Free CCNA 200-301 Practice Exam & Test Questions

Answer: Layer 2 (Data Link)

A switch forwards frames by destination MAC address, and MAC addresses belong to Layer 2, the Data Link layer. Layer 3 is the tempting pick, but forwarding by IP address is what a router, or a Layer 3 switch routing between subnets, does.

Answer: 10.250.10.5

The private ranges are 10.0.0.0/8, 172.16.0.0/12 (172.16 to 172.31) and 192.168.0.0/16, and 10.250.10.5 falls inside 10.0.0.0/8. 172.34 and 172.40 are tempting but sit outside 172.16 to 172.31, and 192.168.300.1 is not a valid address because 300 exceeds 255.

Answer: 30

A /27 leaves 32 minus 27 = 5 host bits, so 2^5 = 32 addresses, minus the network and broadcast addresses = 30 usable hosts. 32 is the tempting answer, but it counts those two reserved addresses.

Answer: 2

A /30 leaves 2 host bits, so 2^2 = 4 addresses, minus the network and broadcast addresses = 2 usable hosts, which is why /30 is the classic prefix for point-to-point router links. 4 is the block size, not the usable count.

Answer: 255.255.255.192

A /26 is 24 bits in the first three octets plus 2 in the fourth: 11000000 = 128 + 64 = 192, so the mask is 255.255.255.192 with a block size of 256 minus 192 = 64. 255.255.255.224 is a /27, one bit too many.

Answer: ARP

ARP (Address Resolution Protocol) maps a known IPv4 address to the MAC address needed to build the Layer 2 frame. DNS is the tempting pick, but it resolves names to IP addresses, not IP addresses to MAC addresses.

Answer: 10.4.79.255

A /21 mask is 255.255.248.0, so the third octet moves in blocks of 256 minus 248 = 8, and 77 falls in the block 72 to 79. The subnet is 10.4.72.0 and its broadcast is 10.4.79.255; 10.4.77.255 is tempting but treats the mask as a /24.

Answer: 192.168.10.192/27

100 hosts need a /25 (2^7 minus 2 = 126 usable), so .0/25 takes .0 to .127, and 50 hosts need a /26 (2^6 minus 2 = 62), so .128/26 takes .128 to .191. 20 hosts need a /27 (2^5 minus 2 = 30) at the next free address, .192; a /28 is tempting but gives only 2^4 minus 2 = 14 usable hosts.

Answer: 2001:DB8:0:0:A00::1

You may drop leading zeros in each group (0DB8 to DB8, 0A00 to A00, never trailing zeros) and replace one run of all-zero groups with ::. 2001:DB8::A00::1 is tempting but uses :: twice, so nobody could tell how many zero groups each one hides.

Answer: 0250:3EFF:FEAB:12CD

Split the MAC into 0050.3E and AB.12CD and insert FFFE between them to get 0050:3EFF:FEAB:12CD, then flip the seventh bit of the first byte: 00 is 00000000, which becomes 00000010 = 02. Skipping that bit flip gives 0050:3EFF:FEAB:12CD, the most common mistake.

Answer: A duplex mismatch, with this port running half duplex

Late collisions are logged by a half-duplex interface whose partner transmits in full duplex, the classic duplex mismatch; the full-duplex end usually logs CRC errors and runts instead. A speed mismatch is tempting, but it normally stops the link from coming up at all.

Answer: UDP has no handshake, sequencing or retransmission

UDP is connectionless, with an 8-byte header and no handshake, sequence numbers or retransmission, which suits voice, video and DNS queries. The three-way handshake (SYN, SYN-ACK, ACK) and acknowledged retransmission belong to TCP, whose header is at least 20 bytes.

Answer: VLAN 1

Every switchport belongs to VLAN 1 out of the box, and VLAN 1 cannot be deleted, so best practice is to move user traffic and the trunk native VLAN to other VLANs. VLAN 1005 also cannot be deleted, but it is one of the reserved legacy VLANs 1002 to 1005, not the default.

Answer: Carries frames for many VLANs, using 802.1Q tags

A trunk carries several VLANs over one link and adds an 802.1Q tag so the far switch knows each frame's VLAN; only native VLAN frames cross untagged. Bundling links is EtherChannel, and a single-VLAN port facing an end device is an access port.

Answer: To prevent Layer 2 loops in a switched network

STP blocks redundant ports (Rapid PVST+ calls the state discarding) so frames cannot loop and cause broadcast storms, while keeping the backup path ready if the active one fails. It does not load balance: for a given VLAN, a blocked link carries no user traffic at all.

Answer: Untagged, so both ends must use the same native VLAN

802.1Q sends native VLAN frames untagged, and the receiving switch places any untagged frame it gets into its own native VLAN, which is why both ends must agree and CDP warns about a native VLAN mismatch. Tagging native frames is possible with the global command vlan dot1q tag native, but it is not the default.

Answer: switchport voice vlan 150

switchport voice vlan 150 tells the phone, through CDP or LLDP-MED, to tag its own traffic for VLAN 150 while the PC's untagged frames stay in access VLAN 10. switchport trunk native vlan 150 is tempting, but it sets the untagged VLAN on a trunk, and this is an access port.

Answer: active on one end, passive on the other

LACP forms when at least one side is active, so active with passive (or active with active) works. passive with passive is tempting, but neither side starts negotiation, and desirable and auto are PAgP modes that cannot negotiate with LACP.

Answer: SW3

The lowest bridge ID wins, comparing priority first and MAC address only to break a tie. SW2 and SW3 share the lowest priority, 24577, and SW3's MAC 0009.3333.3333 is lower than 00AA.2222.2222; SW1 is tempting with the lowest MAC overall, but its priority of 32769 loses before MACs are compared.

Answer: encapsulation dot1Q 30

encapsulation dot1Q 30 binds the router subinterface to VLAN 30 so it tags and accepts that VLAN's frames, and IOS requires it before you can give the subinterface an IP address. The switchport commands are tempting, but they configure switch ports, not router subinterfaces.

Answer: It goes into the err-disabled state and stops forwarding

BPDU guard err-disables a port the moment it receives a BPDU, and the port stays down until someone runs shutdown and no shutdown on it or errdisable recovery is configured. Dropping PortFast and running normal spanning tree is tempting, but that is how a PortFast port behaves without BPDU guard.

Answer: BPDU filter

Interface-level BPDU filter (spanning-tree bpdufilter enable) neither sends nor processes BPDUs, so a connected switch could create an undetected loop. BPDU guard is the tempting answer, but it err-disables the port when a BPDU arrives rather than ignoring it.

Answer: FlexConnect

FlexConnect APs can switch client data straight onto the branch VLAN and keep existing clients connected when they lose contact with the WLC. Local mode is the tempting default, but it tunnels all client traffic to the controller over CAPWAP, so a WAN outage cuts the clients off.

Answer: show lldp neighbors

show lldp neighbors lists each neighbour's device ID, the local interface, capabilities and the neighbour's port ID, learned through LLDP (IEEE 802.1AB), which many Cisco devices need enabled first with lldp run. show cdp neighbors gives similar output, but CDP is Cisco proprietary and misses most other vendors' gear.

Answer: 110

OSPF has a default administrative distance of 110. 90 is internal EIGRP and 120 is RIP; for reference, a static route is 1 and a directly connected route is 0.

Answer: Link state

OSPF is link state: every router floods LSAs, builds the same map of its area and runs Dijkstra's SPF algorithm over it. Distance vector protocols such as RIP only know what their neighbours report; BGP is path vector, and EIGRP is the one usually called advanced distance vector.

Answer: 192.0.2.2

The router uses the longest matching prefix: 10.1.2.5 matches /0, /8 and /16, and /16 is the longest of those. 10.1.1.0/24 is tempting, but it only covers 10.1.1.0 to 10.1.1.255, and this packet's third octet is 2.

Answer: The OSPF route

For an identical prefix the lowest administrative distance wins, and OSPF's 110 beats the static route's 115 and RIP's 120. The static route is tempting because statics normally use AD 1, but at 115 it is a floating static that installs only if OSPF loses the route.

Answer: The static /24 route

Longest prefix match is applied first, and administrative distance only decides between routes to exactly the same prefix. The /24 is more specific than the /16, so the static route wins despite its AD of 250; the OSPF route is the tempting answer only if you compare AD first.

Answer: ip route 0.0.0.0 0.0.0.0 203.0.113.1 120

A floating static needs a higher administrative distance than the route it backs up, and OSPF's is 110, so 120 keeps the static out of the table until the OSPF default is gone. AD 100 is tempting, but 100 is lower than 110, so that static would replace the OSPF route immediately.

Answer: ipv6 route ::/0 2001:DB8:ACAD:1::1

::/0 is the IPv6 all-zeros prefix with no mask bits, the equivalent of 0.0.0.0 0.0.0.0, and IPv6 static routes use ipv6 route (with ipv6 unicast-routing enabled). ::/128 is tempting, but it is a host route to the single unspecified address, not a default route.

Answer: network 10.20.30.64 0.0.0.31 area 0

Subtract the mask from 255.255.255.255: a /27 mask is 255.255.255.224, and 255 minus 224 = 31, so the wildcard 0.0.0.31 covers .64 to .95. 0.0.0.63 is tempting, but it is a /26 wildcard covering .64 to .127, which reaches outside the subnet.

Answer: R3

The highest priority wins the DR election, the highest router ID breaks a tie, and priority 0 means a router can never be DR or BDR. R2 is tempting with the highest router ID but is ineligible, so R3 (3.3.3.3) becomes DR and R4 (2.2.2.2) becomes BDR.

Answer: 172.16.0.1

Without a router-id command, OSPF takes the highest IPv4 address on an up loopback interface and only falls back to physical interfaces when no loopback exists. 192.168.1.1 is tempting as the highest address overall, but it is on a physical interface, so 172.16.0.1 wins.

Answer: Hello interval 10 on R1, 5 on R2

Hello and dead intervals travel in every hello and must match, so R1 and R2 discard each other's hellos and never become neighbours. The process ID is the tempting answer, but it is only locally significant, so process 1 and process 20 form an adjacency normally.

Answer: Path B: 1 against path A's 2

Cost is reference bandwidth divided by interface bandwidth with a minimum of 1: each 1 Gbps link is 100 / 1000 = 0.1, which counts as 1, so path A totals 1 + 1 = 2, while the 100 Mbps link is 100 / 100 = 1. Path A is tempting because its links are ten times faster, but the default reference cannot tell 1 Gbps from 100 Mbps, which is why auto-cost reference-bandwidth should be raised on every router.

Answer: 10.1.1.254, the virtual IP

Hosts point at the HSRP virtual IP, 10.1.1.254, which the active router answers for with a virtual MAC, so a failover to 10.1.1.3 needs no change on the hosts. R1's real interface address is tempting because R1 is active, but hosts using it would lose their gateway if R1 failed.

Answer: ipv6 ospf 1 area 0

OSPFv3 is enabled per interface with ipv6 ospf 1 area 0 and has no network statements; ipv6 router ospf 1 is the global command that creates the process. ip ospf 1 area 0 is tempting, but it enables OSPFv2 for the interface's IPv4 address, not OSPFv3.

Answer: The OSPF cost to reach 10.5.5.0/24

The brackets read [administrative distance/metric], so 110 is OSPF's AD and 3 is the total OSPF cost to the destination. Hop count is the tempting reading, but hop count is RIP's metric, while OSPF's cost comes from interface bandwidth.

Answer: PAT (NAT overload)

PAT, configured with the overload keyword, maps many inside addresses to one public address and tells sessions apart by source port number. Dynamic NAT is tempting, but it needs one public address from its pool for each inside host translating at the same time.

Answer: Discover, Offer, Request, Acknowledge

DHCP follows DORA: the client broadcasts a Discover, a server answers with an Offer, the client sends a Request for the offer it chose, and the server confirms with an Acknowledge. Discover then Request is tempting, but a client can only request an address it has already been offered.

Answer: 443

HTTPS uses TCP port 443, the number you match with eq 443 in an extended ACL. Port 80 is the tempting pick, but it is plain, unencrypted HTTP; 22 is SSH and 53 is DNS.

Answer: ntp server 192.0.2.10

ntp server 192.0.2.10 points the router at that time source, making the router its NTP client. ntp master is tempting, but it turns the router itself into an authoritative time source and takes a stratum number, not a server address.

Answer: Levels 0 through 4

Warnings is severity 4, and a logging level sends that severity plus every more serious one, so 0 (emergencies) through 4 (warnings) reach the server. Levels 4 through 7 is the tempting reversal: lower numbers are more severe, so 5 to 7 are less important and are filtered out.

Answer: ip helper-address 10.0.0.5 on subinterface G0/0.20

DHCP Discovers are broadcasts that a router will not forward, so the interface that hears them, G0/0.20, needs ip helper-address to relay them as unicasts to 10.0.0.5. Putting the helper on the server-side interface is the common mistake: that interface never receives the clients' broadcasts.

Answer: access-list 110 permit tcp 192.168.16.0 0.0.15.255 host 172.16.5.10 eq 443

16 through 31 is 16 values in the third octet, a /20 mask of 255.255.240.0, and 255 minus 240 = 15 gives the wildcard 0.0.15.255. 0.0.31.255 is tempting but spans 192.168.0.0 to 192.168.31.255, and the reversed entry treats the server as the source because extended ACLs list source before destination.

Answer: Every IPv4 packet is dropped, from any source

Every ACL ends with an implicit deny any, so 10.1.1.5 hits the explicit deny and every other source hits the implicit one. Blocking only that host is the tempting reading, and it needs access-list 10 permit any added after the deny.

Answer: The third MAC's frames are dropped and logged; the port stays up

Restrict drops frames from the unknown MAC, increments the violation counter and sends a syslog message or SNMP trap, while the two allowed hosts keep working. Dropping silently without counting is protect mode, and err-disabling the port is shutdown, the default mode.

Answer: Uplinks toward the legitimate DHCP server

With DHCP snooping on, every port starts untrusted and drops server messages such as DHCPOFFER and DHCPACK, which stops a rogue server on an access port. Trusting the user ports is tempting so clients are never blocked, but clients only send requests, and trust there would let a rogue server hand out a fake gateway.

Answer: Storm control

Storm control measures broadcast, multicast or unicast traffic against a threshold, such as storm-control broadcast level 10, and drops the excess or shuts the port down. Port security is tempting, but it limits which MAC addresses may use the port, not how much traffic they send.

Answer: IPv6 RA guard

IPv6 RA guard inspects Router Advertisements and drops them on ports configured as host ports, so only real routers can announce themselves as gateways. DHCP snooping is tempting, but it polices DHCPv4 server messages, and IPv6 hosts learn their default gateway from RAs, not from DHCP.

Answer: TACACS+ uses TCP and encrypts the entire packet body

TACACS+ runs over TCP port 49, encrypts the whole payload and keeps authentication, authorization and accounting separate, which suits per-command device administration. UDP with only the password encrypted is the tempting swap, but that describes RADIUS, which also combines authentication and authorization.

Answer: A password plus a code from an authenticator app

MFA combines different factor types, here something you know (the password) and something you have (the phone running the authenticator app). A security question is tempting, but it is a second thing you know, so password plus question is still a single factor type.

Answer: ESP

ESP (Encapsulating Security Payload, IP protocol 50) encrypts the payload and can also authenticate it. AH is tempting because it is part of IPsec too, but it provides only integrity and authentication with no encryption, while IKE negotiates keys rather than protecting the data.

Answer: It plans steps toward a goal and calls tools, like show commands

An agentic AI breaks a goal into steps, calls tools such as device queries or ticketing systems, and adjusts to the results, usually with a human approving any change. Answering questions without acting describes a plain chat assistant, and a fixed threshold script is traditional automation with no reasoning involved.

Answer: As a network engineer, list the top three issues as a table of severity, interface and cause. Usernames and public IPs are masked.

The best prompt sets a fitting persona, gives a clear instruction and output format, and respects data classification by masking sensitive values before they leave your hands. Attaching the config is tempting for extra context, but passwords are restricted data and do not belong in any prompt, even to an approved tool.

Answer: The southbound API, toward the devices

Southbound APIs such as NETCONF, RESTCONF or OpenFlow carry instructions down from the controller to the network devices. The northbound API is the tempting pick, but it faces upward, letting applications and scripts ask the controller for data and changes.

Answer: PUT

In CRUD terms POST creates, GET reads, PUT updates by replacing the resource (PATCH updates part of it) and DELETE deletes. POST is tempting because it also sends data, but it creates a new resource rather than replacing an existing one.

Answer: {"hostname": "SW1", "vlans": [10, 20]}

JSON needs double quotes around every key and string value and allows no comma after the last item. Single quotes are the tempting choice because Python accepts them, but JSON does not; the other two fail on a trailing comma and on unquoted keys.

Answer: A control node pushes YAML playbooks over SSH, with no agent needed

Ansible is agentless: a control node pushes tasks from YAML playbooks over SSH or an API, so IOS needs nothing extra installed. A pull-based agent is tempting, but that describes tools such as Puppet and Chef, and a state file is how Terraform tracks what it has built.