Cisco CCNA (200-301) — All Questions

In a multi-area OSPF design, which area must all other areas connect to (directly or via a virtual link)?

• a.Any area of the lowest number
• b.A stub area
• c.Area 0 (the backbone)✓
• d.Area 1

OSPF requires a backbone, Area 0, to which all other areas must attach so inter-area routing information passes through it. This hub-and-spoke area design prevents routing loops between areas. If an area cannot physically touch Area 0, a virtual link can bridge it through a transit area.

On a broadcast multiaccess OSPF segment, what does OSPF elect to reduce the number of adjacencies?

• a.A Designated Router (DR) and Backup Designated Router (BDR)✓
• b.A VTP server
• c.A root bridge
• d.A gateway of last resort

On broadcast and non-broadcast multiaccess networks, OSPF elects a DR and BDR so routers form full adjacencies only with them instead of every neighbor, cutting down LSA flooding overhead. Election favors the highest OSPF interface priority, then the highest router ID. Point-to-point links need no DR/BDR.

Using OSPF's default reference bandwidth of 100 Mbps, what is the cost of a 10 Mbps Ethernet link?

• a.1
• b.10✓
• c.0
• d.100

OSPF cost equals the reference bandwidth divided by the interface bandwidth: 100 Mbps / 10 Mbps = 10. A 100 Mbps link would compute to a cost of 1. Because all links at or above 100 Mbps default to cost 1, engineers often raise the reference bandwidth so gigabit and faster links are differentiated.

In the output of 'show ip route', which code identifies a route learned via OSPF?

• a.C
• b.D
• c.S
• d.O✓

In the routing table legend, 'O' marks OSPF-learned routes, 'S' marks static routes, 'C' marks directly connected networks, and 'D' marks EIGRP routes. Recognizing these codes lets you quickly determine how each destination was learned when verifying connectivity or troubleshooting path selection.

What is the role of the default gateway configured on an end host?

• a.It is the router address the host uses to reach destinations on other subnets✓
• b.It stores the host's ARP cache
• c.It assigns the host its IP address
• d.It resolves DNS names to IP addresses

The default gateway is the IP address of a local router interface that a host sends packets to whenever the destination is on a different subnet. The host compares the destination against its own subnet; if it is remote, the frame is addressed to the gateway's MAC. Without a valid gateway, off-subnet communication fails.

A packet is destined for 10.0.0.66. The routing table has 10.0.0.0/8, 10.0.0.0/24, and 10.0.0.64/29. Which route forwards the packet?

• a.10.0.0.64/29✓
• b.0.0.0.0/0
• c.10.0.0.0/8
• d.10.0.0.0/24

The router uses longest prefix match, choosing the most specific route that contains the destination. 10.0.0.64/29 covers addresses .64 through .71, which includes .66, and its /29 is longer (more specific) than the /24 or /8. The most specific match always wins regardless of how each route was learned.

Which OSPF neighbor state indicates that two routers have fully synchronized their link-state databases?

• a.2-WAY
• b.FULL✓
• c.EXSTART
• d.INIT

The FULL state means the neighbors have exchanged and synchronized their complete link-state databases and can route through each other. INIT and 2-WAY are early stages of neighbor discovery, and EXSTART/EXCHANGE occur while databases are being compared. On multiaccess links, non-DR routers stay 2-WAY with each other, which is normal.

On which OSPF network type is no DR/BDR election performed?

• a.Broadcast
• b.Multiaccess Ethernet
• c.Point-to-point✓
• d.Non-broadcast (NBMA)

Point-to-point network types (such as serial links or point-to-point subinterfaces) have only two routers, so a DR/BDR would add no value and none is elected. Broadcast and NBMA multiaccess types do elect a DR/BDR to control flooding. Matching network types and timers on both ends is required for adjacency.

Before forwarding an IPv4 packet onto an Ethernet segment, what does a router use ARP to determine?

• a.The administrative distance of the route
• b.The DNS name of the destination
• c.The subnet mask of the destination
• d.The MAC address of the next hop✓

To build the Layer 2 frame, the router must know the MAC address that corresponds to the next-hop IP address, and ARP provides that IP-to-MAC resolution. The result is cached in the ARP table to avoid repeated lookups. In IPv6, Neighbor Discovery replaces ARP for this function.

Which link-state routing protocol is used to route IPv6 networks?

• a.RIPv2
• b.EIGRP for IPv4
• c.OSPFv3✓
• d.OSPFv2

OSPFv3 is the link-state protocol that supports IPv6, mirroring OSPFv2 concepts like areas, LSAs, and SPF while running over IPv6 and using link-local addresses for adjacencies. OSPFv2 and RIPv2 are IPv4-only, and EIGRP has a separate IPv6 address family. IPv6 also supports static routing for simple designs.

Under what condition will OSPF install multiple routes to the same destination and load-balance across them?

• a.When the routes have equal cost (metric)✓
• b.When the routes have different administrative distances
• c.OSPF never load-balances
• d.When one of the routes is static

OSPF performs equal-cost multipath (ECMP) load balancing, installing up to a configurable maximum of routes only when they share the same lowest cost to the destination. Traffic is then distributed across those equal paths. If costs differ, only the lowest-cost path is installed; OSPF does not do unequal-cost balancing like EIGRP.

A packet's destination matches only the 0.0.0.0/0 entry in the routing table. How is it handled?

• a.It is forwarded using the gateway of last resort✓
• b.It is buffered until a more specific route appears
• c.It is broadcast on all interfaces
• d.It is dropped as unroutable

The 0.0.0.0/0 route is the default route, also called the gateway of last resort, used when no more specific prefix matches the destination. The router forwards the packet toward the configured default next hop, typically an upstream/Internet router. Without a default route, an unmatched packet would be dropped.

What is the correct order of messages in the DHCP address-assignment process?

• a.Offer, Discover, Acknowledge, Request
• b.Discover, Offer, Request, Acknowledge✓
• c.Discover, Request, Offer, Acknowledge
• d.Request, Offer, Discover, Acknowledge

DHCP follows the DORA sequence: the client broadcasts a Discover, servers respond with an Offer, the client broadcasts a Request for one offer, and the server replies with an Acknowledgment finalizing the lease. Understanding DORA helps troubleshoot issues such as a missing relay when the server is on another subnet.

What does the interface command 'ip helper-address' accomplish?

• a.It assigns a static IP to the interface
• b.It forwards DHCP and select UDP broadcasts to a server on another subnet✓
• c.It enables Port Address Translation
• d.It blocks all broadcast traffic

Because routers do not forward broadcasts, 'ip helper-address' converts a client's broadcast DHCP Discover into a unicast (or directed) packet aimed at a DHCP server on a different subnet, acting as a DHCP relay. It also relays a handful of other UDP services by default. This lets one central DHCP server serve many subnets.

Which NAT type creates a permanent one-to-one mapping between a single inside local address and a single inside global address?

• a.Port forwarding pool
• b.Dynamic NAT
• c.Static NAT✓
• d.PAT (overload)

Static NAT fixes a one-to-one mapping so a specific internal host always translates to the same public address, which is useful for servers that must be reachable from outside. Dynamic NAT draws from a pool without fixed mappings, and PAT overloads many hosts onto one address using port numbers. Static NAT provides predictable inbound access.

On the Syslog severity scale, which level represents the most severe condition?

• a.7 (debugging)
• b.3 (error)
• c.0 (emergency)✓
• d.5 (notification)

Syslog severities run from 0 (emergency, system unusable) up to 7 (debugging, most verbose), so 0 is the most severe. Lower numbers indicate more critical events. Setting a logging level of, say, 4 captures messages of that severity and all more-severe levels below it, letting operators filter noise.

In SNMP, what is a trap?

• a.An access control list entry
• b.A polling request sent by the manager to a device
• c.An unsolicited notification sent by the agent to the manager when an event occurs✓
• d.A configuration backup file

An SNMP trap is an asynchronous, agent-initiated message that alerts the management station of an event (like an interface going down) without waiting to be polled. This is more efficient than the manager continuously polling for changes. Traps typically use UDP port 162, while polling/get requests use UDP 161.

Which QoS marking is typically applied to real-time voice traffic so it receives priority (low-latency) queuing?

• a.AF11 (DSCP 10)
• b.Expedited Forwarding (EF / DSCP 46)✓
• c.Best effort (DSCP 0)
• d.CS1 (DSCP 8)

Voice is commonly marked Expedited Forwarding (EF, DSCP 46) so it is placed in a low-latency priority queue during congestion, minimizing delay and jitter. CS1 and AF11 are lower-priority classes, and DSCP 0 is best effort with no guarantees. Consistent marking and trust boundaries make end-to-end QoS effective.

To conserve bandwidth and drop unwanted traffic early, where should an extended ACL generally be placed?

• a.As close to the destination as possible
• b.Only on the Internet-facing WAN link
• c.Only on a loopback interface
• d.As close to the source of the traffic as possible✓

Extended ACLs match on source, destination, protocol, and port, so they can be placed near the source to discard unwanted traffic before it crosses the network, saving bandwidth. Standard ACLs, which match only source, are placed near the destination to avoid unintentionally blocking legitimate traffic. Placement is a common exam distinction.

In an ACL wildcard mask, what does a bit value of 0 indicate?

• a.It reverses the subnet mask automatically
• b.Deny any packet with this bit set
• c.The corresponding address bit must match exactly✓
• d.Ignore this bit; it can be anything

A wildcard mask is the inverse of a subnet mask: a 0 bit means the corresponding address bit must match exactly, while a 1 bit means ignore it. For example, 0.0.0.255 matches a full /24, checking the first three octets and ignoring the last. This lets ACLs match ranges of addresses precisely.

What behavior is applied to traffic that does not match any explicit statement in an ACL?

• a.An implicit permit any allows it
• b.An implicit deny any drops it✓
• c.It is logged then permitted
• d.It is queued for review

Every ACL ends with an invisible implicit deny any, so any packet not explicitly permitted is dropped. This means an ACL with only deny statements and no permit will block everything. Administrators must include at least one permit statement for the traffic they want to allow through.

Which statement correctly contrasts TACACS+ with RADIUS?

• a.RADIUS encrypts the entire packet payload
• b.TACACS+ uses UDP for transport
• c.RADIUS separates authentication, authorization, and accounting into distinct functions
• d.TACACS+ separates authentication, authorization, and accounting and uses TCP✓

TACACS+ is Cisco-developed, uses TCP port 49, encrypts the entire payload, and separates the three AAA functions, making it well suited to granular device administration (command authorization). RADIUS uses UDP, encrypts only the password, and combines authentication and authorization, and is common for network access (802.1X). Both centralize AAA.

Why is SSH preferred over Telnet for remote device management?

• a.Telnet consumes more bandwidth than SSH
• b.SSH encrypts the session, while Telnet sends credentials and data in clear text✓
• c.SSH transfers data faster than Telnet
• d.SSH requires no authentication

SSH encrypts the entire management session, protecting usernames, passwords, and commands from eavesdropping, whereas Telnet transmits everything in clear text and is trivially captured. Best practice is to disable Telnet, generate RSA keys, and allow only SSH (version 2) on the VTY lines. Both provide CLI access, but only SSH is secure.

Dynamic ARP Inspection (DAI) validates ARP packets against which data source?

• a.The router's routing table
• b.The switch MAC address table only
• c.The DHCP snooping binding table✓
• d.The spanning-tree topology

DAI checks each ARP packet on untrusted ports against the DHCP snooping binding table, which maps legitimate IP-to-MAC-to-port bindings. ARP replies that do not match a valid binding are dropped, defeating ARP spoofing/man-in-the-middle attacks. Because DAI depends on that table, DHCP snooping must be enabled first.

Which encryption method is used by WPA2 to secure wireless traffic?

• a.AES with CCMP✓
• b.RC4 with TKIP only
• c.DES
• d.WEP static keys

WPA2 mandates AES encryption with CCMP, providing strong confidentiality and integrity that replaced the weaker RC4/TKIP used by the original WPA. WEP is obsolete and broken. WPA3 further improves security with SAE for the handshake, but WPA2-AES remains widely deployed and is a solid baseline for enterprise and home use.

What is the key difference between the 'enable secret' and 'enable password' commands?

• a.enable password is encrypted with AES
• b.enable secret is stored as a strong hash, while enable password can be clear text or weakly encoded✓
• c.They are functionally identical
• d.enable secret is stored in clear text

The 'enable secret' stores the privileged-mode password as a strong one-way hash (MD5 or better on modern IOS), whereas 'enable password' is either clear text or protected only by the weak, reversible Type 7 encoding. When both are set, the enable secret takes precedence. Best practice is to use enable secret and avoid enable password.

Which REST API method is used to retrieve data from a resource without modifying it?

• a.PUT
• b.GET✓
• c.DELETE
• d.POST

GET requests read/retrieve a resource and are considered safe and idempotent because they do not change server state. POST creates new resources, PUT updates/replaces a resource, and DELETE removes one. Knowing the CRUD-to-HTTP mapping (Create=POST, Read=GET, Update=PUT/PATCH, Delete=DELETE) is fundamental to using network controller APIs.

Which description best fits JSON as used in network automation?

• a.A programming language for writing scripts
• b.A physical cabling standard
• c.A text-based data format using key-value pairs, arrays, and nested objects✓
• d.A dynamic routing protocol

JSON (JavaScript Object Notation) is a lightweight, human-readable data-interchange format built from key-value pairs, arrays, and nested objects. REST APIs commonly exchange JSON payloads, so being able to read its curly-brace and bracket structure is essential for parsing controller responses. YAML and XML are alternative data formats.

In an SDN architecture, what does the controller's southbound interface communicate with?

• a.External DNS servers
• b.End users browsing the web
• c.The network devices the controller programs✓
• d.Business applications requesting services

The southbound interface (using protocols like OpenFlow, NETCONF, or vendor APIs) connects the controller down to the network devices it manages, pushing forwarding and policy instructions. The northbound interface, by contrast, faces up toward applications and orchestration tools that request network behavior. This separation abstracts the underlying hardware.

Compared with traditional per-device management, what is a key benefit of controller-based networking?

• a.It eliminates the need for any security
• b.Each device must still be configured individually by hand
• c.It removes the need for IP addressing
• d.Centralized, consistent policy can be pushed to many devices, reducing manual error✓

Controller-based networking centralizes intelligence so administrators define policy once and the controller programs it across many devices, improving consistency and speed while cutting the human errors common in box-by-box CLI configuration. Devices still forward traffic, but their control decisions are coordinated centrally, enabling automation and rapid change.

What is the primary responsibility of the data (forwarding) plane on a network device?

• a.Running the SPF algorithm
• b.Actually forwarding packets based on the control plane's decisions✓
• c.Deciding the overall network topology
• d.Managing user accounts and logins

The data plane (forwarding plane) moves packets through the device as fast as possible, consulting forwarding tables built by the control plane. The control plane makes the decisions (routing protocols, topology), and the management plane handles administration and monitoring. SDN centralizes the control plane while leaving forwarding on the devices.

In which human-readable language are Ansible playbooks written to define desired configuration state?

• a.YAML✓
• b.Compiled binary
• c.HTML
• d.C++

Ansible playbooks are written in YAML, a readable, indentation-based format that describes the desired end state of devices. Ansible is agentless and connects over SSH, applying tasks idempotently so re-running a playbook does not cause unintended changes. YAML's simplicity is a major reason Ansible is popular for network automation.

How many usable host addresses does a subnet with a /28 prefix provide?

• a.16
• b.30
• c.A /28 provides all 256 addresses on the segment for hosts
• d.14✓

A /28 leaves 4 host bits, so 2^4 = 16 total addresses. Subtracting the network and broadcast addresses leaves 14 usable host addresses. This block-of-16 size is common for small point-to-multipoint segments.

Which dotted-decimal subnet mask corresponds to a /28 prefix length?

• a.255.255.255.240✓
• b.255.255.255.224
• c.255.255.255.192
• d.255.255.255.248

A /28 sets 28 network bits, leaving 4 host bits, which gives 255.255.255.240 (the last octet 11110000 = 240). Each step in the fourth octet mask (240) creates blocks of 16 addresses. Converting between prefix length and dotted decimal is an essential subnetting skill.

A subnet must support at least 500 hosts. Which subnet mask is the most efficient choice?

• a.255.255.252.0
• b.255.255.254.0✓
• c.255.255.255.192
• d.255.255.255.0

To fit 500 hosts you need 9 host bits because 2^9 - 2 = 510 usable, and 2^8 - 2 = 254 is too few. Nine host bits means a /23, which is 255.255.254.0. A /22 (255.255.252.0) would also fit but wastes addresses, so /23 is the most efficient.

What is the network (subnet) address for the host 192.168.10.75/28?

• a.192.168.10.64✓
• b.192.168.10.80
• c.192.168.10.48
• d.192.168.10.0

A /28 has a block size of 16, so subnets increment .0, .16, .32, .48, .64, .80. The host .75 falls in the .64 subnet (range .64 to .79), making the network address 192.168.10.64. Zeroing the host bits identifies the subnet.

What is the broadcast address of the subnet containing 10.10.10.10/29?

• a.10.10.10.16
• b.10.10.10.15✓
• c.10.10.10.7
• d.10.10.10.8

A /29 (255.255.255.248) creates blocks of 8. The subnets are .0, .8, .16, so .10 falls in the .8 subnet (range .8 to .15). The broadcast is the last address of that block, 10.10.10.15, where all host bits are 1.

What is the valid host address range for the subnet 172.16.8.0/22?

• a.172.16.8.1 to 172.16.11.254✓
• b.172.16.8.1 to 172.16.9.254
• c.172.16.8.1 to 172.16.8.254
• d.172.16.8.1 to 172.16.15.254

A /22 mask (255.255.252.0) makes the third octet increment in blocks of 4, so this subnet spans 172.16.8.0 through 172.16.11.255. The network is 172.16.8.0 and the broadcast is 172.16.11.255, leaving usable hosts 172.16.8.1 to 172.16.11.254.

How many /26 subnets can be created from a single /24 network?

• a.16
• b.8
• c.2
• d.4✓

Going from /24 to /26 borrows 2 bits (26 - 24 = 2), and 2^2 = 4 subnets. Each /26 provides 62 usable hosts. This is a common way to divide one /24 among four departments.

How many usable host addresses are available on a /25 subnet?

• a.254 usable hosts
• b.126 usable hosts✓
• c.128 usable hosts
• d.62 usable hosts

A /25 mask (255.255.255.128) leaves 7 host bits, so 2^7 = 128 total addresses minus 2 for the network and broadcast equals 126 usable hosts. A /25 splits a /24 into two equal halves.

Which of the following is a valid IPv4 subnet mask?

• a.255.255.255.100
• b.255.255.255.5
• c.255.255.255.224✓
• d.255.255.240.255

A valid subnet mask must be a contiguous string of 1 bits followed by 0 bits, so 255.255.255.224 (/27) is valid. Values like 100, 5, or a 0 octet sandwiched before a 255 break the contiguous rule and are invalid masks.

The subnet mask 255.255.240.0 is equivalent to which CIDR prefix length?

• a./21
• b./20✓
• c./19
• d./22

255.255.240.0 has two full octets of 1s (16 bits) plus 240 in the third octet (11110000 = 4 bits), totaling 20 network bits, which is /20. Each 0 bit is a host bit, here 12 of them.

A /24 network must be divided into at least 6 subnets. What is the minimum number of bits to borrow?

• a.3 bits (/27)✓
• b.2 bits (/26)
• c.4 bits (/28)
• d.6 bits, extending each subnet mask all the way to /30

Each borrowed bit doubles the subnet count: 2 bits give 4 subnets (too few) and 3 bits give 2^3 = 8 subnets (enough for 6). Borrowing 3 bits changes /24 to /27, leaving 5 host bits (30 usable hosts each).

Are the hosts 192.168.1.62/26 and 192.168.1.65/26 in the same subnet?

• a.Yes, both are in 192.168.1.0/26
• b.Yes, all 192.168.1.x hosts share one subnet
• c.No, they are in different /26 subnets✓
• d.No, but only because their gateways differ

A /26 has a block size of 64, so the subnets are .0-.63 and .64-.127. Address .62 falls in the first subnet and .65 in the second, so they are in different subnets and cannot communicate without a router.

What is the network address for 10.5.5.130/25?

• a.10.5.5.130
• b.10.5.5.192
• c.10.5.5.128✓
• d.10.5.5.0

A /25 has a block size of 128, giving subnets .0-.127 and .128-.255. Address .130 falls in the second block, so the network address is 10.5.5.128 (host bits zeroed).

On a point-to-point link using a /31 prefix (RFC 3021), how many usable host addresses are available?

• a.0
• b.It cannot be used on point-to-point links at all
• c.1
• d.2✓

RFC 3021 allows /31 on point-to-point links, where both addresses are usable because no network or broadcast address is reserved. This yields exactly 2 usable addresses, one for each endpoint, conserving address space compared with a /30.

What is the default (classful) subnet mask for a Class B IPv4 address?

• a.255.255.255.255
• b.255.0.0.0
• c.255.255.0.0✓
• d.255.255.255.0

Class B addresses (first octet 128-191) use a default mask of 255.255.0.0 (/16), giving 16 host bits. Class A defaults to 255.0.0.0 and Class C to 255.255.255.0. Modern networks subnet these classful defaults with CIDR.

Which of the following is a valid /27 network (subnet) address?

• a.192.168.4.100
• b.192.168.4.96✓
• c.192.168.4.16
• d.192.168.4.80

A /27 has a block size of 32, so valid subnet addresses are multiples of 32: .0, .32, .64, .96, .128. Only 192.168.4.96 is a multiple of 32; .100, .80, and .16 fall inside subnets rather than on a boundary.

Which OSI layer is responsible for data formatting, encryption, and translation between formats?

• a.Session (Layer 5)
• b.Presentation (Layer 6)✓
• c.Application (Layer 7)
• d.Transport (Layer 4)

The Presentation layer (Layer 6) handles data representation, including encryption, compression, and format translation such as ASCII or character encoding. The Session layer manages dialogs, and the Application layer provides network services to programs.

Which OSI layer provides network services directly to end-user applications?

• a.Presentation (Layer 6)
• b.Session (Layer 5)
• c.Application (Layer 7)✓
• d.Network (Layer 3)

The Application layer (Layer 7) is the top layer and interfaces directly with user applications through protocols like HTTP, FTP, and DNS. It is where the user-facing service request originates before data moves down the stack for delivery.