• 100 questions

CCNA Practice Test

CCNA prep questions for exam 200-301 v1.1, with the RFC, Cisco guide or other public text behind each answer.

What is the broadcast address of the subnet that holds 10.1.5.200/29?

Pick an answer, then press Check answer. Then you see Correct or Not quite, with the reason. Keys: 1 to 4 pick, Enter checks.

Print covers the next 100 questions. Share this set copies a link to the same questions in the same order.

Exam mode: 100 questions, 120 minutes.

More options

Unofficial practice questions, not affiliated with Cisco Systems, Inc. Bank checked October 8, 2026.

Next step Weak on fundamentals? Try Network+Another IT certification? Pick it

All 100 questions

Network fundamentals 20

  • A LAN must hold 500 hosts. Which is the longest prefix that still fits them? RFC 4632, section 3.1
  • A UDP datagram carries no data at all. What value does its Length field hold? RFC 768
  • An interface has the MAC address 00-1A-2B-3C-4D-5E. Which modified EUI-64 interface identifier does it form? RFC 4291, Appendix A
  • For IPv6 unicast addresses that do not start with binary 000, how long must the interface ID be? RFC 4291, section 2.5.1
  • Host 192.168.10.77 has the mask 255.255.255.224. Which subnet is it in? RFC 4632, section 3.1
  • How is the solicited-node multicast address of an IPv6 unicast address formed? RFC 4291, section 2.7.1
  • How many usable host addresses does a /27 IPv4 subnet give? RFC 4632, section 3.1
  • In a two-tier campus design, which layer is called the collapsed core? Cisco Campus LAN and Wireless LAN Solution Design Guide
  • In IPv6 address notation, what does "::" stand for? RFC 4291, section 2.2
  • Two routers share the link subnet 172.16.8.4/30. Which two addresses can their interfaces use? RFC 4632, section 3.1
  • What is the broadcast address of the subnet that holds 10.1.5.200/29? RFC 4632, section 3.1
Show all 100 questions (89 more)

Network fundamentals, continued

  • Which address lies inside one of the private blocks of RFC 1918? RFC 1918, section 3
  • Which IPv6 address is the loopback address? RFC 4291, section 2.5.3
  • Which IPv6 multicast address reaches all routers on the local link? RFC 4291, section 2.7.1
  • Which IPv6 prefix identifies unique local unicast addresses? RFC 4193, section 3.1
  • Which is a legal short form of 2001:0DB8:0000:0000:0008:0800:200C:417A? RFC 4291, section 2.2
  • Which of these fields is found in a TCP header but not in a UDP header? RFC 9293, section 3.1
  • Which TCP control bit synchronizes sequence numbers when a connection opens? RFC 9293, section 3.1
  • Which TCP header field tells the other end how many octets of data the sender of the segment is willing to accept? RFC 9293, section 3.1
  • Which virtualization feature gives one router several separate forwarding tables, so that the routes of different customers stay apart? RFC 4364, section 3

Network access 20

  • A port is added to a channel group with mode on. How does it negotiate the bundle? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring EtherChannels
  • An access point and its wireless LAN controller speak CAPWAP. Which well-known UDP ports does the controller use for control and for data? RFC 5415, section 3.1
  • Both ends of a link between two switches are left at switchport mode dynamic auto. What happens? Cisco VLAN Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring VLAN Trunks
  • BPDU guard is enabled on a PortFast port, and someone plugs a switch into it. What happens once a BPDU arrives on that port? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Optional Spanning-Tree Features
  • By default, how long does a Cisco device hold a neighbor's Cisco Discovery Protocol information before discarding it? Cisco Network Management Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring the Cisco Discovery Protocol
  • Every switch in a VLAN keeps the default spanning-tree priority. Which switch becomes the root? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Spanning Tree Protocol
  • In rapid spanning tree, what is an alternate port? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Spanning Tree Protocol
  • The native VLAN is 10 on one end of an 802.1Q trunk and 20 on the other. What does Cisco warn might result? Cisco VLAN Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring VLAN Trunks
  • Rapid spanning tree has three port states. Which 802.1D states does its discarding state replace? Cisco, Understand Rapid Spanning Tree Protocol 802.1w (document 24062)
  • Root guard is enabled on an interface, and spanning tree would now select that interface as a root port. Which state does root guard place it in? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Optional Spanning-Tree Features
  • Two Cisco switches are cabled together but have no IP addresses yet. Can each still discover the other with Cisco Discovery Protocol? Cisco Network Management Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring the Cisco Discovery Protocol
  • Up to how many compatibly configured Ethernet ports can one EtherChannel on a Catalyst 9300 consist of? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring EtherChannels
  • What does PortFast do on a switch port? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Optional Spanning-Tree Features
  • What does the command switchport nonegotiate do on a trunk interface? Cisco VLAN Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring VLAN Trunks
  • What is loop guard used to prevent? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Optional Spanning-Tree Features
  • What is the default switchport mode of an Ethernet interface on a Catalyst 9300 switch? Cisco VLAN Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring VLAN Trunks
  • Which pair of channel-group modes on the two ends leaves the links unbundled? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring EtherChannels
  • Which protocol, defined in IEEE 802.3ad, lets a Cisco switch negotiate an EtherChannel with a switch from another vendor? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring EtherChannels
  • Which VLAN does a Catalyst switch create by itself during system initialization, as the default VLAN? Cisco VLAN Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring VLANs
  • Which VLAN IDs does a Catalyst switch reserve for Token Ring and FDDI VLANs? Cisco VLAN Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring VLANs

IP connectivity 25

  • A Catalyst 9300 has IPv6 addresses on two routed interfaces but does not forward IPv6 packets between them. Which command is missing? Cisco IP Routing Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring IPv6 Unicast Routing
  • A Cisco router has a loopback interface at 10.0.0.1 and a physical interface at 192.168.50.1, and no router ID is set by hand. Which router ID does OSPF use? Cisco IP Routing Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring OSPF
  • A route is given an administrative distance of 255. What does a Cisco router do with it? Cisco, Understand and Use Administrative Distance (document 15986)
  • A router holds 172.16.0.0/16 from OSPF, 172.16.4.0/22 from RIP and a static default route. Which one forwards a packet for 172.16.5.9? Cisco, Understand and Use Administrative Distance (document 15986)
  • A routing table line reads: O 10.2.2.0/24 [110/20] via 10.1.1.2. What is the 20? Cisco, Understand and Use Administrative Distance (document 15986)
  • An OSPF interface is given a Router Priority of 0. What follows? RFC 2328, section 9
  • How does Cisco IOS XE work out the default OSPF cost of an interface? Cisco IP Routing Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring OSPF
  • In the Cisco command ip route prefix mask {address | interface} [distance], what does the optional last value set? Cisco IP Routing Configuration Guide, IOS XE 17.12 (Catalyst 9300), Protocol-Independent Features
  • In the output of show ip route, which code letter marks a route learned by EIGRP? Cisco, Understand and Use Administrative Distance (document 15986)
  • On a broadcast network, with which routers does every OSPF router form a full adjacency? RFC 2328, section 10.4
  • On which OSPF network types does the Hello Protocol elect a Designated Router? RFC 2328, section 4
  • The same prefix reaches a router from EIGRP (internal) and from OSPF. With default settings, which route goes into the routing table? Cisco, Understand and Use Administrative Distance (document 15986)
  • To which address are OSPF Hello packets sent on a broadcast network? RFC 2328, Appendix A.1
  • Two OSPF routers on an Ethernet segment both try to become Designated Router. Which one takes precedence? RFC 2328, section 9
  • Two OSPF routers on one Ethernet segment never become neighbors. Which mismatch between them explains it? RFC 2328, section 9.5
  • Two routers run HSRP for one group. Which one forwards the packets hosts address to the virtual router? RFC 2281, abstract
  • What does the OSPF RouterDeadInterval set? RFC 2328, section 9
  • What is a floating static route? Cisco, Understand and Use Administrative Distance (document 15986)
  • What is the default administrative distance of a connected route on a Cisco router? Cisco, Understand and Use Administrative Distance (document 15986)
  • What is the default administrative distance of a static route on a Cisco router? Cisco, Understand and Use Administrative Distance (document 15986)
  • What is the default administrative distance of OSPF on a Cisco router? Cisco, Understand and Use Administrative Distance (document 15986)
  • Which IP protocol number carries OSPF packets? RFC 2328, section 4.3
  • Which of these route sources has the lowest default administrative distance on a Cisco router? Cisco, Understand and Use Administrative Distance (document 15986)
  • Which OSPF multicast address is for the Designated Router and the Backup Designated Router alone to listen on? RFC 2328, Appendix A.1
  • Which OSPF neighbor state means the two routers have become fully adjacent? RFC 2328, section 10.1

IP services 10

  • A switch has a hostname and an IP domain name. Which command creates the key pair that turns on its SSH server? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Secure Shell
  • DHCP clients sit on VLAN 20 and the DHCP server on another subnet. Where does the ip helper-address command belong? Cisco IP Addressing Services Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring DHCP
  • How does an SNMP inform differ from an SNMP trap? Cisco Network Management Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Simple Network Management Protocol
  • In Cisco NAT terms, what is an inside local address? Cisco IP Addressing Services Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Network Address Translation
  • In Cisco NAT terms, which address represents one or more inside hosts to the outside world? Cisco IP Addressing Services Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Network Address Translation
  • Traffic arrives faster than its profile allows. What does a shaper do with the excess, where a policer would drop it? RFC 2475, section 2.3.3.3
  • Which kind of NAT maps many unregistered addresses to a single registered address by using different Layer 4 ports? Cisco IP Addressing Services Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Network Address Translation
  • Which NTP stratum value marks a clock as unsynchronized? RFC 5905, section 7.3
  • Which statement about TFTP is true? RFC 1350, section 1
  • Which syslog severity value means Warning? RFC 5424, section 6.2.1

Security fundamentals 15

  • A fingerprint reader is added to a password login. Which kind of authentication factor does the fingerprint supply? NIST Computer Security Resource Center glossary, multi-factor authentication
  • A packet matches no entry of the access list applied to an interface. What happens to it? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring IPv4 ACLs
  • Both enable password and enable secret are configured on a Cisco switch. Which one is used? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Controlling Switch Access with Passwords and Privilege Levels
  • How does TACACS+ treat authentication, authorization and accounting? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring TACACS+
  • In an access list entry, what does the source and wildcard pair 0.0.0.0 255.255.255.255 mean? Cisco, Configure and Filter IP Access Lists (document 23602)
  • In the NIST glossary, what is a threat? NIST Computer Security Resource Center glossary, threat
  • On which UDP port does IKE normally listen and send when it sets up IPsec security associations? RFC 7296, section 2
  • Port security is enabled on an access port with default settings. What happens when a second MAC address sends a frame? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Port Security
  • What does a standard IPv4 access list match on? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring IPv4 ACLs
  • What does dynamic ARP inspection check an incoming ARP packet against? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Dynamic ARP Inspection
  • What does the command service password-encryption do? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Controlling Switch Access with Passwords and Privilege Levels
  • Which numbers can a standard IPv4 access list have on a Catalyst switch? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring IPv4 ACLs
  • Which services does the IPsec Authentication Header (AH) give an IP datagram? RFC 4302, section 1
  • Which wildcard mask matches every address of the subnet 10.20.16.0/20 in an access list entry? Cisco, Configure and Filter IP Access Lists (document 23602)
  • With DHCP snooping enabled, how must a switch port that leads to the DHCP server be set? Cisco IP Addressing Services Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring DHCP

Automation and programmability 10

  • A REST API answers a POST with status code 201. What does that tell the client? RFC 9110, section 15.3.2
  • A REST client only wants to read a resource. Which HTTP method is defined as safe? RFC 9110, section 9.2.1
  • How does HTTP Basic authentication send the user ID and password? RFC 7617, section 1
  • In a software-defined access fabric, what is the underlay network? Cisco SD-Access Solution Design Guide
  • In JSON, what do square brackets enclose? RFC 8259, section 5
  • In RFC 7426's SDN terms, what is the forwarding plane? RFC 7426, section 2
  • In RFC 7426's SDN terms, which plane instructs network devices how to process and forward packets? RFC 7426, section 2
  • What does it mean that Terraform configuration files are declarative? HashiCorp, What is Terraform? (Terraform documentation)
  • Which HTTP method asks the server to create or replace the state of the target resource with the enclosed representation? RFC 9110, section 9.3.4
  • Which line is valid JSON? RFC 8259, section 4

How this list was compiled: Own questions, written to the six sections and weights of Cisco's exam topics for CCNA Exam v1.1 (200-301), as Cisco publishes them at https://learningnetwork.cisco.com/s/ccna-exam-topics and in the exam topics PDF https://learningcontent.cisco.com/documents/marketing/exam-topics/200-301-CCNA-v1.1.pdf (both read 2026-10-08). Facts were read on 2026-10-08 in public texts: IETF RFCs on rfc-editor.org, Cisco's public configuration guides for IOS XE 17.12 on the Catalyst 9300 and Cisco's public support documents and design guides on cisco.com, the NIST glossary at csrc.nist.gov and HashiCorp's Terraform documentation. Each question names the text and section it was written from and links to it. Licence: Own work. Every question, wrong choice and explanation was written for this site from the public texts named in each question. Nothing is copied or reworded from a Cisco exam, a released or sample question, a practice product or a question dump.

How it works

This unofficial CCNA practice test holds 100 of our own questions on the six sections of Cisco's 200-301 v1.1 exam topics. It is not affiliated with Cisco Systems, Inc., and no question comes from the real exam.

Read the full guide

What the CCNA exam asks

Cisco's exam topics for 200-301 v1.1, read on October 8, 2026, weight six sections: network fundamentals 20%, network access 20%, IP connectivity 25%, IP services 10%, security fundamentals 15%, and automation and programmability 10%.

What this bank leaves out

Every question is multiple choice, so the exam's drag-and-drop and performance-based items are not here. Also left out, for want of a public text to cite: Wi-Fi channels, cable and connector types, the wireless controller's screens, and AI in network operations.

  • Longest prefix match comes before administrative distance: a /22 learned from RIP beats a /16 learned from OSPF for an address inside both.
  • Two ports set to LACP passive never bundle. One end has to be active.
  • A loopback address becomes the OSPF router ID even when a physical interface holds a higher address.

Questions and answers

Is this a CCNA 200-125 practice test?

It follows 200-301. Cisco's list of retired exams gives February 23, 2020 as the last day to test on 200-125, the CCNA Routing and Switching exam, and names 200-301 CCNA as its replacement.

How many questions are on the CCNA exam?

Cisco does not publish a count. It gives the time, 120 minutes, and three kinds of question: multiple choice, drag-and-drop and performance-based. Exam mode here draws all 100 of our questions on a 120-minute clock.

What is the passing score for the CCNA?

Cisco publishes none. Its certification page says grading is pass or fail, with results online within 48 hours, so no score on this page tells you whether you would pass.

When does CCNA v2.0 replace v1.1?

Cisco's exam topics page gives February 2, 2027 as the last date to test on v1.1 and February 3, 2027 as the first date for v2.0. Until then this bank stays on the v1.1 topics.

More tests

Show 7 more

Browse Safety and Trades