, never use.

Question 39 of 150

What is an IOS router interface configuration command to set an IP address?

Explanation: Example: R1(config)# interface GigabitEthernet0/0 R1(config-if)# ip address 192.168.1.1 255.255.255.0 R1(config-if)# no shutdown Verify: show interfaces or show ip interface brief.

Question 40 of 150

What does the command 'show ip route' display?

Explanation: 'show ip route': routing table. Legend: C=Connected, S=Static, O=OSPF, D=EIGRP, R=RIP. Format: O 10.0.0.0/8 [110/2] via 192.168.1.1, 00:05:23, GigabitEthernet0/0. Shows: protocol, network, AD, metric, next hop, age, interface.

Question 41 of 150

What command shows MAC address table on a Cisco switch?

Explanation: 'show mac address-table': displays MAC address table (CAM table). Shows: VLAN, MAC address, type (dynamic/static), port. Dynamic: learned from received frames. Static: manually configured. Aged out if no traffic received (default 5 minutes).

Question 42 of 150

What is a trunk port on a Cisco switch?

Explanation: Trunk port: carries traffic for multiple VLANs. Configured: 'switchport mode trunk'. 802.1Q tags added/removed. Native VLAN: untagged (default VLAN 1). Access port: carries single VLAN, untagged. Trunks: between switches, or switch to router/server.

Question 43 of 150

What is inter-VLAN routing?

Explanation: Inter-VLAN routing methods: 1) Router-on-a-stick: one router port with subinterfaces per VLAN. 2) Layer 3 switch with SVIs (Switch Virtual Interfaces). 3) Separate physical router interfaces per VLAN. Layer 3 switch most common in enterprise.

Question 44 of 150

What is EtherChannel?

Explanation: EtherChannel (Port-Channel): LACP (IEEE 802.3ad) or PAgP (Cisco proprietary). Bundles 2-8 links. STP sees as single logical link. Load balances: source/destination MAC, IP, port combinations. Verify: 'show etherchannel summary'.

Question 45 of 150

What is OSPF area 0?

Explanation: OSPF backbone area (area 0): all areas must connect here. ABR (Area Border Router): connects areas to area 0. ASBR (Autonomous System Boundary Router): connects OSPF to other routing domains. Multi-area OSPF reduces LSA flooding.

Question 46 of 150

What is the OSPF router ID?

Explanation: OSPF RID: used in LSA identification. Best practice: configure manually ('router-id [address]') for stability. Loopback: stable (never goes down). Active interface: changes if interface changes. RID change: requires OSPF process restart.

Question 47 of 150

What is a loopback interface?

Explanation: Loopback: 'interface loopback [number]'. Always up/up (no physical dependency). Used: OSPF RID, BGP update source, management IP, testing. Not the same as 127.0.0.1 loopback address (that's a host loopback, not a router interface).

Question 48 of 150

What is CDP?

Explanation: CDP: enabled by default on Cisco devices. 'show cdp neighbors': lists adjacent Cisco devices. 'show cdp neighbors detail': full details including IP addresses. Security: disable on untrusted interfaces ('no cdp enable'). LLDP: IEEE 802.1AB equivalent.

Question 49 of 150

What is LLDP?

Explanation: LLDP: enabled globally then per interface. 'show lldp neighbors': adjacent devices. Works with: Cisco, HP, Juniper, etc. Enable: 'lldp run' (global), 'lldp transmit'/'lldp receive' (interface). CDP: Cisco-only. LLDP: open standard.

Question 50 of 150

What is FHRP (First Hop Redundancy Protocol)?

Explanation: FHRP: HSRP (Hot Standby Router Protocol): Cisco proprietary. Active/Standby. Virtual IP and MAC. VRRP: IEEE 802.1AC. Master/Backup. GLBP: Cisco, load balancing. All: provide seamless gateway redundancy — clients use virtual IP, don't notice failover.

Question 51 of 150

What is QoS?

Explanation: QoS: DSCP (Differentiated Services Code Point) marks packets for priority. Classifications: voice (EF), interactive video (AF), data (BE). Queuing: priority queue for voice. Policing and shaping: control bandwidth. NBAR: application classification.

Question 52 of 150

What is SVI?

Explanation: SVI: 'interface vlan [number]'. Assign IP for inter-VLAN routing. Management SVI: SSH/Telnet access to switch. SVI is up when: VLAN exists, VLAN active, at least one access/trunk port up with that VLAN. Verify: 'show interface vlan [number]'.

Question 53 of 150

What is APIC-EM?

Explanation: APIC-EM: Cisco SDN controller. Path trace, EasyQoS, network visualisation. Succeeded by Cisco DNA Center (DNAC). DNA Center: intent-based networking, automation, assurance. CCNA covers: APIC-EM/DNA Center concepts for automation domain.

Question 54 of 150

What is SD-WAN?

Explanation: SD-WAN: Cisco Viptela (vManage, vBond, vSmart, vEdge). Central management. Overlay: multiple underlay connections (MPLS, internet, LTE). Benefits: lower cost than MPLS-only, application-aware routing, centralised policy. CCNA: basic SD-WAN concepts.

Question 55 of 150

What is JSON?

Explanation: JSON: human-readable, easy to parse. Uses: {key: value} pairs, arrays []. Used in: REST APIs, Cisco NETCONF/RESTCONF. Alternatives: XML, YAML. CCNA: understand JSON structure for automation/programmability questions.

Question 56 of 150

What is a REST API?

Explanation: REST API: stateless, uses HTTP verbs. GET: retrieve data. POST: create. PUT: update. DELETE: remove. Response: typically JSON or XML. Cisco DNA Center has REST API. Used with Python or Ansible to automate network tasks.

Question 57 of 150

What is NETCONF?

Explanation: NETCONF: RFC 6241. Uses: SSH (TCP port 830). Data: XML with YANG models. Operations: get, get-config, edit-config, lock, unlock, commit. RESTCONF: REST-based alternative to NETCONF using HTTP.

Question 58 of 150

What is Ansible for network automation?

Explanation: Ansible: agentless (no software on managed device). Playbooks: YAML. Modules: ios_command, ios_config, nxos_config. Push model: Ansible server pushes to devices. Easy to learn. Compare: Puppet/Chef (pull model, agent-based).

Question 59 of 150

What is the purpose of NTP?

Explanation: NTP: UDP port 123. Stratum: distance from reference clock. Stratum 1: connected to atomic clock. Stratum 2: syncs from stratum 1. 'ntp server [ip]'. 'show ntp status'. Logs with consistent timestamps: critical for troubleshooting and SIEM correlation.

Question 60 of 150

What is SNMP?

Explanation: SNMP v3 (recommended): authentication + encryption. MIB (Management Information Base): structured data. OID: unique identifier for each piece of data. Operations: GET, GET-NEXT, SET, TRAP (unsolicited alerts). Versions: v1, v2c (community string), v3 (secure).

Question 61 of 150

What is a trunk allowed VLAN list?

Explanation: Trunk allowed VLANs: by default all active VLANs traverse trunk. Restrict: 'switchport trunk allowed vlan [list]'. Verify: 'show interfaces trunk'. Security: only permit required VLANs on trunks. Prune unused VLANs.

Question 62 of 150

What is STP root bridge election?

Explanation: Bridge ID: 16-bit priority (32768 default) + 48-bit MAC. Lowest BID = root bridge. Best practice: manually set priority ('spanning-tree vlan [x] priority [value]') to ensure correct switch becomes root. Verify: 'show spanning-tree'.

Question 63 of 150

What is RSTP?

Explanation: RSTP: port roles: Root, Designated, Alternate (blocks), Backup. Edge ports (PortFast): immediately forward. Rapid: handshake mechanism. Convergence: <1 second vs STP 30-50 seconds. PVST+: Cisco per-VLAN STP (one STP instance per VLAN).

Question 64 of 150

What is PortFast?

Explanation: PortFast: 'spanning-tree portfast' (interface) or 'spanning-tree portfast default' (global for all access ports). Only on ports connected to end devices (PCs, printers). Never on ports connected to switches (creates loops). BPDU Guard: err-disables port if BPDU received.

Question 65 of 150

What is BPDU Guard?

Explanation: BPDU Guard: 'spanning-tree bpduguard enable' (interface) or with PortFast default (global). If BPDU received on protected port: port goes to err-disabled state. Recovery: manual 'shutdown/no shutdown' or err-disable recovery timer.

Question 66 of 150

What is the difference between distance vector and link state routing?

Explanation: Distance vector (RIP): simple, slow convergence, routing by rumour, count-to-infinity problem. Link state (OSPF, IS-IS): each router has full topology map, faster convergence, scalable, more CPU/memory. EIGRP: advanced distance vector (hybrid).

Question 67 of 150

What is EIGRP?

Explanation: EIGRP: metric: bandwidth + delay (default). DUAL algorithm: successor + feasible successor. Fast convergence. Supports: VLSM, summarisation, authentication. AD: internal=90, external=170. 'show ip eigrp neighbors', 'show ip eigrp topology'.

Question 68 of 150

What is the purpose of Syslog?

Explanation: Syslog: UDP port 514. Levels: 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, 7 Debug. 'logging [server-ip]'. 'logging trap [level]'. Higher number = less severe. Configure: send to centralised server (SIEM).

Question 69 of 150

What is HSRP?

Explanation: HSRP: active router handles traffic. Standby monitors. Virtual IP: shared. Virtual MAC: 0000.0C07.ACXX (XX = group number). Preempt: allows higher-priority router to take over. Versions: v1 (group 0-255), v2 (0-4095). Track: adjust priority based on interface state.

Question 70 of 150

What is the 'show ip interface brief' command?

Explanation: 'show ip interface brief' (or 'sh ip int br'): compact table showing: Interface, IP-Address, OK?, Method, Status, Protocol. Status up/Protocol up: fully working. Status up/Protocol down: Layer 2 issue. Status down: Layer 1 (cable/power).

Question 71 of 150

What is a /30 subnet used for?

Explanation: /30 subnet: 2³⁰ = 4 addresses total. 4 - 2 = 2 usable hosts. Perfect for point-to-point: one address each end. Subnet mask: 255.255.255.252. Even more efficient: /31 (RFC 3021, 2 addresses, no broadcast for p2p) or /127 (IPv6 p2p).

Question 72 of 150

What is subnetting?

Explanation: Subnetting: borrow host bits for network bits. /24 → /25: 2 subnets, 126 hosts each. /26: 4 subnets, 62 hosts. Magic number: 256 - subnet mask last octet. Block size: 256-192=64. Subnets: 0, 64, 128, 192.

Question 73 of 150

What is VLSM?

Explanation: VLSM: different subnets can have different sizes. /24 network: divide /27 for 30-host subnet, /30 for point-to-point. Classful routing (RIPv1): doesn't support VLSM. Classless (OSPF, EIGRP, RIPv2): supports VLSM.

Question 74 of 150

What is the purpose of an ACL 'implicit deny'?

Explanation: Implicit deny: every ACL ends with: 'deny any any' (not shown in config). Effect: if no permit matches, traffic is denied. Common mistake: create ACL, apply to interface, accidentally block all traffic. Always verify ACL doesn't block needed traffic.

Question 75 of 150

What is 802.11ac Wi-Fi?

Explanation: 802.11 standards: b (2.4GHz, 11Mbps), g (2.4GHz, 54Mbps), n (2.4/5GHz, 600Mbps, MIMO), ac/Wi-Fi 5 (5GHz, 3.5Gbps), ax/Wi-Fi 6 (2.4/5GHz, 9.6Gbps). 5GHz: faster, shorter range. 2.4GHz: slower, longer range, more interference.

Question 76 of 150

What is the difference between unicast, multicast, and broadcast?

Explanation: Unicast: specific destination IP/MAC. Multicast: group address (224.0.0.0/4 IPv4). Broadcast: 255.255.255.255 or subnet broadcast. IPv6: no broadcast — uses multicast. Anycast: one sender, nearest receiver.

Question 77 of 150

What is a DHCP address pool and scope?

Explanation: DHCP pool config: 'ip dhcp pool [name]', 'network [network] [mask]', 'default-router [gateway]', 'dns-server [DNS-IP]', 'lease [days]'. Exclusions: 'ip dhcp excluded-address [start] [end]'. Conflict detection: DHCP ping (Cisco).

Question 78 of 150

What is a network access control list vs extended?

Explanation: Standard ACL: 'access-list 1 permit 192.168.1.0 0.0.0.255'. Applied close to destination. Extended ACL: 'access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 80'. Applied close to source. Named ACLs: 'ip access-list [standard|extended] [name]'.

Question 79 of 150

What command shows VLAN information on a Cisco switch?

Explanation: 'show vlan brief': displays all VLANs, their names, status, and assigned ports. 'show vlan id [number]': specific VLAN details. 'show interfaces trunk': shows trunk ports, allowed VLANs, active VLANs.

Question 80 of 150

What is the significance of TCP port 22 vs 23?

Explanation: SSH (port 22): encrypts all data including credentials. Requires: RSA keys, VTY lines configured for SSH, AAA or local users. Telnet (port 23): plain text — sniffable. Never use Telnet in production environments. 'transport input ssh' on VTY lines.

Question 81 of 150

What is an EtherChannel LACP command?

Explanation: LACP: 802.3ad. Modes: active (sends LACP packets), passive (responds only). Both active: forms. Active+passive: forms. PAgP (Cisco): desirable+desirable or desirable+auto. Static: mode on (no negotiation). Port-channel interface: carries VLANs, spanning tree sees as one link.

Question 82 of 150

What does 'no shutdown' do on a Cisco interface?

Explanation: Router interfaces: admin down by default. 'interface g0/0', then 'no shutdown'. Switch ports: active by default. Check: 'show interfaces [interface]' — Status should change from 'administratively down' to 'up'.

Question 83 of 150

What is the wildcard mask in an OSPF or ACL command?

Explanation: Wildcard mask: inverse of subnet mask. /24 → 0.0.0.255. /25 → 0.0.0.127. /28 → 0.0.0.15. 0.0.0.0 = exact match. 255.255.255.255 = any. OSPF: 'network 10.0.0.0 0.0.0.255 area 0'. ACL: 'permit 192.168.0.0 0.0.255.255'.

Question 84 of 150

What does 'ip helper-address' do?

Explanation: ip helper-address: on router interface facing clients. 'ip helper-address [DHCP-server-IP]'. Converts DHCP Discover (broadcast) to unicast forward to DHCP server. Also forwards: DNS, TFTP, TACACS, NTP broadcasts by default.

Question 85 of 150

What is the purpose of 'spanning-tree portfast bpduguard default'?

Explanation: Global BPDU Guard with PortFast: 'spanning-tree portfast bpduguard default'. Enables: PortFast globally + BPDU Guard on PortFast ports. Security: prevents unauthorised switches on access ports. Recovery: 'errdisable recovery cause bpduguard' + timer.

Question 86 of 150

What is an IPv6 global unicast address?

Explanation: IPv6 global unicast: 2000::/3. ISP allocates /48 prefix to organisations. Site divides into /64 subnets (each VLAN/segment). Interface ID: last 64 bits. EUI-64: derived from MAC address. SLAAC: automatic configuration using Router Advertisement.

Question 87 of 150

What is SLAAC?

Explanation: SLAAC: host uses Router Advertisement (RA) to learn: network prefix (/64). Host: combines prefix + EUI-64 (from MAC). No DHCP server needed. DNS info: Router Advertisement or DHCPv6 (stateless DHCPv6: provides DNS but not IP).

Question 88 of 150

What are common well-known TCP/UDP ports for CCNA?

Explanation: Key ports: FTP (20/21 TCP), SSH (22 TCP), Telnet (23 TCP), SMTP (25 TCP), DNS (53 UDP/TCP), DHCP (67/68 UDP), HTTP (80 TCP), HTTPS (443 TCP), SNMP (161/162 UDP), Syslog (514 UDP), NTP (123 UDP).

Question 89 of 150

What is the command to configure a static route on Cisco IOS?

Explanation: 'ip route [destination network] [subnet mask] [next-hop IP or exit interface]'. Example: 'ip route 10.0.0.0 255.255.255.0 192.168.1.1'. Floating static: add higher AD. Default: 'ip route 0.0.0.0 0.0.0.0 192.168.1.1'.

Question 90 of 150

What is the command to enable OSPF and configure a network?

Explanation: 'router ospf 1' (process ID: locally significant). 'network 10.0.0.0 0.0.0.255 area 0'. Interfaces matching the network statement will run OSPF. Or: per-interface 'ip ospf 1 area 0'.

Question 91 of 150

What is the command to verify OSPF neighbours?

Explanation: 'show ip ospf neighbor': shows OSPF neighbour state. States: FULL = adjacency formed. 2WAY = DR/BDR election. INIT/EXSTART/EXCHANGE/LOADING: transitional states. Full adjacency required to exchange routing info.

Question 92 of 150

What is the OSPF DR and BDR?

Explanation: DR/BDR election: highest OSPF priority (default 1), then highest RID. All routers form adjacency with DR/BDR only. DR = full adjacency. BDR = full adjacency. DROther = 2WAY with other DROthers. DR election: non-preemptive by default.

Question 93 of 150

What command displays the routing table?

Explanation: 'show ip route' (IPv4), 'show ipv6 route' (IPv6). Output: C (connected), S (static), O (OSPF), D (EIGRP), R (RIP). Route entry: [AD/metric] via [next-hop], [age], [interface]. Best path: lowest AD first, then lowest metric.

Question 94 of 150

What is NAT configuration on Cisco IOS?

Explanation: 'ip nat inside' (LAN interface), 'ip nat outside' (WAN interface). PAT: 'ip nat inside source list [ACL] interface [outside] overload'. Pool: 'ip nat pool [name] [start] [end] netmask [mask]'. Verify: 'show ip nat translations'.

Question 95 of 150

What is the purpose of IP SLA?

Explanation: IP SLA: 'ip sla [number]', 'icmp-echo [target]', 'frequency [seconds]'. Track: 'track [number] ip sla [number] reachability'. Use track in: static routes ('ip route ... track [number]') for floating static route failover.

Question 96 of 150

What does 'service password-encryption' do?

Explanation: 'service password-encryption': Type 7 (weak, reversible). 'enable secret [password]': Type 5 (MD5) or Type 8/9 (SHA). Best practice: use 'enable secret', not 'enable password'. Type 7: can be decoded online easily.

Question 97 of 150

What is the 'enable secret' command?

Explanation: 'enable secret [password]': stored as MD5 hash (Type 5). If both 'enable secret' and 'enable password': secret takes precedence. Modern IOS: Type 8 (PBKDF2-SHA256) or Type 9 (scrypt) available for stronger hashing.

Question 98 of 150

What is the purpose of 'login local' on VTY lines?

Explanation: VTY configuration: 'line vty 0 4', 'login local' (use local usernames), 'username [name] privilege 15 secret [password]'. Without login: no auth required. 'login': uses line password only. 'login local': uses username/password database.

Question 99 of 150

What is the difference between 'shutdown' and 'no shutdown' on a Cisco interface?

Explanation: 'shutdown': interface goes admin down. Status: 'administratively down'. 'no shutdown': enables interface. Router interfaces: admin down by default. Switch access/trunk ports: not admin down by default. Verify: 'show interfaces' or 'show ip int brief'.

Question 100 of 150

What is an OSPF passive interface?

Explanation: Passive interface: 'router ospf 1', 'passive-interface [interface]'. Or 'passive-interface default' then 'no passive-interface [active interfaces]'. Use on: LAN interfaces without OSPF neighbours, loopbacks. Prevents: unnecessary OSPF traffic to hosts.

Question 101 of 150

What is a floating static route?

Explanation: Floating static: 'ip route [dest] [mask] [next-hop] [AD]'. Default static AD=1. Floating: set higher (e.g., 5). If OSPF route (AD 110) exists: static won't be used. If OSPF fails: static floats into routing table. Backup path.

Question 102 of 150

What is the purpose of the 'show version' command?

Explanation: 'show version': IOS version, hostname, uptime, reload reason, boot image, hardware, interfaces, memory (DRAM, Flash). Serial number. Configuration register (0x2102 = normal boot). Useful: licence info, hardware inventory.

Question 103 of 150

What is TFTP used for in networking?

Explanation: TFTP: UDP 69, simple, no authentication, no directory listing. Used in Cisco environments for: IOS upgrades ('copy tftp flash'), config backups ('copy running-config tftp'), disaster recovery (ROMMON TFTP boot). Not secure — use SFTP in production.

Question 104 of 150

What does 'copy running-config startup-config' do?

Explanation: 'copy run start' (abbreviated). If not saved: reload loses all config. 'write memory' (old equivalent). Important: always save after making changes. Verify: 'show startup-config' (NVRAM) vs 'show running-config' (RAM).

Question 105 of 150

What is the purpose of 'ip domain-name' and 'crypto key generate rsa' for SSH?

Explanation: SSH prerequisites: 1) hostname (not 'Router'/'Switch'). 2) ip domain-name. 3) crypto key generate rsa (2048+ bits). 4) username with password. 5) 'line vty 0 15', 'login local', 'transport input ssh'. 6) 'ip ssh version 2'. Verify: 'show ip ssh'.

Question 106 of 150

What is a management VLAN?

Explanation: Management VLAN: 'interface vlan [number]', assign IP, 'no shutdown'. Use for: SSH to switch. Best practice: not VLAN 1 (security). Change: 'ip management-vlan [number]' or configure SVI. Separate from user data VLANs.

Question 107 of 150

What is the purpose of NTP in a network?

Explanation: NTP: 'ntp server [ip]'. Verify: 'show ntp status'. Stratum 1: reference clock. Stratum 2: synced to stratum 1. Without NTP: log timestamps unreliable, certificates fail, troubleshooting difficult. Critical for SIEM log correlation.

Question 108 of 150

What is the difference between a routed port and an SVI on a Layer 3 switch?

Explanation: Routed port: 'no switchport' (removes Layer 2 function), then 'ip address'. SVI: 'interface vlan [number]', 'ip address'. Both: enable routing. Use routed port: point-to-point between switches/routers. SVI: inter-VLAN routing.

Question 109 of 150

What is the Cisco IOS privilege level system?

Explanation: Privilege levels: 1 (user mode): show commands only. 15 (privileged mode): all commands. Custom (2-14): restrict specific commands. 'enable privilege 15' or 'privilege exec level [n] [command]'. TACACS+: can assign per-user privilege levels.

Question 110 of 150

What is the 802.1X port authentication?

Explanation: 802.1X: Supplicant (client), Authenticator (switch), Authentication Server (RADIUS). EAP (Extensible Authentication Protocol) over LAN (EAPOL). Until authenticated: only EAP traffic permitted. After: port placed in correct VLAN. Enterprise WiFi uses 802.1X.

Question 111 of 150

What does 'traceroute' (or 'tracert') show?

Explanation: Traceroute: sends packets with TTL=1, 2, 3... Each router decrements TTL; when TTL=0: router sends ICMP Time Exceeded back. Identifies: path taken, latency at each hop, where packets stop. '* * *': no ICMP response (firewall/ACL). Use: network troubleshooting.

Question 112 of 150

What is the purpose of 'ip dhcp excluded-address'?

Explanation: 'ip dhcp excluded-address [start] [end]'. Applied globally (before pool config). Best practice: exclude at least the default gateway IP. Example: exclude 192.168.1.1-192.168.1.10 for networking devices.

Question 113 of 150

What is the purpose of show cdp neighbors detail?

Explanation: 'show cdp neighbors detail': more info than 'show cdp neighbors'. Shows: native VLAN, device capabilities, IP address, software version. Caution: disable CDP on edge/internet-facing ports ('no cdp enable' on interface) — security concern.

Question 114 of 150

What is the 'ping' command used for in networking?

Explanation: Ping: ICMP Echo Request/Reply. 'ping [destination]'. Extended ping: specify source, size, count, timeout. If ping fails: check: cable, interface status, IP config, routing, ACLs, firewall. Ping success: Layer 3 connectivity confirmed.

Question 115 of 150

What does 'show ip ospf interface' show?

Explanation: 'show ip ospf interface': interface in OSPF, area, DR/BDR status, hello/dead interval, cost, network type. Verify: timers match between neighbours (must match for adjacency). 'show ip ospf interface brief': compact summary.

Question 116 of 150

What is the 'debug ip ospf events' command?

Explanation: Debug commands: use carefully in production. 'debug ip ospf events': shows OSPF events. 'undebug all' or 'no debug all': stops all debugging. On busy networks: debug can overwhelm CPU. Use: logging buffered or in maintenance window.

Question 117 of 150

What is the BGP ASN for private use?

Explanation: ASN ranges: 1-64511: public (IANA assigned). 64512-65535: private (like RFC 1918 for IPs). 4-byte ASNs: 131072-4294967294 public, 4200000000-4294967294 private. SA: use private ASNs for internal BGP labs.

Question 118 of 150

What command saves the running configuration in modern IOS?

Explanation: 'copy running-config startup-config' (full form) = 'copy run start' = 'write memory' = 'wr'. All save RAM config to NVRAM. Modern IOS: all work. Verify: 'show startup-config' confirms saved config.

Question 119 of 150

What is 'ip routing' command on a multilayer switch?

Explanation: 'ip routing': enables IPv4 routing on multilayer switch. Without it: SVIs have IPs but switch won't route between VLANs. Verify: 'show ip route' should show routes. Some models: routing enabled by default. 'ipv6 unicast-routing': for IPv6.

Question 120 of 150

What is the difference between FQDN and hostname?

Explanation: FQDN: www.cisco.com (complete path to host). Hostname: www. Domain: cisco.com. In Cisco IOS: hostname sets device name. ip domain-name sets domain. Together: FQDN for SSH key generation. DNS: resolves FQDNs to IPs.

Question 121 of 150

What is a VLAN access port?

Explanation: Access port: 'switchport mode access', 'switchport access vlan [number]'. Untagged frames. Devices: PCs, printers, phones. VLAN assigned here. 802.1Q tag: added when entering switch, removed when leaving access port.

Question 122 of 150

What is the difference between half-duplex and full-duplex?

Explanation: Half-duplex: CSMA/CD (collision detection). Hubs: half-duplex. Full-duplex: modern switches, no collisions, higher throughput. 1Gbps full-duplex: twice the throughput of half-duplex. Auto-negotiation: default on switch ports.

Question 123 of 150

What is IPv4 address class A, B, C?

Explanation: Classful addressing (legacy): A (0xxxxxxx, /8, 16m hosts). B (10xxxxxx, /16, 65k hosts). C (110xxxxx, /24, 254 hosts). D (224-239): multicast. E (240-255): experimental. Modern: classless (CIDR) — subnet mask determines network size.

Question 124 of 150

What is a Cisco switch 'show interfaces' output field 'CRC errors'?

Explanation: CRC errors: high count = physical problem. Causes: damaged/too-long cables, EMI interference, duplex mismatch (half+full duplex = CRC errors + runts + late collisions). 'show interfaces [interface]': CRC, input errors, output drops counters.

Question 125 of 150

What is the purpose of ICMP?

Explanation: ICMP: Layer 3 protocol. Types: Echo Request/Reply (ping). Destination Unreachable. Time Exceeded (traceroute uses this). Redirect. No route found. ICMP not routed by some firewalls. IPv6: uses ICMPv6 for neighbour discovery (replacing ARP).

Question 126 of 150

What is a transitive ACL?

Explanation: Tour tests knowledge that 'transitive ACL' is not a Cisco IOS ACL type. Standard (source IP only), Extended (src+dst+proto+port), Named (can be standard or extended). Reflexive ACL: permits return traffic dynamically. Time-based ACL: active during specified times.

Question 127 of 150

What is the function of the transport layer?

Explanation: Transport layer (Layer 4): TCP/UDP. Segmentation: breaks data into segments. Port numbers: identify applications. TCP: connection-oriented, acknowledgements, retransmission. UDP: connectionless, no ACK. Multiplexing: multiple apps share network.

Question 128 of 150

What is CEF (Cisco Express Forwarding)?

Explanation: CEF: hardware-assisted forwarding. FIB: built from routing table. Adjacency table: next-hop MAC addresses. Advantages: faster than process switching, consistent, less CPU use. 'show ip cef': displays FIB. Enabled by default on most Cisco platforms.

Question 129 of 150

What is the purpose of a DMZ in network design?

Explanation: DMZ: public servers accessible from internet without risking internal network. Firewall: internet → DMZ (controlled). DMZ → internal (restricted). Example: web server in DMZ; employee PCs internal. Perimeter security concept.

Question 130 of 150

What command verifies SSH is enabled on a Cisco device?

Explanation: 'show ip ssh': shows SSH version, timeout, and status. Output: 'SSH Enabled - version 2.0'. 'show ssh': active SSH sessions. Verify: version 2 enabled, RSA keys generated, VTY configured for SSH. Prerequisites: hostname, domain name, RSA keys.

Question 131 of 150

What is a subnet's broadcast address?

Explanation: Broadcast: last address in subnet. For 192.168.1.0/24: broadcast = 192.168.1.255. For 192.168.1.0/26: broadcast = 192.168.1.63. Formula: network address + (2^host_bits - 1). Routers: don't forward directed broadcasts by default.

Question 132 of 150

What is a network address?

Explanation: Network address: first in subnet. 192.168.1.0/24: network = 192.168.1.0. 192.168.1.64/26: network = 192.168.1.64. Formula: IP address ANDed with subnet mask. Not assignable to host. Appears in routing table entries.

Question 133 of 150

What is the function of a firewall?

Explanation: Firewall types: Packet filtering (ACLs), Stateful (tracks connections), Application Layer (Layer 7), Next-Generation (NGFW: IDS/IPS, application awareness). Cisco: ASA (legacy), Firepower (NGFW). Position: edge of network, between segments.

Question 134 of 150

What is the maximum transmission unit (MTU)?

Explanation: MTU: standard Ethernet = 1500 bytes. If packet larger: fragmented (IPv4) or dropped with ICMPv6 'Packet Too Big' (IPv6). Jumbo frames (9000 bytes): SANs, data centres — improves throughput. Path MTU Discovery: finds smallest MTU along path.

Question 135 of 150

What is Cisco IOS Software Licensing?

Explanation: Traditional licensing: feature sets (IP Base, IP Services, Advanced IP). DNA license: Advantage, Essentials (Catalyst 9000 series). Smart Licensing: devices register with Cisco Smart Account, licenses tracked in cloud. 'show license' or 'show version' displays current license.

Question 136 of 150

What port does RADIUS use?

Explanation: RADIUS: UDP 1812 (authentication/authorisation), UDP 1813 (accounting). TACACS+: TCP 49. RADIUS: open standard (RFC 2865). TACACS+: Cisco proprietary. Difference: TACACS+ encrypts full packet. RADIUS: encrypts only password. TACACS+: separate auth, authz, accounting.

Question 137 of 150

What is the purpose of 'switchport trunk native vlan [number]'?

Explanation: Native VLAN: untagged on trunk. Default: VLAN 1. Attack: VLAN hopping (double-tagging against native VLAN 1). Mitigation: change native VLAN to unused VLAN ('switchport trunk native vlan 999') and don't put any devices on it.

Question 138 of 150

What is AAA in network security?

Explanation: AAA: Authentication (verify identity: password, certificate, MFA). Authorisation (define privileges: which commands/resources). Accounting (log actions: who did what, when). Implemented: RADIUS, TACACS+. Cisco IOS: 'aaa new-model' to enable.

Question 139 of 150

What is the command to set OSPF priority on an interface?

Explanation: 'ip ospf priority [0-255]' on interface. Default: 1. Higher priority: more likely to become DR. Priority 0: never becomes DR/BDR. Must match between neighbours? No — each interface has its own priority. DR election: highest priority, then highest RID. Non-preemptive.

Question 140 of 150

What is VLAN hopping attack?

Explanation: VLAN hopping: Switch Spoofing (configure attacking PC as trunk to see all VLANs). Double Tagging (send double-tagged frame to jump VLANs via native VLAN). Mitigation: 'switchport mode access' (disable DTP), change native VLAN, explicitly set trunk VLANs.

Question 141 of 150

What is the difference between an IDS and an IPS?

Explanation: IDS: out-of-band, passive, only alerts. IPS: inline, active, can drop packets. NGFW: combines firewall + IPS. Cisco Firepower: NGFW with IPS. False positive risk: IPS might block legitimate traffic. Tune signatures carefully.

Question 142 of 150

What is the purpose of the 'do' command in IOS configuration mode?

Explanation: 'do show ip route' (from config mode) = return to enable then 'show ip route'. Saves steps. Works for: ping, show commands. Available: from global config and sub-config modes. Cisco IOS convenience feature.

Question 143 of 150

What is the purpose of the 'ip default-gateway' command on a switch?

Explanation: Layer 2 switch management: needs 'ip default-gateway [router-ip]' to reach remote subnets for SSH/Telnet management. Not for routing — the switch isn't routing packets. Layer 3 switch: uses 'ip route 0.0.0.0 0.0.0.0 [next-hop]' instead.

Question 144 of 150

What is the difference between a router sub-interface and an SVI?

Explanation: Sub-interface (router-on-a-stick): one physical router interface with multiple sub-interfaces (G0/0.10, G0/0.20). Each sub-interface: encapsulation dot1q [vlan] + IP address. SVI: on Layer 3 switch, 'interface vlan [number]'. SVIs more common in modern enterprise.

Question 145 of 150

What is WLAN controller (WLC) in Cisco architecture?

Explanation: WLC: Cisco DNA/CAPWAP architecture. Lightweight APs (LAPs): minimal config, CAPWAP tunnel to WLC. WLC: handles all intelligence. Split MAC: WLC handles management frames, AP handles data frames (local switching). Large deployments benefit from centralised management.

Question 146 of 150

What does CAPWAP stand for?

Explanation: CAPWAP (RFC 5415): UDP 5246 (control), UDP 5247 (data). APs communicate to WLC via CAPWAP tunnel. Control plane: config, firmware, management. Data plane: can be local (AP forwards locally) or central (all data tunnelled to WLC).

Question 147 of 150

What is a Cisco DNA Center?

Explanation: Cisco DNA Center (DNAC): replaced APIC-EM. Intent-based networking. Key features: Design (network design), Policy (segmentation, QoS), Provision (automation), Assurance (analytics, troubleshooting). API: REST. Integrates with ISE for security policy.

Question 148 of 150

What is a routed protocol vs routing protocol?

Explanation: Routed protocol: the data being routed (IP packets). Routing protocol: the mechanism routers use to share routes. OSPF is a routing protocol for routing IP (routed protocol). Analogy: IP is the cargo, OSPF is the logistics system.

Question 149 of 150

What is a promiscuous port in private VLANs?

Explanation: Private VLANs (PVLAN): primary VLAN → secondary VLANs (isolated, community). Isolated: communicate with promiscuous only. Community: communicate with each other + promiscuous. Promiscuous: communicate with all. Use case: ISP/hotel isolate customers from each other.

Question 150 of 150

What is 'ip split-horizon' in routing?

Explanation: Split horizon: RIP, EIGRP. Prevents routing loops. 'no ip split-horizon': sometimes needed on hub-and-spoke networks (Frame Relay/DMVPN) where hub must re-advertise to spokes. OSPF: link-state, doesn't use split horizon.

Cisco CCNA 200-301

Practice More on Dragonfly

Flashcards

Study Resources

More Practice Tests

Related Study Guides

Frequently Asked Questions