PrepPass team · Verified against Cisco · How we review
Free · printable · no signup
Cisco CCNA (200-301) Exam Cheat Sheet (2026)
A free, printable Cisco CCNA (200-301) exam cheat sheet: the 139 highest-yield points to know, grouped into 6 sections that follow the exam's content areas, each section with its published weight.
- Free to read, print and keep — no signup, no email, no paywall.
- The real Cisco CCNA (200-301) exam: 120 minutes.
- Prints from your browser (Ctrl-P, or Cmd-P on a Mac) — the navigation, buttons and links drop out of the printed copy.
- 522 free Cisco CCNA (200-301) practice questions on the same material, every one explained.
- Last updated: August 2026.
Studying in order?
In the Cisco CCNA 200-301 guide: 89 worked examples, from subnetting to OSPF cost, with every step of the arithmetic written out. Practice here stays free.
Network Fundamentals
20% of the exam- Layer order (1-7): Physical, Data Link, Network, Transport, Session, Presentation, Application.
- Switch = Layer 2 (MAC); Router = Layer 3 (IP); firewall inspects up to Layer 4 and above.
- PDU names: bits, frame, packet, segment.
- Across a routed path, IP addresses stay the same end to end; MAC addresses change at each hop.
- Straight-through cable = unlike devices (PC-to-switch, switch-to-router).
- Crossover cable = like devices (switch-to-switch, PC-to-PC).
- Rollover cable = console/management access.
- Duplex mismatch causes late collisions and CRC errors even when the link stays up.
- Single-mode fiber for long distance; multimode for shorter runs.
- Usable hosts = 2^(host bits) − 2; block size = 256 − mask octet value.
- 172.16.45.10/20 → network 172.16.32.0, broadcast 172.16.47.255.
- 192.168.1.100/26 → network 192.168.1.64, broadcast 192.168.1.127.
- /30 gives 2 usable hosts (ideal for point-to-point WAN links).
- Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
- Compression: drop leading zeros; :: replaces one run of zero hextets, used only once.
- Link-local FE80::/10 is auto-created and never routed off the link.
- SLAAC builds a host address from the RA /64 prefix; standard LAN prefix is /64.
- NDP (ICMPv6) replaces ARP; FF02::1 = all nodes, FF02::2 = all routers.
- IPv6 has no broadcast — multicast (FF00::/8) is used instead.
- TCP is reliable/connection-oriented (three-way handshake SYN, SYN-ACK, ACK); UDP is best-effort.
- Use UDP for real-time voice/video and DNS; TCP for web, email, file transfer.
- Well-known ports: FTP 20/21, SSH 22, Telnet 23, DNS 53, HTTP 80, HTTPS 443.
- DHCP 67/68, SNMP 161/162, Syslog 514 — all UDP.
- A socket = IP address + port number.
Network Access
20% of the exam- Switch process: learn source MAC, then forward known unicast or flood unknown/broadcast/multicast.
- Unknown-unicast, broadcast, and multicast frames are flooded out all ports in the VLAN except the ingress port.
- Each port = one collision domain; each VLAN = one broadcast domain.
- MAC address table default aging = 300 seconds.
- Cisco default forwarding is store-and-forward (checks FCS).
- Access port = one VLAN, untagged; trunk port = many VLANs, tagged.
- 802.1Q inserts a 4-byte tag; the native VLAN is sent untagged and must match on both trunk ends.
- Devices in different VLANs need a router / Layer 3 switch to communicate (inter-VLAN routing).
- VLAN 1 is the default and cannot be deleted; normal range 1-1005.
- Best practice: statically set access/trunk mode and disable DTP with switchport nonegotiate.
- Root bridge = lowest bridge ID (priority + MAC); on a tie, lowest MAC wins.
- Adjust priority in increments of 4096; each non-root switch has one root port (lowest path cost).
- STP costs: 10M=100, 100M=19, 1G=4, 10G=2 (lower is better).
- Rapid PVST+ (802.1w) converges in seconds vs up to 50s for classic 802.1D.
- PortFast = instant forwarding on host ports; BPDU Guard err-disables a PortFast port that receives a BPDU.
- EtherChannel bundles links into one logical port-channel; STP does not block the members.
- LACP (standard) modes: active/passive — not passive-passive. PAgP (Cisco) modes: desirable/auto — not auto-auto.
- 'on' mode = static, no negotiation, must match on both ends; do not mix on with LACP/PAgP.
- All members must match speed, duplex, allowed VLANs, native VLAN, and mode.
- Verify with show etherchannel summary (look for P and SU flags).
- Wi-Fi uses CSMA/CA on a shared half-duplex medium; 2.4 GHz non-overlapping channels are 1, 6, 11.
- Lightweight APs use split-MAC and are managed by a WLC; autonomous APs are standalone.
- AP-to-WLC uses CAPWAP: control tunnel UDP 5246, data tunnel UDP 5247.
- SSID = network name; a WLAN on the WLC maps an SSID to a VLAN/interface and a security policy.
- APs can discover the WLC via DHCP option 43, DNS, or broadcast.
IP Connectivity
25% of the exam- Longest-prefix (most-specific) match always wins, regardless of AD or metric.
- AD and metric only break ties between routes of equal prefix length.
- Route codes: C=connected, L=local, S=static, O=OSPF, D=EIGRP, B=BGP.
- Default route 0.0.0.0/0 (gateway of last resort) is used only when no specific match exists.
- 'show ip route <destination>' reveals the exact entry the router will use.
- Decision order: longest prefix → lowest AD → lowest metric.
- AD values: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120, iBGP 200.
- AD compares different routing sources; metric compares routes within one protocol.
- Floating static route = a static route with a raised AD used as a backup to a dynamic route.
- AD 255 = route is treated as unreachable and not installed.
- Syntax: ip route <network> <mask> <next-hop | exit-interface>.
- Default route = ip route 0.0.0.0 0.0.0.0 <next-hop>; matches when nothing more specific does.
- On Ethernet/multi-access links, prefer a next-hop IP to avoid recursive-lookup/ARP issues.
- Floating static = ip route ... <AD> with AD higher than the dynamic protocol's, used as backup.
- Routing must work both directions — always configure the return route.
- OSPF is link-state, AD 110; all routers in an area share an identical LSDB and run SPF (Dijkstra).
- OSPF cost = reference bandwidth (default 100 Mbps) ÷ interface bandwidth; lower cost wins, path cost is summed.
- Adjacency requires matching area, hello/dead timers, subnet, MTU, and authentication.
- DR/BDR election: highest priority, then highest router ID; priority 0 never becomes DR/BDR.
- Router ID = highest loopback IP, else highest active interface IP, unless set manually; area 0 is the backbone.
- ARP (IPv4) / NDP (IPv6, ICMPv6) resolves the next-hop IP to a MAC before forwarding.
- Recursive lookup: the router resolves a non-connected next hop through additional routes until it reaches an exit interface.
- Enable IPv6 routing with 'ipv6 unicast-routing'; OSPFv3 is the IPv6 link-state protocol.
- IPv6 next-hop is often the neighbor's link-local (FE80::) address.
- Troubleshoot in order: routing table → ARP/neighbor table → ping/traceroute.
IP Services
10% of the exam- Static NAT = permanent one-to-one; dynamic NAT = pool, one-to-one at a time; PAT/overload = many-to-one via port numbers.
- PAT is the common form (whole site shares one public IP); enabled with the 'overload' keyword.
- Address types: inside local (private LAN) vs inside global (translated public).
- Mark interfaces ip nat inside / ip nat outside; verify with show ip nat translations.
- NAT is an IPv4 address-conservation workaround; IPv6 largely removes the need.
- DHCP process = DORA (Discover, Offer, Request, Acknowledge) over UDP 67/68.
- Cross-subnet DHCP needs ip helper-address on the client-side router interface (DHCP relay).
- DNS resolves names to IPs on UDP 53; A=IPv4, AAAA=IPv6, CNAME=alias, MX=mail, PTR=reverse.
- A 169.254.x.x (APIPA) address means no DHCP reply was received.
- Can ping IPs but not names = DNS problem, not connectivity.
- NTP synchronizes clocks over UDP 123 — essential for correlated logs, certificates, and troubleshooting.
- Stratum measures distance from the reference clock: stratum 1 is closest, lower is better (16 = unsynchronized).
- 'ntp server <ip>' sets a source; a router can be both client and server.
- NTP authentication (keys) prevents accepting time from untrusted sources.
- Verify with show ntp status (synchronized?) and show ntp associations (* = selected master).
- SNMP monitors devices over UDP 161/162; use v3 for authentication and encryption (v1/v2c use plaintext community strings).
- Syslog severities 0-7: 0 Emergency (most severe) to 7 Debugging; Syslog uses UDP 514.
- QoS classifies/marks (e.g. DSCP EF for voice) then queues so voice/video get priority during congestion.
- Voice requires low latency, low jitter, low loss — typically a priority queue.
- Use SSH (encrypted), never Telnet (cleartext); requires hostname, domain name, and an RSA key.
Security Fundamentals
15% of the exam- CIA triad: Confidentiality (encryption), Integrity (hashing), Availability (anti-DoS).
- AAA = Authentication (who), Authorization (what you may do), Accounting (what you did).
- RADIUS: open, UDP, encrypts only the password, combines authN/authZ (used for user/802.1X access).
- TACACS+: Cisco, TCP 49, encrypts the whole payload, separates authN/authZ/accounting (device admin).
- Use 'enable secret' (hashed), not 'enable password' (weak).
- ACLs are read top-down, first match wins, and end in an implicit deny any.
- Standard ACL (1-99) matches source only → place near the destination.
- Extended ACL (100-199) matches source, destination, protocol, and port → place near the source.
- Wildcard mask = inverse of subnet mask: /24 = 0.0.0.255, /26 = 0.0.0.63; 'host' = 0.0.0.0, 'any' = 255.255.255.255.
- Apply with ip access-group in|out; wrong direction/interface is the classic mistake.
- Port security limits MACs per port; default violation action is shutdown (err-disabled); modes: shutdown, restrict, protect.
- DHCP snooping marks trusted vs untrusted ports and blocks rogue DHCP replies on untrusted ports.
- Dynamic ARP Inspection uses the DHCP-snooping binding table to stop ARP spoofing.
- Match attack to fix: MAC flooding→port security, rogue DHCP→snooping, ARP spoof→DAI, IP spoof→IP Source Guard.
- Prevent VLAN hopping: disable DTP (switchport nonegotiate) and move the native VLAN off VLAN 1.
- Wi-Fi security order: WEP (broken) → WPA/TKIP (deprecated) → WPA2/AES (secure baseline) → WPA3/SAE (newest).
- WPA3 uses SAE, resisting offline dictionary attacks and providing forward secrecy.
- Personal mode = shared PSK; Enterprise mode = 802.1X with a RADIUS server (per-user credentials).
- Site-to-site VPN connects whole networks (IPsec); remote-access VPN connects one user (often SSL/TLS).
- IPsec provides confidentiality, integrity, authentication, and anti-replay; GRE tunnels but does not encrypt.
- Manage over SSH, not Telnet; use 'enable secret' (hashed) not 'enable password'.
- Run service password-encryption and use 'username ... secret' for hashed local accounts.
- Restrict VTY lines with an access-class ACL, set exec-timeout, and use login local / AAA.
- Add a legal login banner (not 'Welcome'); disable unused ports, services, and auto-trunking.
- Prefer secure management protocols: SSHv2, SNMPv3, WPA2/WPA3; patch IOS and back up configs.
Automation & Programmability
10% of the exam- Traditional networking = per-device control plane and manual CLI, which scales poorly.
- Controller-based networking centralizes intelligence and pushes consistent policy from one point.
- Northbound interface = toward apps/operators (REST API); southbound = toward devices (NETCONF/RESTCONF/OpenFlow).
- Benefits: consistency, speed, scale, visibility; trade-off: the controller must be highly available.
- Cisco DNA Center is the enterprise controller; ACI/APIC is the data-center controller.
- Data plane forwards packets; control plane decides paths (OSPF, STP, ARP); management plane administers (SSH, SNMP).
- SDN separates the control plane from the data plane and centralizes control in a controller.
- Devices become forwarders programmed by the controller's network-wide view.
- Southbound (controller→devices): OpenFlow, NETCONF, RESTCONF; northbound (apps→controller): REST API.
- Result: programmable, automated, consistent network behavior.
- REST is stateless over HTTP(S); methods map to CRUD: GET read, POST create, PUT/PATCH update, DELETE remove.
- Status codes: 200 OK, 201 Created, 401 Unauthorized, 404 Not Found, 500 Server Error; auth often via a token in a header.
- JSON: objects in { } as key:value pairs, arrays in [ ], values are strings/numbers/booleans/null/objects.
- Be able to read a JSON response (count array items, find a key's value); keys and strings use double quotes.
- XML (used by NETCONF) uses tags; YAML (used by Ansible) uses indentation and dashes.
- Config management enforces a declared desired state idempotently — re-running is safe and only fixes drift.
- Ansible: agentless, push model, YAML playbooks (popular for network automation).
- Puppet: agent-based, pull model, declarative manifests; Chef: agent-based, pull model, Ruby recipes/cookbooks.
- Benefits: less configuration drift, fewer errors, consistent auditable infrastructure-as-code.
- Cisco DNA Center = intent-based enterprise controller (design/policy/provision/assurance) with a northbound REST API.
Want the dense 6-page printable? Cisco CCNA 200-301 cheat sheet PDF — $9.99 →
Now prove you know them
Reading an outline is not the same as recalling it under exam pressure. Drill the free Cisco CCNA (200-301) questions to find the areas you keep missing, then sit a full timed mock.
Study aid, not a substitute for the official material — always confirm the current rule with Cisco.