Cisco CCNA (200-301) — All Questions

Which layer of the OSI model is responsible for logical addressing and determining the best path to route packets between networks?

• a.Data Link (Layer 2)
• b.Transport (Layer 4)
• c.Network (Layer 3)✓
• d.Session (Layer 5)

The Network layer (Layer 3) handles logical addressing, such as IPv4 and IPv6, and performs routing to select the best path across internetworks. Routers operate at this layer. The Data Link layer uses physical MAC addresses within a single segment, while the Transport layer manages end-to-end delivery.

A host is configured with the IPv4 address 172.16.45.10/20. What is the network address of the subnet it belongs to?

• a.172.16.45.0
• b.172.16.32.0✓
• c.172.16.40.0
• d.172.16.0.0

A /20 mask (255.255.240.0) makes the third octet increment in blocks of 16 (256 - 240 = 16). The subnets in the third octet are 0, 16, 32, 48, so 45 falls in the 32 block, giving a network address of 172.16.32.0. The host portion is zeroed to identify the subnet.

Which IPv6 address type is automatically configured on every IPv6-enabled interface and is only valid within a single link (never routed)?

• a.Link-local (FE80::/10)✓
• b.Global unicast (2000::/3)
• c.Unique local (FC00::/7)
• d.Multicast (FF00::/8)

Link-local addresses in the FE80::/10 range are automatically generated on each IPv6 interface and are used for on-link communication such as neighbor discovery and next-hop routing. Routers never forward packets with link-local source or destination addresses beyond the local link. Global unicast addresses are the routable, Internet-facing addresses.

Which TCP/IP protocol provides connectionless, best-effort delivery with no retransmission or flow control, making it suitable for real-time voice traffic?

• a.TCP
• b.ICMP
• c.ARP
• d.UDP✓

UDP (User Datagram Protocol) is a connectionless Transport layer protocol that adds minimal overhead and does not guarantee delivery, ordering, or provide flow control. This low latency makes it ideal for real-time applications like VoIP and video streaming where speed matters more than retransmission. TCP, by contrast, is connection-oriented and reliable.

On a Cisco switch trunk link using IEEE 802.1Q, how are frames belonging to the native VLAN handled by default?

• a.They are tagged with VLAN ID 1
• b.They are sent untagged✓
• c.They are dropped for security
• d.They are tagged with the highest VLAN ID

With 802.1Q, frames on the native VLAN traverse the trunk untagged by default, while all other VLANs are tagged with a 4-byte VLAN identifier. The native VLAN must match on both ends of the trunk to avoid a mismatch. For security, administrators often change the native VLAN away from the default VLAN 1.

In a Spanning Tree Protocol topology, which switch becomes the root bridge?

• a.The switch with the highest MAC address
• b.The switch with the most ports
• c.The switch with the lowest bridge ID✓
• d.The switch configured last

STP elects the root bridge as the switch with the lowest bridge ID, which is the combination of bridge priority and MAC address. If priorities are equal (default 32768), the lowest MAC address breaks the tie. Administrators lower the priority on the desired switch to control root placement.

Which EtherChannel negotiation protocol is an IEEE open standard (802.3ad) rather than Cisco-proprietary?

• a.LACP✓
• b.PAgP
• c.CDP
• d.VTP

LACP (Link Aggregation Control Protocol) is the IEEE 802.3ad open standard for dynamically bundling multiple physical links into one logical channel. PAgP is Cisco's proprietary equivalent. Bundling links increases bandwidth and provides redundancy while STP treats the channel as a single logical interface.

In a wireless network, what is the primary role of a Wireless LAN Controller (WLC) in a split-MAC architecture?

• a.It replaces all access points
• b.It acts only as a DHCP server
• c.It broadcasts the SSID directly to clients
• d.It centrally manages configuration and RF for lightweight APs✓

In split-MAC (controller-based) deployments, lightweight access points handle real-time RF functions while the WLC centrally manages configuration, security policies, roaming, and RF resource management via CAPWAP tunnels. This centralizes control of many APs. Autonomous APs, by contrast, operate independently without a controller.

A router has two routes to 10.1.1.0/24: a static route with administrative distance 1 and an OSPF route with AD 110. Which route is installed in the routing table?

• a.The OSPF route, because OSPF is dynamic
• b.The static route, because it has the lower AD✓
• c.Both routes, load-balanced equally
• d.Neither, they conflict and both are rejected

Administrative distance measures the trustworthiness of a routing source, and the route with the lower AD is preferred. A static route (AD 1) is preferred over an OSPF route (AD 110) to the same destination. The less-trusted OSPF route is kept in the OSPF database but not installed while the static route is valid.

Which command correctly configures a default static route that forwards all unknown-destination traffic to next-hop 203.0.113.1?

• a.ip route 203.0.113.1 0.0.0.0 0.0.0.0
• b.ip route 203.0.113.1 255.255.255.255 0.0.0.0
• c.ip route 0.0.0.0 0.0.0.0 203.0.113.1✓
• d.ip default-gateway 203.0.113.1

A default route uses 0.0.0.0 0.0.0.0 to match any destination, followed by the next-hop address, so 'ip route 0.0.0.0 0.0.0.0 203.0.113.1' is correct. It is the gateway of last resort used when no more specific route matches. The 'ip default-gateway' command only applies to a device that is not routing (ip routing disabled).

In OSPFv2, two routers on the same Ethernet segment fail to form an adjacency. Which mismatch is a common cause?

• a.Different hello/dead timers or mismatched area IDs✓
• b.Different hostnames
• c.Different interface descriptions
• d.Different serial numbers

OSPF neighbors must agree on parameters including hello and dead intervals, area ID, authentication, subnet mask, and MTU to reach the FULL adjacency state. A mismatch in any of these prevents the neighbor relationship from forming. Hostnames and descriptions are cosmetic and do not affect adjacency.

What metric does OSPF use by default to calculate the cost of a link?

• a.Hop count
• b.Delay
• c.Load
• d.Bandwidth (reference bandwidth / interface bandwidth)✓

OSPF calculates cost based on bandwidth, using the formula reference bandwidth (default 100 Mbps) divided by the interface bandwidth. Higher-bandwidth links receive lower costs and are preferred. Because modern links exceed the default reference, engineers often raise the reference bandwidth so faster interfaces are distinguished.

A packet arrives at a router destined for 192.168.5.130. The routing table contains 192.168.5.0/24, 192.168.5.128/25, and 0.0.0.0/0. Which route is used?

• a.192.168.5.0/24
• b.192.168.5.128/25✓
• c.0.0.0.0/0
• d.All three simultaneously

Routers forward using the longest prefix match, meaning the most specific route (the one with the longest matching subnet mask) wins. 192.168.5.130 falls within 192.168.5.128/25 (128-255 range), which is more specific than the /24 or the default route. Longer masks always take precedence regardless of administrative distance across differing prefixes.

Which statement about IPv6 Stateless Address Autoconfiguration (SLAAC) is correct?

• a.It requires a DHCPv6 server to assign every address
• b.It uses ARP to learn the gateway
• c.Hosts build their own address from the Router Advertisement prefix✓
• d.It only works with link-local addresses

With SLAAC, a host listens for Router Advertisement messages, takes the announced /64 prefix, and combines it with a self-generated interface identifier to form a global address without a DHCP server. Neighbor Discovery Protocol (not ARP) provides address resolution and router discovery in IPv6. DHCPv6 is optional and can supplement SLAAC for information like DNS.

A network uses Port Address Translation (PAT). How does the router distinguish return traffic for multiple internal hosts sharing one public IP address?

• a.By using unique source port numbers✓
• b.By using different MAC addresses
• c.By assigning each host a separate public IP
• d.By using VLAN tags

PAT (NAT overload) maps many private addresses to a single public IP by translating and tracking unique source port numbers for each session. The router records these port-to-host mappings in its translation table so return traffic is delivered to the correct inside host. This conserves scarce public IPv4 addresses.

Which protocol synchronizes the clocks of network devices so that log timestamps and certificates remain consistent?

• a.SNMP
• b.Syslog
• c.DNS
• d.NTP✓

NTP (Network Time Protocol) synchronizes device clocks to a reliable time source, typically over UDP port 123. Accurate time is essential for correlating Syslog messages, validating certificates, and troubleshooting. Devices reference a stratum hierarchy where lower stratum numbers are closer to the authoritative time source.

A standard IPv4 ACL is applied to filter traffic. On which criterion can a standard ACL match?

• a.Source and destination IP plus port
• b.Source IP address only✓
• c.Destination MAC address
• d.Application-layer payload

Standard IPv4 ACLs (numbered 1-99 and 1300-1999) filter based only on the source IP address. Extended ACLs are required to match source and destination addresses, protocols, and port numbers. Because standard ACLs are less granular, they are typically placed close to the destination to avoid blocking too much traffic.

DHCP snooping classifies switch ports as trusted or untrusted. What happens to a DHCP server reply (DHCPOFFER) received on an untrusted port?

• a.It is forwarded normally
• b.It is tagged and logged only
• c.It is dropped✓
• d.It is rate-limited but allowed

DHCP snooping treats ports facing hosts as untrusted and drops server-sourced messages like DHCPOFFER and DHCPACK arriving on them, preventing rogue DHCP servers. Only trusted ports, typically uplinks toward legitimate DHCP servers, may forward these replies. The feature also builds a binding table that Dynamic ARP Inspection uses.

A switch port is configured with port security in the default violation mode. When an unauthorized MAC address exceeds the maximum, what is the result?

• a.The port is err-disabled and shut down (shutdown mode)✓
• b.The port drops only the offending frames but stays up
• c.The port allows the traffic but sends a Syslog
• d.The port reboots the switch

The default port-security violation mode is shutdown, which places the port in the err-disabled state and requires administrative recovery (or errdisable recovery) when a violation occurs. The 'protect' mode silently drops unknown traffic, while 'restrict' drops it and increments counters plus sends notifications. This limits which MAC addresses can use a port.

Which wireless security standard introduces Simultaneous Authentication of Equals (SAE) to replace the pre-shared key handshake and protect against offline dictionary attacks?

• a.WEP
• b.WPA
• c.WPA2
• d.WPA3✓

WPA3 replaces the WPA2 four-way handshake with SAE (Simultaneous Authentication of Equals), a dragonfly key exchange that resists offline dictionary attacks even with weak passwords. It also adds forward secrecy. WEP and WPA are legacy and cryptographically broken, while WPA2 relies on AES-CCMP but remains vulnerable to some offline attacks.

In a controller-based (SDN) network architecture, which plane does the centralized controller primarily assume from the individual network devices?

• a.Data (forwarding) plane
• b.Control plane✓
• c.Management plane only
• d.Physical layer

SDN separates the control plane from the data plane, centralizing control-plane decisions such as routing and topology in a controller. The controller programs the devices, which continue to forward traffic in their data plane. A southbound interface (for example, OpenFlow or NETCONF) carries instructions from the controller down to the devices.

A configuration management tool applies a desired state to network devices without requiring an agent installed on each device, connecting over SSH and using YAML playbooks. Which tool is described?

• a.Ansible✓
• b.Puppet
• c.Chef
• d.SNMP

Ansible is agentless, pushing configuration over SSH and defining desired state in human-readable YAML playbooks, which makes it popular for network automation. Puppet and Chef traditionally use an agent-based, pull model with their own domain-specific languages. All three enforce consistent, repeatable configuration across many devices.