Cisco CCNA 200-301 Exam — Questions and Answers

Question 1: A switch receives a tagged frame with VLAN 10 on a port configured as an access port for VLAN 20. What does the switch do?

Drops the frame (Correct answer)
Adds a second tag and floods the frame
Forwards the frame to VLAN 10
Strips the tag and forwards on VLAN 20

Correct answer: Drops the frame

Cisco switches drop tagged frames received on access ports because access ports expect untagged traffic.

Question 2: A network administrator notices that EIGRP is not forming a neighbor relationship between two directly connected routers. Which mismatch would NOT prevent adjacency?

K-value mismatch
Hello timer mismatch (Correct answer)
Authentication key mismatch
Autonomous system number mismatch

Correct answer: Hello timer mismatch

Unlike OSPF, EIGRP does not require Hello and Hold timers to match between neighbors to form an adjacency.

Question 3: In Python, which library is commonly used to make HTTP REST API calls to network devices?

scapy
requests (Correct answer)
paramiko
netmiko

Correct answer: requests

The 'requests' library is the standard Python library for making HTTP/REST API calls.

Question 4: A wireless client roams from an AP associated with WLC1 to an AP associated with WLC2. Both WLCs are in the same mobility group, but the client is assigned to a different VLAN/subnet after roaming. To maintain the client's session and IP address, what type of roaming occurs?

Layer 2 Inter-controller Roaming
Static Channel Roaming
Layer 3 Inter-controller Roaming (Correct answer)
Intra-controller Roaming

Correct answer: Layer 3 Inter-controller Roaming

When a wireless client roams between APs connected to different WLCs and moves to a new VLAN/subnet, it is called a Layer 3 Inter-controller roam. To ensure seamless connectivity, the original WLC becomes the 'anchor' controller, and a mobility tunnel (often a CAPWAP or EoIP tunnel) is built between the anchor and the new 'foreign' controller. This allows the client to keep its original IP address by tunneling its traffic back to the original subnet. [13, 16, 21]

Question 5: To prevent double-tagging VLAN hopping attacks, which best practice should be applied?

Set all ports to dynamic auto
Change the native VLAN to an unused VLAN ID (Correct answer)
Enable VTP transparent mode
Disable 802.1Q on all ports

Correct answer: Change the native VLAN to an unused VLAN ID

Using an unused, non-default native VLAN prevents double-tagging attacks because the attacker cannot predict or match the native VLAN.

Question 6: What is the size of the 802.1Q tag inserted into an Ethernet frame?

4 bytes (Correct answer)
8 bytes
6 bytes
2 bytes

Correct answer: 4 bytes

The 802.1Q tag is 4 bytes: 2 bytes for the TPID (0x8100) and 2 bytes for the TCI (PCP, DEI, and VID fields).

Question 7: A technician captures traffic and sees a PDU with source and destination MAC addresses but no IP header. At which OSI layer was this PDU created?

Layer 2 - Data Link (Correct answer)
Layer 4 - Transport
Layer 1 - Physical
Layer 3 - Network

Correct answer: Layer 2 - Data Link

MAC addresses are used at Layer 2 (Data Link), and frames at this layer do not contain IP headers.

Question 8: To identify traffic bottlenecks between two sites, which router command is used?

Ping
Telnet
Trace (Correct answer)
SSH

Correct answer: Trace

The `traceroute` (or `trace` on Cisco devices, `tracert` on Windows) command is used to display the path and measure transit delays of packets across an IP network. By showing each router (hop) a packet traverses and the round-trip time to each hop, it helps identify where delays or bottlenecks might be occurring between two sites. This makes it ideal for diagnosing connectivity and performance issues.

Question 9: What is the primary function of the native VLAN on an IEEE 802.1Q trunk port?

To encrypt all management traffic between switches.
To carry untagged traffic. (Correct answer)
To assign a VLAN ID to frames that arrive without one.
To exclusively carry VTP and CDP traffic.

Correct answer: To carry untagged traffic.

The native VLAN is a specific VLAN assigned to an 802.1Q trunk port. Its primary purpose is to handle traffic that is not tagged with a VLAN ID. When a trunk port receives an untagged frame, it assumes the frame belongs to the native VLAN.

Question 10: In PVST+, how is the extended system ID used in the bridge priority field?

The VLAN ID is not used in PVST+
The VLAN ID replaces the bridge priority
The VLAN ID is subtracted from the bridge priority
The VLAN ID is added to the bridge priority (Correct answer)

Correct answer: The VLAN ID is added to the bridge priority

PVST+ uses the lower 12 bits of the 16-bit priority field as the extended system ID (VLAN ID), so valid priorities must be multiples of 4096.

Question 11: When HSRP is deployed, what should end hosts be configured to use as their default gateway?

The HSRP virtual IP address (Correct answer)
The HSRP multicast address 224.0.0.2
The physical interface IP of the active router
The physical interface IP of the standby router

Correct answer: The HSRP virtual IP address

Hosts point to the virtual IP that the HSRP group shares. Whichever router is active answers for that virtual IP and its virtual MAC, so failover is transparent to hosts and no reconfiguration is needed.

Question 12: A network administrator is configuring a backup route for a critical network. The primary route to the 10.10.20.0/24 network is learned via OSPF. Which command will correctly configure a static route to be used only if the OSPF route becomes unavailable?

ip route 10.10.20.0 255.255.255.0 192.168.1.1 90
ip route 10.10.20.0 255.255.255.0 192.168.1.1 120 (Correct answer)
ip route 10.10.20.0 255.255.255.0 192.168.1.1 1
ip route 10.10.20.0 255.255.255.0 192.168.1.1

Correct answer: ip route 10.10.20.0 255.255.255.0 192.168.1.1 120

This configuration creates a floating static route. The primary route is learned via OSPF, which has a default administrative distance (AD) of 110. To make the static route a backup, its AD must be higher (less preferred) than the primary route's AD. Configuring the static route with an AD of 120 makes it less preferred than the OSPF route. It will only be installed in the routing table if the OSPF route is no longer available.

Question 13: A network administrator is configuring a new web server. The network address is 172.16.32.0/22. Which of the following IP addresses can be validly assigned to the server?

172.16.35.255
172.16.31.255
172.16.35.100 (Correct answer)
172.16.32.0

Correct answer: 172.16.35.100

The /22 CIDR notation corresponds to a subnet mask of 255.255.252.0. This creates a network range from 172.16.32.0 to 172.16.35.255. The first address (.32.0) is the network ID, and the last address (.35.255) is the broadcast address, neither of which can be assigned to a host. Therefore, 172.16.35.100 is a valid, usable host address within this range.

Question 14: Which Cisco IOS command displays port security status including the number of secure MAC addresses on an interface?

show mac address-table secure
show interface port-security
show switchport security
show port-security interface (Correct answer)

Correct answer: show port-security interface

'show port-security interface <interface>' displays the port security configuration, violation count, and learned secure MAC addresses.

Question 15: Which of the following is a reserved VLAN that cannot be deleted or used for data traffic on Cisco switches?

VLAN 999
VLAN 1006
VLAN 100
VLAN 1002 (Correct answer)

Correct answer: VLAN 1002

VLANs 1002–1005 are reserved for legacy Token Ring and FDDI protocols and cannot be deleted or modified.

Question 16: In the context of the OSI model, what is a 'service data unit' (SDU)?

The error-checking trailer added by Layer 2
The complete PDU including all headers and trailers
The header added by each layer during encapsulation
The data passed from a higher layer to a lower layer for encapsulation (Correct answer)

Correct answer: The data passed from a higher layer to a lower layer for encapsulation

A Service Data Unit (SDU) is the payload (data) that a layer receives from the layer above it before adding its own header to form a PDU.

Question 17: What are the ones that are used with NAT?

Outside local
Inside global
Outside global
Inside local
All of the above (Correct answer)

Correct answer: All of the above

NAT (Network Address Translation) uses several terms to describe IP addresses from different perspectives during translation. 'Inside local' is the private IP address of a host on the internal network. 'Inside global' is the public IP address used to represent the inside local address to the outside world. 'Outside local' is the private IP address of an outside host as seen by the inside network, and 'Outside global' is the public IP address of an outside host.

Question 18: An IPv6 address written as 2001:0DB8:0000:0000:0000:0000:0000:0001 can be abbreviated to which of the following?

2001:0DB8::0001
2001:DB8:0::1
2001:DB8::1 (Correct answer)
2001:DB8:::1

Correct answer: 2001:DB8::1

Leading zeros in each group can be removed and consecutive all-zero groups replaced with :: once, yielding 2001:DB8::1.

Question 19: What is the function of the Priority Code Point (PCP) field in the 802.1Q tag?

It identifies the VLAN number
It indicates whether the frame is eligible to be dropped
It signals that the frame is a native VLAN frame
It specifies the Class of Service (CoS) priority for QoS (Correct answer)

Correct answer: It specifies the Class of Service (CoS) priority for QoS

The 3-bit PCP field carries Layer 2 Class of Service markings used for QoS prioritization.

Question 20: In a split-MAC architecture, which functions are handled by the Wireless LAN Controller (WLC) rather than the AP?

RF transmission and beacon generation
Client authentication and association management (Correct answer)
Physical layer signal modulation
802.11 frame encryption at the AP level

Correct answer: Client authentication and association management

In split-MAC architecture, the WLC handles management functions like client authentication and association, while the AP handles real-time functions like RF transmission.

Question 21: Which command enables port security on a Cisco switch interface and sets the maximum number of MAC addresses to 2?

switchport security limit 2
port-security max-addresses 2
switchport port-security maximum 2 (Correct answer)
ip port-security maximum 2

Correct answer: switchport port-security maximum 2

After enabling 'switchport port-security', the 'switchport port-security maximum 2' command limits the port to two learned MAC addresses.

Question 22: Which 802.1Q field identifies the VLAN to which a frame belongs?

Priority Code Point (PCP)
VLAN ID (VID) (Correct answer)
Drop Eligible Indicator (DEI)
EtherType (0x8100)

Correct answer: VLAN ID (VID)

The 12-bit VLAN Identifier (VID) field in the 802.1Q tag specifies the VLAN.

Question 23: In which cloud service model does the customer manage the operating system and applications, while the provider manages the physical servers, storage, and networking?

SaaS
IaaS (Correct answer)
On-premises
PaaS

Correct answer: IaaS

In IaaS (Infrastructure as a Service), the provider supplies virtualized compute, storage, and networking. The customer installs and manages the OS, middleware, and applications. In PaaS the provider also manages the OS, and in SaaS the provider manages everything.

Question 24: Which protocol maps IP addresses to MAC addresses and operates at the boundary between OSI Layers 2 and 3?

ICMP
RARP
DNS
ARP (Correct answer)

Correct answer: ARP

ARP (Address Resolution Protocol) resolves known IP addresses to MAC addresses, bridging the Network (Layer 3) and Data Link (Layer 2) layers.

Question 25: Which wildcard mask would match only the host 192.168.10.5?

0.0.0.255
255.255.255.0
0.0.255.255
0.0.0.0 (Correct answer)

Correct answer: 0.0.0.0

A wildcard mask of 0.0.0.0 means all bits must match, which specifies a single host.

Question 26: Which Ansible component describes the desired state of managed devices?

Inventory
Role
Module
Playbook (Correct answer)

Correct answer: Playbook

An Ansible playbook is a YAML file that defines the desired configuration state for managed hosts.

Question 27: The IEEE 802.1Q frame tag, used for identifying VLANs, is 4 bytes long and inserted into the Ethernet frame header. Which field within this tag is 12 bits long and specifies the VLAN membership of the frame?

Priority Code Point (PCP)
VLAN Identifier (VID) (Correct answer)
Canonical Format Indicator (CFI)
Tag Protocol Identifier (TPID)

Correct answer: VLAN Identifier (VID)

The 802.1Q tag contains four fields. The VLAN Identifier (VID) is a 12-bit field that specifies the VLAN to which the frame belongs. This 12-bit length allows for 4096 possible VLANs, with 4094 being usable.

Question 28: What happens when you delete vlan.dat from the switch's flash memory?

All normal-range VLAN configurations are erased and reset to defaults (Correct answer)
VLAN 1 is deleted along with all others
Only extended VLANs are removed
The switch reboots and loses the running configuration

Correct answer: All normal-range VLAN configurations are erased and reset to defaults

Deleting vlan.dat removes all normal-range VLAN definitions, resetting the switch to factory VLAN defaults on next boot.

Question 29: Where should an extended ACL be placed for optimal performance?

As close to the source as possible (Correct answer)
On the core switch only
On the default gateway router
As close to the destination as possible

Correct answer: As close to the source as possible

Extended ACLs should be placed close to the source to stop unwanted traffic early and reduce unnecessary network load.

Question 30: Which command configures a Cisco router login banner that is displayed before authentication?

banner motd # message #
banner exec # message #
banner login # message # (Correct answer)
login banner text message

Correct answer: banner login # message #

The 'banner login' command displays a message specifically before the username/password prompt, intended for legal warnings.

Question 31: What are some examples of Denial of Service Attacks? (Choose three)

DNS Spoofing
TCP SYN Flood Attack (Correct answer)
Smurfing (Correct answer)
Ping of Death (Correct answer)
ARP Spoofing

Correct answer: TCP SYN Flood Attack

Denial of Service (DoS) attacks aim to make a network service unavailable to legitimate users. A TCP SYN Flood overwhelms a server by sending numerous SYN requests without completing the three-way handshake. A Ping of Death involves sending oversized or malformed ICMP packets that can crash older systems. Smurfing is a distributed DoS attack that uses ICMP echo requests directed at an IP broadcast address to amplify traffic to a victim.

Question 32: Which AAA protocol encrypts only the password in the authentication packet, while the other encrypts the entire payload?

TACACS+ encrypts only the password; RADIUS encrypts the entire payload
RADIUS encrypts only the password; TACACS+ encrypts the entire payload (Correct answer)
Both RADIUS and TACACS+ encrypt only the password
Both RADIUS and TACACS+ encrypt the entire payload

Correct answer: RADIUS encrypts only the password; TACACS+ encrypts the entire payload

RADIUS encrypts only the user's password in the Access-Request packet, while TACACS+ encrypts the entire body of every packet for greater security.

Question 33: A network administrator wants to prevent a user-facing access port from causing a Layer 2 loop if another switch is accidentally connected. The desired behavior is for the port to shut down immediately if it receives a BPDU. Which Cisco feature should be configured on this port?

Root Guard
BPDU Guard (Correct answer)
BPDU Filter
Loop Guard

Correct answer: BPDU Guard

BPDU Guard is a Cisco feature designed for access ports, especially those with PortFast enabled. If a port with BPDU Guard enabled receives any BPDU, it will immediately be placed into an err-disabled state, effectively shutting it down. This prevents unauthorized switches from influencing the STP topology.

Question 34: A network engineer is developing a Python script to make REST API calls to a Cisco Meraki dashboard to automate the creation of new wireless networks. Which standard Python library is most commonly used to handle the HTTP requests and responses for this task?

Requests (Correct answer)
Paramiko
Netmiko
Scapy

Correct answer: Requests

The 'requests' library is the de facto standard in Python for making HTTP requests to APIs. [2, 11] It simplifies the process of sending GET, POST, PUT, and other HTTP methods. [19] Paramiko and Netmiko are primarily used for automating interactions over SSH, not for web-based REST APIs. [11, 17] Scapy is a library used for packet crafting and analysis at a lower level of the network stack.

Question 35: Which command displays the currently configured EtherChannel load-balancing method on a Cisco switch?

show lacp counters
show port-channel load-balance
show interfaces port-channel 1
show etherchannel load-balance (Correct answer)

Correct answer: show etherchannel load-balance

'show etherchannel load-balance' displays the global load-balancing policy currently applied to all EtherChannel bundles on the switch.

Question 36: What action should be taken to recover a Cisco switch port from an err-disabled state after a port security violation?

Reload the switch
Shut down and then no shutdown the interface (Correct answer)
Clear the MAC address table
Remove and reapply the port-security configuration

Correct answer: Shut down and then no shutdown the interface

To recover an err-disabled port, issue 'shutdown' followed by 'no shutdown' on the interface after resolving the cause of the violation.

Question 37: Which essential characteristic of cloud computing means resources can be quickly scaled up or down to match demand?

Resource pooling
Rapid elasticity (Correct answer)
Measured service
Broad network access

Correct answer: Rapid elasticity

NIST defines rapid elasticity as the ability to provision and release capacity quickly, often automatically, so resources follow demand. The other options are separate NIST characteristics: shared multi-tenant pools, access over standard networks, and metered usage.

Question 38: A network administrator needs to automate configuration changes across a multi-vendor network. A key requirement is that no special software or 'agent' can be installed on the network devices. Which configuration management tool is most suitable for this scenario?

Puppet
Cisco DNA Center
Ansible (Correct answer)
Chef

Correct answer: Ansible

Ansible is an agentless configuration management tool, meaning it communicates with managed devices over standard protocols like SSH without requiring any client software to be installed on them. [9, 12] This makes it ideal for environments where installing agents is not feasible or desirable. Puppet and Chef, in contrast, are primarily agent-based, requiring a client on each managed node. [8, 14] While Cisco DNA Center is a powerful automation platform, it is a full network controller, not just a configuration management tool in the same category as Ansible, Puppet, or Chef. [24]

Question 39: Which of the following are the two most common data serialization formats used in modern network automation and REST APIs for their human-readable structure?

Binary and BSON
JSON and YAML (Correct answer)
HTML and CSS
SNMP and NetFlow

Correct answer: JSON and YAML

JSON (JavaScript Object Notation) and YAML (YAML Ain't Markup Language) are widely used data serialization formats in network automation. [10, 26] They provide a standardized, human-readable way to structure data, which is essential for communication between different systems, such as in REST API calls. [16, 28] XML is also a common format but JSON and YAML are often preferred for their simplicity and readability in many modern applications. [20] SNMP, NetFlow, HTML, and Binary are protocols or formats used for other purposes in networking and web development.

Question 40: Which of the following protocols is a Distance Vector Protocol?

RIP (Correct answer)
BGP
OSPF
EIGRP

Correct answer: RIP

Distance Vector routing protocols determine the best path to a destination based on the 'distance' (e.g., hop count) and the 'direction' (vector) to reach it, typically relying on information from directly connected neighbors. RIP (Routing Information Protocol) is a classic example of a distance vector protocol, using hop count as its primary metric and periodically exchanging full routing tables with its neighbors.

Question 41: Which 802.11 service set type allows two wireless clients to communicate directly without an AP?

DSS (Distribution Service Set)
IBSS (Independent Basic Service Set) (Correct answer)
ESS (Extended Service Set)
BSS (Basic Service Set)

Correct answer: IBSS (Independent Basic Service Set)

An IBSS (Independent BSS), also called an ad-hoc network, allows devices to communicate peer-to-peer without requiring an access point.

Question 42: In the context of NAT terminology, what does the 'inside global' address represent?

The IP address of an internal host as it appears to the public network. (Correct answer)
The IP address of an external host as it appears to the internal network.
The private IP address assigned to a host on the internal network.
The public IP address of a destination host on the internet.

Correct answer: The IP address of an internal host as it appears to the public network.

The 'inside global' address is the public, routable IP address that represents one or more 'inside local' addresses to the outside world. When a packet from an internal host traverses a NAT router, its source address (the inside local) is translated to the inside global address.

Question 43: Which protocol encrypts the entire management session between an administrator and a Cisco device?

Telnet
SNMP v2c
TFTP
SSH (Correct answer)

Correct answer: SSH

SSH (Secure Shell) encrypts all traffic between the client and the network device, while Telnet transmits data in plaintext.

Question 44: Which of the wireless protocols is the most reliable?

WPA3 (Correct answer)
WPA2
WPA
WEP
None of them

Correct answer: WPA3

WPA3 is the latest and most secure wireless security protocol, offering significant improvements over its predecessors like WPA2, WPA, and WEP. It provides enhanced encryption, stronger authentication, and protection against brute-force attacks. These advancements make WPA3 the most reliable choice for securing modern wireless networks.

Question 45: Which command verifies the current NTP synchronization status and stratum on a Cisco IOS device?

show clock detail
debug ntp events
show ntp status (Correct answer)
show ntp associations

Correct answer: show ntp status

'show ntp status' displays whether the clock is synchronized, the reference server, stratum level, and clock offset.

Question 46: Which NTP stratum number indicates that a device is directly connected to a reference clock (e.g., GPS)?

Stratum 0
Stratum 15
Stratum 2
Stratum 1 (Correct answer)

Correct answer: Stratum 1

Stratum 1 NTP servers are directly connected to a stratum 0 reference clock source such as GPS or atomic clocks.

Question 47: Which of the following statements concerning TCP and UDP are correct?

TCP is slower than UDP. (Correct answer)
TCP is a secure protocol UDP is not secure. (Correct answer)
TCP has 8 bits header.
UDP has guaranteed transmission
There is no error checking mechanism in UDP (Correct answer)

Correct answer: TCP is slower than UDP.

Explanation: <br> The main difference between these protocols is that TCP is a connection-oriented protocol, while UDP is a connectionless one. Each of the protocols has its strengths and weaknesses. One is much faster, while the other is safer.

Question 48: Which HTTP method is used to partially update an existing resource in a REST API?

POST
DELETE
PUT
PATCH (Correct answer)

Correct answer: PATCH

PATCH is used for partial updates to an existing resource, while PUT replaces the entire resource.

Question 49: Which STP port state forwards data frames but does NOT learn MAC addresses?

Listening (Correct answer)
Blocking
Learning
Forwarding

Correct answer: Listening

The Listening state participates in frame forwarding decisions but does not populate the MAC address table.

Question 50: Which DNS record type maps a fully qualified domain name (FQDN) to an IPv4 address?

A record (Correct answer)
AAAA record
PTR record
CNAME record

Correct answer: A record

An A (Address) record maps a hostname to a 32-bit IPv4 address in the DNS namespace.

Question 51: What happens when you configure one side of a link with EtherChannel mode 'On' and the other side with mode 'Active' (LACP)?

The EtherChannel fails to form because 'On' mode does not send or respond to negotiation packets (Correct answer)
The switch automatically detects the mismatch and switches to passive mode
The EtherChannel forms successfully using LACP
The EtherChannel forms using PAgP as a fallback

Correct answer: The EtherChannel fails to form because 'On' mode does not send or respond to negotiation packets

'On' mode forces EtherChannel without any negotiation protocol; it will not respond to LACP or PAgP packets, so the channel will not form with a negotiating peer.

Question 52: Which Syslog severity level number represents a 'Critical' condition on a Cisco device?

0
2 (Correct answer)
4
6

Correct answer: 2

Syslog severity level 2 is Critical, indicating serious conditions that require immediate attention.

Question 53: What does a DHCP NACK message indicate to a client?

The client must renew its lease immediately
The server is out of available addresses
The requested IP address is unavailable or invalid (Correct answer)
The server has accepted the client's request

Correct answer: The requested IP address is unavailable or invalid

A DHCP NACK (Negative Acknowledgment) tells the client its requested IP address cannot be provided and it must restart the discovery process.

Question 54: A network engineer is writing a Python script to interact with a device's RESTCONF API. The script needs to retrieve the current state of all interfaces. Which HTTP method should be used in the API request for this read-only operation?

PUT
DELETE
POST
GET (Correct answer)

Correct answer: GET

The HTTP GET method is used to retrieve data from a specified resource. [1, 7] In the context of REST APIs, this corresponds to the 'Read' operation in CRUD (Create, Read, Update, Delete). [3, 15] POST is used to create a new resource, PUT is used to update or replace an existing resource, and DELETE is used to remove a resource. [7, 15] Since the engineer only wants to retrieve information without making changes, GET is the appropriate method.

Question 55: A network administrator needs to use a standard ACL to prevent traffic from the 192.168.1.0/24 subnet from reaching the server subnet 10.10.10.0/24. All other traffic from 192.168.1.0/24 should be permitted to reach other destinations. According to Cisco best practices, where should this ACL be placed?

Inbound on the source router's interface connected to 192.168.1.0/24.
Outbound on the destination router's interface connected to 10.10.10.0/24. (Correct answer)
Inbound on the destination router's interface leading towards the source.
Outbound on the source router's interface leading towards the destination.

Correct answer: Outbound on the destination router's interface connected to 10.10.10.0/24.

The best practice for standard ACLs is to place them as close to the destination as possible. This is because standard ACLs only filter by source address and cannot specify a destination. Placing it close to the source (e.g., inbound on the source router) would block all traffic from 192.168.1.0/24, preventing it from reaching any destination, not just the intended server subnet.

Question 56: A network consists of a single 24-port switch. All ports are operating in full-duplex mode. How many collision domains and broadcast domains exist in this network by default?

24 collision domains, 1 broadcast domain (Correct answer)
24 collision domains, 24 broadcast domains
1 collision domain, 1 broadcast domain
1 collision domain, 24 broadcast domains

Correct answer: 24 collision domains, 1 broadcast domain

Each port on a switch is a separate collision domain. Therefore, a 24-port switch has 24 collision domains. By default, all ports on a single switch are part of the same broadcast domain (typically VLAN 1). Broadcasts are forwarded out of all ports. Routers or VLANs are required to segment a network into multiple broadcast domains.

Question 57: What is the purpose of configuring an 'exec-timeout' on Cisco VTY lines?

Applies an inactivity ACL to VTY lines
Automatically disconnects idle management sessions after a specified time (Correct answer)
Sets the maximum session login time
Limits the number of concurrent VTY sessions

Correct answer: Automatically disconnects idle management sessions after a specified time

'exec-timeout <minutes> <seconds>' closes inactive VTY sessions automatically, reducing the risk of unauthorized access to unattended sessions.

Question 58: An administrator needs to insert a new rule into an existing, numbered standard ACL (access-list 10). The new rule must permit a specific host (192.168.5.5) and should be evaluated before any other existing rules in the ACL. Which of the following methods should be used to achieve this?

Use a sequence number to insert the new permit statement at the beginning of the ACL. (Correct answer)
Use a text editor to copy the ACL, insert the new line at the top, delete the old ACL, and paste the new version.
Re-enter the entire ACL from the CLI, typing the new permit statement first.
Add the new permit statement to the end of the ACL and use the `ip access-list resequence` command.

Correct answer: Use a sequence number to insert the new permit statement at the beginning of the ACL.

Modern Cisco IOS allows for editing both numbered and named ACLs using sequence numbers. To insert a rule at the beginning, an administrator can enter the specific ACL configuration mode (`ip access-list standard 10`) and then specify a low sequence number (e.g., `5 permit host 192.168.5.5`) to place it before the default sequence numbers, which start at 10 and increment by 10.

Question 59: Which NetFlow command on a Cisco router exports flow data to a collector at 10.0.0.50 on UDP port 9996?

netflow export 10.0.0.50 9996
ip netflow collector 10.0.0.50 9996
ip flow-export destination 10.0.0.50 9996 (Correct answer)
ip flow destination 10.0.0.50 port 9996

Correct answer: ip flow-export destination 10.0.0.50 9996

The command 'ip flow-export destination <ip> <port>' configures the router to send NetFlow records to the specified collector.

Question 60: Which type of VLAN attack allows a rogue device to send frames on a VLAN other than the one it is assigned to?

STP manipulation
MAC spoofing
ARP poisoning
VLAN hopping (Correct answer)

Correct answer: VLAN hopping

VLAN hopping exploits trunk negotiation (DTP) or double-tagging to inject frames into a target VLAN without authorization.

Question 61: Which of the following correctly identifies the Protocol Data Unit (PDU) at the OSI Transport Layer?

Bits
Packet
Segment (Correct answer)
Frame

Correct answer: Segment

The Protocol Data Unit (PDU) at the Transport Layer (Layer 4) is called a segment when using TCP, or a datagram when using UDP. Packets are the PDU for the Network Layer (Layer 3), Frames are for the Data Link Layer (Layer 2), and Bits are for the Physical Layer (Layer 1).

Question 62: Which statement accurately describes a key characteristic of dynamic routing protocols like OSPF and EIGRP compared to static routing?

They consume no router CPU or memory resources.
They reduce administrative overhead in large networks by automatically learning routes. (Correct answer)
They are best suited for small, simple networks with predictable traffic paths.
They provide greater security because routes are not advertised over the network.

Correct answer: They reduce administrative overhead in large networks by automatically learning routes.

Dynamic routing protocols automatically discover remote networks and adapt to topology changes without manual intervention. This significantly reduces the administrative burden required to maintain routing tables in large or frequently changing networks, which is a major drawback of relying solely on static routes.

Question 63: Which IPv6 address type is equivalent to an IPv4 private address and is used only within a site?

Link-local
Global unicast
Unique local (Correct answer)
Multicast

Correct answer: Unique local

Unique local addresses (FC00::/7) are used for internal communication within a site, similar to RFC 1918 private IPv4 addresses.

Question 64: Which of the following is a primary advantage of using dynamic NAT without overload (PAT) instead of static NAT?

It allows a specific internal server to be reached from the internet on a fixed public IP.
It provides a permanent one-to-one mapping for every host on the internal network.
It allows multiple internal hosts to share a single public IP address simultaneously.
It conserves public IP addresses by creating translations only when they are needed for outbound connections. (Correct answer)

Correct answer: It conserves public IP addresses by creating translations only when they are needed for outbound connections.

Dynamic NAT allocates a public IP address from a pool to an internal host, but only when that host initiates an outbound connection. The mapping is temporary and is returned to the pool after a period of inactivity. This is more efficient than static NAT, which permanently reserves a public IP for each internal host, whether it's active or not.

Question 65: A network administrator wants to prevent a switch from learning MAC addresses on a specific port dynamically. Which feature should be used?

VLAN pruning
DHCP snooping
Spanning Tree PortFast
Port security with sticky MAC (Correct answer)

Correct answer: Port security with sticky MAC

Port security with sticky MAC learning locks down dynamically learned addresses and converts them to secure sticky entries.

Question 66: Which IP SLA probe type can measure round-trip time (RTT) to a remote Cisco device using ICMP echo?

udp-jitter
http
tcp-connect
icmp-echo (Correct answer)

Correct answer: icmp-echo

IP SLA icmp-echo probes send ICMP echo requests to a target IP and measure round-trip time for availability monitoring.

Question 67: Which description best matches a typical SOHO (small office/home office) network?

A three-tier design with separate core switches
A single integrated device that acts as router, switch, firewall, and wireless AP (Correct answer)
An MPLS WAN connecting dozens of branches
A spine-leaf fabric with redundant spines

Correct answer: A single integrated device that acts as router, switch, firewall, and wireless AP

SOHO networks usually use one consumer or small-business device that combines routing, a small switch, a firewall/NAT, and a wireless access point, connected to a single ISP link.

Question 68: Which Cisco-proprietary protocol is used to negotiate EtherChannel formation between switches?

CDP
LACP
LLDP
PAgP (Correct answer)

Correct answer: PAgP

Port Aggregation Protocol (PAgP) is Cisco's proprietary protocol for automatically negotiating EtherChannel bundles between Cisco devices.

Question 69: What does the flag 'D' indicate for a port in the output of 'show etherchannel summary'?

The port is a dynamic trunk port
The port is in LACP active mode
The port is down and not part of the active bundle (Correct answer)
The port is the designated root port

Correct answer: The port is down and not part of the active bundle

The 'D' flag in 'show etherchannel summary' indicates the port is down, meaning it is not contributing to the active EtherChannel bundle.

Question 70: Which data serialization format does NETCONF use natively?

CSV
JSON
XML (Correct answer)
YAML

Correct answer: XML

NETCONF uses XML as its native data encoding format for both configuration data and protocol messages.

Question 71: A port is configured with `switchport mode dynamic desirable`. What will happen if the neighboring port is set to `switchport mode access`?

The port stays in dynamic desirable mode indefinitely
The port becomes an access port (Correct answer)
The port becomes a trunk
The link goes down

Correct answer: The port becomes an access port

Dynamic desirable will form a trunk only if the neighbor also negotiates trunking; an access-mode neighbor causes it to become an access port.

Question 72: Which first hop redundancy protocol is Cisco-proprietary and uses an active/standby model with one virtual IP address?

GLBP
VRRP
HSRP (Correct answer)
CARP

Correct answer: HSRP

HSRP (Hot Standby Router Protocol) is Cisco-proprietary. One router is elected active and forwards traffic sent to the virtual IP, while a standby router takes over if the active router fails. VRRP is an open standard, GLBP adds load balancing, and CARP is not a Cisco protocol.

Question 73: Which command configures a Cisco router as a DHCP server and excludes the first 10 addresses of the 192.168.1.0/24 pool?

no ip dhcp address 192.168.1.1 192.168.1.10
ip dhcp pool exclude 192.168.1.1 192.168.1.10
ip dhcp excluded-address 192.168.1.1 192.168.1.10 (Correct answer)
ip dhcp no-assign 192.168.1.1 192.168.1.10

Correct answer: ip dhcp excluded-address 192.168.1.1 192.168.1.10

The 'ip dhcp excluded-address' command prevents specified IP addresses from being assigned by the DHCP server.

Question 74: What is the correct order of encapsulation when a user sends an HTTP request from a web browser?

Frame → Packet → Segment → Data → Bits
Data → Segment → Packet → Frame → Bits (Correct answer)
Bits → Frame → Packet → Segment → Data
Segment → Packet → Data → Frame → Bits

Correct answer: Data → Segment → Packet → Frame → Bits

Encapsulation proceeds top-down: Application data → Transport segment → Network packet → Data Link frame → Physical bits.

Question 75: A switch receives a frame with a destination MAC address not in its MAC address table. What does it do?

Floods the frame out all ports except the incoming port (Correct answer)
Buffers the frame until the address is learned
Drops the frame
Sends the frame back to the source

Correct answer: Floods the frame out all ports except the incoming port

When a switch receives a frame with an unknown unicast destination, it floods the frame out all ports except the one it arrived on.

Question 76: What command is used to turn on the Cisco router interface?

no shutdown (Correct answer)
run
activate
shutdown

Correct answer: no shutdown

In Cisco IOS, network interfaces are often administratively shut down by default or can be manually disabled. The `no shutdown` command is used within the interface configuration mode to bring an interface up and enable it to send and receive traffic. This command is essential for activating a router's physical or logical connections.

Question 77: A network engineer needs to allow VLANs 10, 20, and 30 on a trunk and remove all others. Which command accomplishes this?

switchport allowed vlan 10,20,30
switchport trunk allowed vlan add 10,20,30
switchport trunk vlan allow 10,20,30
switchport trunk allowed vlan 10,20,30 (Correct answer)

Correct answer: switchport trunk allowed vlan 10,20,30

Using `switchport trunk allowed vlan 10,20,30` replaces the entire allowed list with only VLANs 10, 20, and 30.

Question 78: What is the default lease time for a DHCP address assignment on a Cisco IOS router if not explicitly configured?

12 hours
8 hours
7 days
1 day (Correct answer)

Correct answer: 1 day

Cisco IOS DHCP server defaults to a 1-day (24-hour) lease time when no explicit lease duration is configured.

Question 79: Which command on a Cisco switch sends Syslog messages to a remote server at 10.1.1.100?

logging 10.1.1.100 remote
logging host 10.1.1.100 (Correct answer)
ip syslog 10.1.1.100
syslog server 10.1.1.100

Correct answer: logging host 10.1.1.100

The global configuration command 'logging host <ip>' directs Syslog output to the specified remote Syslog server.

Question 80: A network administrator is configuring a multilayer switch to perform routing between VLANs. This device primarily operates at which two layers of the OSI model?

Layer 4 and Layer 7
Layer 3 and Layer 4
Layer 2 and Layer 3 (Correct answer)
Layer 1 and Layer 2

Correct answer: Layer 2 and Layer 3

A multilayer switch, also known as a Layer 3 switch, combines the functionality of a switch and a router. It performs standard Layer 2 (Data Link) functions like MAC address-based forwarding within a VLAN, and also Layer 3 (Network) functions like IP address-based routing between different VLANs.

Question 81: An administrator applies the command 'ip access-group 101 in' on an interface. What does this mean?

ACL 101 is applied to all interfaces
ACL 101 filters traffic entering the interface (Correct answer)
ACL 101 is a named ACL
ACL 101 filters traffic leaving the interface

Correct answer: ACL 101 filters traffic entering the interface

The 'in' keyword applies the ACL to inbound traffic arriving on that interface.

Question 82: Which OSI layer converts data between formats such as encryption, compression, and character encoding?

Session (Layer 5)
Presentation (Layer 6) (Correct answer)
Application (Layer 7)
Transport (Layer 4)

Correct answer: Presentation (Layer 6)

The Presentation layer (Layer 6) handles data translation, encryption/decryption, and compression between the application and network.

Question 83: What is the primary purpose of the Spanning Tree Protocol (STP) in a switched network?

To dynamically assign VLANs to switch ports.
To increase the speed of frame forwarding.
To provide a mechanism for inter-VLAN routing.
To prevent Layer 2 switching loops. (Correct answer)

Correct answer: To prevent Layer 2 switching loops.

Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks. Its primary function is to prevent bridge loops and the broadcast radiation that results from them by blocking redundant paths in a switched network.

Question 84: Which 802.11 amendment introduced the concept of high-throughput (HT) with MIMO and channel bonding up to 40 MHz?

802.11g
802.11ac
802.11n (Correct answer)
802.11a

Correct answer: 802.11n

802.11n introduced MIMO (Multiple Input Multiple Output) and optional 40 MHz channel bonding, significantly increasing throughput.

Question 85: In a REST API response, which HTTP status code indicates that a new resource was successfully created?

204 No Content
201 Created (Correct answer)
202 Accepted
200 OK

Correct answer: 201 Created

HTTP 201 Created is the standard response when a POST request successfully creates a new resource.

Question 86: In server virtualization, what connects the virtual NICs of VMs to each other and to the host's physical NICs?

A NAT pool
An IPS
A WLC
A virtual switch (vSwitch) (Correct answer)

Correct answer: A virtual switch (vSwitch)

The hypervisor provides a virtual switch that forwards frames between VM vNICs on the same host and uplinks them to the physical network through the host's physical NICs. It can also apply VLAN tagging.

Question 87: Which DTP mode will actively attempt to negotiate a trunk with the neighboring switch?

dynamic auto
trunk
dynamic desirable (Correct answer)
access

Correct answer: dynamic desirable

Dynamic desirable actively sends DTP frames to negotiate a trunk, while dynamic auto only responds to DTP from the other side.

Question 88: What does the 'established' keyword do in an extended ACL?

Matches only UDP traffic
Permits all TCP traffic
Permits TCP packets with ACK or RST bits set (Correct answer)
Denies all new TCP connections

Correct answer: Permits TCP packets with ACK or RST bits set

The 'established' keyword matches TCP segments that have the ACK or RST bit set, indicating an existing session.

Question 89: If Dynamic ARP Inspection (DAI) is enabled,.... is checked, and this ARP packet is permitted if the incoming MAC address is in this table.

IP-MAC Binding Table (Correct answer)
None of the above
MAC Table
RIB Table

Correct answer: IP-MAC Binding Table

Dynamic ARP Inspection (DAI) is a security feature that prevents ARP spoofing and poisoning attacks by validating ARP packets. When DAI is enabled, it checks incoming ARP packets against the IP-MAC binding table, which is often populated by DHCP snooping. If an ARP packet's source IP-MAC address pair does not match an entry in this trusted table, the packet is dropped, preventing unauthorized ARP traffic.

Question 90: 'show interfaces' on a switch port shows a growing count of late collisions. What is the most likely cause?

A missing default gateway
STP blocking the port
A duplex mismatch (Correct answer)
An incorrect VLAN assignment

Correct answer: A duplex mismatch

Late collisions are the classic sign of a duplex mismatch. The half-duplex side detects collisions after the first 64 bytes because the full-duplex side transmits whenever it wants. Cables longer than spec can also cause them, but duplex mismatch is the usual answer.

Question 91: In a Cisco DNA Center architecture, which type of API is used by external applications and orchestration systems to communicate high-level, business-oriented requests or 'intent' to the controller?

Eastbound API
Southbound API
Westbound API
Northbound API (Correct answer)

Correct answer: Northbound API

Northbound APIs (NBIs) are used for communication between the SDN controller (like Cisco DNA Center) and the applications or orchestration layers above it. [23, 29] These APIs abstract the complexity of the network and allow administrators to define policies and intent. [13] Southbound APIs (SBIs), on the other hand, are used by the controller to communicate with the network devices themselves (e.g., switches and routers) using protocols like NETCONF, RESTCONF, or SNMP. [5, 23]

Question 92: What is the minimum RSA key size recommended when generating SSH keys on a Cisco IOS device for SSHv2?

2048 bits (Correct answer)
1024 bits
512 bits
768 bits

Correct answer: 2048 bits

SSHv2 requires a minimum RSA key modulus of 768 bits, but Cisco and industry best practices recommend at least 2048 bits for current deployments.

Question 93: A router receives a packet destined for a remote network. At which OSI layer does it make the forwarding decision?

Layer 1
Layer 3 (Correct answer)
Layer 2
Layer 4

Correct answer: Layer 3

Routers operate at Layer 3 (Network) and use the destination IP address in the packet header to make forwarding decisions.

Question 94: Which IPv4 address class supports the most hosts per network?

Class C
Class A (Correct answer)
Class D
Class B

Correct answer: Class A

Class A networks use only 8 bits for the network portion, leaving 24 bits for hosts — supporting over 16 million hosts per network.

Question 95: A network administrator is concerned about network latency and wants to ensure frames with errors are not propagated through the network. Which switching method should be used?

Store-and-Forward (Correct answer)
Fast-Forward
Fragment-Free
Cut-Through

Correct answer: Store-and-Forward

The store-and-forward switching method receives the entire frame before making a forwarding decision. This allows the switch to check the Frame Check Sequence (FCS) at the end of the frame for errors. If an error is detected, the frame is dropped. Cut-through methods, like fast-forward and fragment-free, begin forwarding before the entire frame is received and therefore cannot check for all errors.

Question 96: A network topology consists of SwitchA (Root Bridge), SwitchB, and SwitchC. SwitchB connects to SwitchA via a 1 Gbps link. SwitchC connects to SwitchB via a 100 Mbps link. Assuming default STP costs are used, what is the root path cost for SwitchC?

38
23 (Correct answer)
19
4

Correct answer: 23

The root path cost is the cumulative cost of all links to the root bridge. The default short path cost for a 1 Gbps link is 4, and for a 100 Mbps link is 19. SwitchB's cost to the root is 4. SwitchC's total cost is its own link cost to SwitchB plus SwitchB's cost to the root. Therefore, SwitchC's root path cost is 19 (SwitchC-to-SwitchB link) + 4 (SwitchB-to-SwitchA link) = 23.

Question 97: Which of these is the Cisco-developed Neighbour Discovery Protocol?

CGMP
ICMP
IGMP
CDP (Correct answer)

Correct answer: CDP

CDP (Cisco Discovery Protocol) is a Cisco proprietary Layer 2 protocol used to discover information about directly connected Cisco devices. It allows devices to share details such as device type, IOS version, capabilities, and connected interface. This protocol is invaluable for network documentation, troubleshooting, and managing Cisco-centric network environments.

Question 98: A member interface shows the flag 's' in 'show etherchannel summary'. What is the most likely cause?

It is running PAgP in auto mode
Its configuration (e.g., allowed VLANs or speed) does not match the other members (Correct answer)
It is the standby LACP port beyond the max-bundle limit
It is bundled and forwarding normally

Correct answer: Its configuration (e.g., allowed VLANs or speed) does not match the other members

Lowercase 's' means suspended, usually because of a configuration mismatch with the other bundle members.

Question 99: During a Traffic Exceed, QoS.... is the mechanism used. Exceed Traffic is buffered and transmitted again after a brief delay.

Traffic Shaping (Correct answer)
Traffic Selecting
Traffic Determining
Traffic Monitoring

Correct answer: Traffic Shaping

Traffic shaping is a Quality of Service (QoS) mechanism designed to manage and smooth out network traffic flow. When traffic exceeds a configured rate, traffic shaping buffers the excess packets and then transmits them at a regulated, consistent pace. This prevents bursts of data from overwhelming the network, reducing congestion and packet loss for critical applications.

Question 100: A network engineer needs to troubleshoot why two hosts can ping each other but cannot establish a Telnet session. Which OSI layer should be investigated first?

Layer 4 - Transport (Correct answer)
Layer 3 - Network
Layer 2 - Data Link
Layer 1 - Physical

Correct answer: Layer 4 - Transport

Ping operates at Layer 3, so if ping works, Layers 1-3 are functional; Telnet failures point to Layer 4 (TCP port 23) or above.

Cisco CCNA 200-301 Exam

The Cisco Certified Network Associate (CCNA 200-301) exam validates the ability to install, configure, operate, and troubleshoot medium-sized routed and switched networks, covering network fundamentals, access, IP connectivity, services, security, and automation.

100

Questions

120 min

Time Limit

83%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learningcontent.cisco.com — Exam information · verified Oct 2026
cisco.com — Time limit, test delivery, eligibility, fees, renewal, retake fee, score validity, passing score, retake policy, score release · verified Oct 2026
blogs.cisco.com — Exam dates, test dates · verified Oct 2026