Cisco CCNA (200-301) — All Questions

What does the first half (the OUI) of a MAC address identify?

• a.The manufacturer (vendor) of the network interface✓
• b.The default gateway for the host
• c.The IP subnet the device currently belongs to
• d.The VLAN the port is assigned to

The first 24 bits of a MAC address form the Organizationally Unique Identifier (OUI), which the IEEE assigns to a specific hardware vendor. The remaining 24 bits are the device-specific serial portion. Together they make each burned-in address globally unique.

How does the EUI-64 process build an IPv6 interface ID from a 48-bit MAC address?

• a.It requests the interface ID from a DHCPv6 server
• b.It inserts FFFE into the middle of the MAC and flips the 7th bit✓
• c.It randomizes the entire 64-bit identifier for privacy
• d.It appends the host's IPv4 address to the MAC

EUI-64 splits the 48-bit MAC, inserts FFFE in the middle to reach 64 bits, and inverts the 7th bit (the universal/local bit) of the first byte. The result becomes the interface identifier appended to the /64 prefix.

What is the IPv6 loopback address?

• a.FE80::1
• b.127.0.0.1
• c.::
• d.::1✓

The IPv6 loopback address is ::1, the equivalent of IPv4's 127.0.0.1, used by a host to test its own TCP/IP stack. The all-zeros address :: is the unspecified address, and FE80::/10 is link-local.

Which IPv6 address is the unspecified address, often used as a source before an address is assigned?

• a.::1
• b.FF02::1
• c.0.0.0.0
• d.::✓

The unspecified IPv6 address is :: (all zeros), used as a source address during processes like duplicate address detection before a real address is configured. ::1 is loopback and FF02::1 is the all-nodes multicast address.

Which IPv6 multicast address reaches all IPv6 nodes on the local link?

• a.FF02::2
• b.FF02::1✓
• c.FF05::1
• d.FF02::5

FF02::1 is the all-nodes link-local multicast address, reaching every IPv6 host on the segment (similar to a broadcast). FF02::2 targets all routers on the link. The FF02:: prefix denotes link-local multicast scope.

Which IPv6 multicast address is used to reach all routers on the local link?

• a.FF02::9
• b.FF02::1
• c.FF02::2✓
• d.FF02::1:2

FF02::2 is the all-routers link-local multicast address, used by hosts to reach every router on the segment, such as when sending Router Solicitation messages. FF02::1 reaches all nodes, not just routers.

In IPv6, which Neighbor Discovery messages replace IPv4 ARP for resolving a neighbor's link-layer address?

• a.ARP request and ARP reply broadcast frames
• b.ICMPv6 Echo request and Echo reply diagnostic messages
• c.Neighbor Solicitation and Neighbor Advertisement✓
• d.DHCP Discover and DHCP Offer messages

IPv6 uses ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages (part of NDP) to map an IPv6 address to a MAC address, replacing IPv4's ARP. NDP also handles router discovery and duplicate address detection on the link.

How many usable host addresses does a /24 subnet provide?

• a.254✓
• b.256
• c.253
• d.255

A /24 has 8 host bits, giving 2^8 = 256 total addresses. Removing the network address and the broadcast address leaves 254 usable host addresses, the familiar count for a standard Class C-sized LAN.

Which cable type connects a PC's serial/USB port to a Cisco router or switch console port for CLI management?

• a.A shielded straight-through cable wired T568B on both ends
• b.Crossover
• c.Rollover (console) cable✓
• d.Coaxial

A rollover (console) cable connects a management PC to the device's console port for initial CLI access, with the pinout reversed end to end. Crossover and straight-through cables carry Ethernet data, not console signaling.

A straight-through Ethernet cable is traditionally used to connect which of the following?

• a.A router console port to a laptop for management access
• b.Switch to switch
• c.PC to switch (unlike devices)✓
• d.Router to router

Straight-through cables connect unlike devices, such as a PC to a switch or a switch to a router, because their transmit and receive pairs already align. Like devices (switch to switch) traditionally need a crossover cable, though Auto-MDIX now adjusts automatically.

What is a key advantage of fiber-optic cabling over copper?

• a.Immunity to electromagnetic interference✓
• b.It can also deliver electrical power to remote devices
• c.Lower material cost than copper
• d.Easier field splicing and termination

Fiber transmits light rather than electrical signals, so it is immune to electromagnetic and radio interference and supports much longer distances and higher bandwidth. Copper is cheaper and easier to terminate, but is susceptible to EMI and crosstalk.

Which statement correctly describes single-mode fiber?

• a.It carries many light paths using inexpensive LED sources
• b.It is used only for very short indoor patch cables
• c.It transmits electrical signals over copper conductors
• d.It supports longer distances using a laser light source✓

Single-mode fiber uses a very thin core and a laser source to send one light path over long distances (kilometers), ideal for backbone and WAN links. Multimode fiber uses a wider core with LED sources for shorter runs and is typically cheaper.

What is the maximum standard cable length for 1000BASE-T over Cat5e/Cat6 copper?

• a.250 meters
• b.100 meters✓
• c.55 meters
• d.100 meters, but only when run over fiber-optic cabling

1000BASE-T (Gigabit Ethernet over twisted pair) is specified for up to 100 meters on Cat5e or better copper. Beyond that distance, signal degradation requires fiber or a repeater. The 100-meter limit applies to most copper Ethernet standards.

What does the Auto-MDIX feature on a switch port do?

• a.It automatically forces the port to 10 Gbps
• b.It encrypts all Ethernet frames and authenticates connected devices
• c.It auto-detects and adjusts for straight-through vs crossover wiring✓
• d.It supplies inline power to attached endpoints

Auto-MDIX automatically senses whether a straight-through or crossover cable is connected and adjusts the port's transmit and receive pairs accordingly. This removes the need to match cable types manually and is why modern switch-to-switch links work with either cable.

What does full-duplex operation on an Ethernet link allow?

• a.Sending and receiving simultaneously with no collisions✓
• b.Only receiving data, never transmitting
• c.Sending and receiving alternately, one direction at a time using CSMA/CD
• d.Sharing bandwidth among many hosts on a hub

Full-duplex lets a device transmit and receive at the same time over dedicated pairs, eliminating collisions and disabling CSMA/CD. Half-duplex, used on hubs or legacy links, allows only one direction at a time and must detect collisions.

In which environment is CSMA/CD (carrier sense multiple access with collision detection) used?

• a.Wireless 802.11 networks
• b.Half-duplex Ethernet segments✓
• c.IPv6 routing between subnets
• d.Full-duplex switched fiber links with dedicated bandwidth

CSMA/CD manages access on shared, half-duplex Ethernet where collisions can occur, having stations listen before sending and back off after a collision. Full-duplex switched links have no collisions, and wireless uses CSMA/CA (collision avoidance) instead.

Which device operates purely at Layer 1 (the Physical layer)?

• a.A multilayer switch performing inter-VLAN routing
• b.Router
• c.Hub or repeater✓
• d.Switch

A hub or repeater works at Layer 1, simply regenerating and flooding electrical signals out all ports without reading addresses. Switches operate at Layer 2 using MAC addresses, and routers at Layer 3 using IP addresses.

What is the Layer 2 broadcast MAC address?

• a.0180.C200.0000
• b.The lowest MAC currently in the switch address table
• c.0000.0000.0000
• d.FFFF.FFFF.FFFF✓

FFFF.FFFF.FFFF is the broadcast MAC address; a frame sent to it is delivered to every host in the VLAN. Switches flood broadcast frames out all ports except the ingress port, since the destination is every node.

How does a switch populate its MAC address table?

• a.By requesting the table from a DHCP server
• b.By recording the source MAC of each incoming frame with its ingress port✓
• c.By flooding ARP requests to every VLAN on the switch
• d.By reading the destination MAC of frames it forwards upstream

A switch learns by examining the source MAC address of every incoming frame and associating it with the port it arrived on. It stores this in the CAM/MAC table so future frames to that address are forwarded only out the correct port.

What is the default MTU (maximum transmission unit) size for a standard Ethernet frame payload?

• a.576 bytes
• b.1000 bytes
• c.1500 bytes✓
• d.9000 bytes

Standard Ethernet uses a 1500-byte MTU for the IP payload. Frames larger than this (jumbo frames, up to about 9000 bytes) must be explicitly enabled end to end. An MTU mismatch can cause fragmentation or dropped packets.

What is the purpose of the TTL (Time To Live) field in an IPv4 header?

• a.It sets the QoS priority of the packet in the queue
• b.It is decremented at each router hop and the packet is dropped at zero✓
• c.It stores the destination MAC address for delivery
• d.It encrypts the packet payload end to end between the two hosts

Each router decrements the TTL by one, and when it reaches zero the packet is discarded and an ICMP time-exceeded message may be returned. This prevents packets from looping endlessly through a network and is what traceroute exploits.

An IPv4 address whose first octet is in the range 128-191 belongs to which class?

• a.Class C
• b.Class D (multicast)
• c.Class B✓
• d.Class A

First-octet ranges define legacy classes: Class A is 1-126, Class B is 128-191, Class C is 192-223, and Class D (multicast) is 224-239. So a first octet of 128-191 is Class B, with a default /16 mask.

Which address block is reserved for IPv4 loopback?

• a.127.0.0.0/8✓
• b.192.0.2.0/24
• c.10.0.0.0/8
• d.169.254.0.0/16

The 127.0.0.0/8 block is reserved for loopback, with 127.0.0.1 most commonly used to test the local TCP/IP stack. 169.254.0.0/16 is APIPA/link-local, and 10.0.0.0/8 is RFC 1918 private space.

Which address range does a host self-assign (APIPA) when no DHCP server responds?

• a.169.254.0.0/16✓
• b.127.0.0.0/8
• c.172.16.0.0/12
• d.192.168.0.0/16

When DHCP fails, a host automatically configures an APIPA (link-local) address from 169.254.0.0/16. This allows limited same-subnet communication but not Internet access, and seeing a 169.254 address is a strong sign of a DHCP problem.

How is the broadcast address of an IPv4 subnet identified?

• a.Any address in the multicast range 224.0.0.0/4
• b.The first usable address in the subnet, reserved for the router interface
• c.The last address in the subnet, with all host bits set to 1✓
• d.The address that is currently assigned to the DHCP server

The broadcast address is the final address of a subnet, formed by setting every host bit to 1, and a frame sent to it reaches all hosts on that subnet. The network address (all host bits 0) is the first address in the block.

Which statement about the relationship between prefix length and subnet size is correct?

• a.A longer prefix always yields more hosts per subnet
• b.A longer prefix yields more subnets but fewer hosts per subnet✓
• c.Every subnet supports 254 hosts regardless of the mask applied
• d.Prefix length has no effect on the number of hosts

Lengthening the prefix (for example /24 to /27) borrows host bits to create more, smaller subnets, so each subnet supports fewer hosts. There is always a trade-off: more subnets means fewer hosts each, since the 32 bits are fixed.

A host is assigned 192.168.20.200 with a /26 mask. What is the network address of its subnet?

• a.192.168.20.128
• b.192.168.20.200
• c.192.168.20.192✓
• d.192.168.20.224

A /26 mask (255.255.255.192) makes the fourth octet increment in blocks of 64, so the subnets are .0, .64, .128, and .192. The host .200 falls inside the .192-.255 block, so zeroing the host bits gives the network address 192.168.20.192.

How many usable host addresses does a subnet with a /23 prefix provide?

• a.510✓
• b.254, which is the same as a standard /24 network
• c.512, because two addresses per subnet are always reserved for routers
• d.508, after subtracting the network, broadcast, and gateway addresses

A /23 leaves 9 host bits (32 - 23 = 9), giving 2^9 = 512 total addresses. Subtracting the network and broadcast addresses leaves 512 - 2 = 510 usable hosts, roughly double the capacity of a single /24.

Which dotted-decimal subnet mask corresponds to a /22 prefix length?

• a.255.255.248.0
• b.255.255.254.0
• c.255.255.252.0✓
• d.255.255.255.0

A /22 sets the first 22 bits to one. The third octet becomes 11111100, which is 252, so the mask is 255.255.252.0. This yields a block size of 4 in the third octet and 1024 total addresses.

What is the broadcast address of the subnet that contains the host 172.18.33.66/27?

• a.172.18.33.127, the broadcast of a different /27 block
• b.172.18.33.64, which is actually the subnet's network address
• c.172.18.33.96, which begins the following subnet block
• d.172.18.33.95✓

A /27 mask (255.255.255.224) creates a block size of 32, so the subnets are .0, .32, .64, .96. The host .66 sits in the .64-.95 block, and the broadcast is the last address in that block, 172.18.33.95.

What is the valid host address range for the subnet 192.168.100.32/28?

• a.192.168.100.32 through 192.168.100.47, including the endpoints
• b.192.168.100.33 through 192.168.100.47, up to the broadcast
• c.192.168.100.34 through 192.168.100.46, skipping the first host
• d.192.168.100.33 through 192.168.100.46✓

A /28 has a block size of 16, so this subnet spans .32 to .47. The network address (.32) and broadcast (.47) are unusable, leaving the host range .33 through .46, which is 14 usable addresses.

How many /27 subnets can be created from a single /24 network?

• a.16, matching the /28 subnet count
• b.8✓
• c.32, the number of host addresses per /27
• d.4, one for each block of 64 addresses

Going from /24 to /27 borrows 3 host bits (27 - 24 = 3), and each borrowed bit doubles the subnet count, so 2^3 = 8 subnets result. Each /27 subnet then provides 30 usable host addresses.

Which CIDR prefix length is equivalent to the subnet mask 255.255.255.240?

• a./28✓
• b./29, which corresponds to 255.255.255.248
• c./27, which corresponds to 255.255.255.224
• d./26, which corresponds to 255.255.255.192

The last octet 240 in binary is 11110000, which sets 4 additional bits. Added to the 24 network bits, that totals 28 bits, so the prefix is /28 with a block size of 16.

A LAN segment must support at least 100 hosts. Which subnet mask is the most efficient choice?

• a.255.255.255.192, which supplies only 62 usable hosts
• b.255.255.255.224, which supplies only 30 usable hosts
• c.255.255.255.128✓
• d.255.255.255.0, which wastes many addresses on a small segment

Supporting 100 hosts requires 7 host bits (2^7 - 2 = 126 usable), which is a /25 or 255.255.255.128. A /26 (255.255.255.192) offers only 62 usable addresses, too few, so the /25 is the smallest mask that fits.

Which address is a valid, assignable host address within the subnet 192.168.5.16/28?

• a.192.168.5.25✓
• b.192.168.5.16
• c.192.168.5.32, which belongs to the next subnet
• d.192.168.5.31

The /28 subnet .16 spans .16 to .31, with usable hosts .17 through .30. The address .25 lies within that usable range, while .16 (network), .31 (broadcast), and .32 (next subnet) cannot be assigned to a host.

Which pair of UDP ports does DHCP use for the server and the client respectively?

• a.67 (server) and 68 (client)✓
• b.53 for the server and 54 for the client, mirroring DNS
• c.123 for the server and 124 for the client, alongside NTP
• d.69 for the server and 70 for the client, sharing the TFTP range

DHCP servers listen on UDP port 67 and clients use UDP port 68. Because a client has no address yet, the initial Discover is broadcast, and these fixed ports let servers and clients recognize each other's messages.

Which TCP port does POP3 use to retrieve email from a mailbox server?

• a.25
• b.110✓
• c.995
• d.143

POP3 (Post Office Protocol version 3) uses TCP port 110 to download messages to a client. IMAP uses TCP 143, SMTP uses TCP 25 for sending mail, and POP3S (POP3 over TLS) uses TCP 995.

Which application protocol uses TCP port 143 and typically leaves messages stored on the mail server?

• a.FTP, which transfers files over a control channel
• b.SMTP, which transfers mail between mail servers
• c.IMAP✓
• d.POP3, which normally downloads and removes messages

IMAP (Internet Message Access Protocol) uses TCP port 143 and is designed to keep mail on the server so it can be accessed and synchronized from multiple devices. POP3 (TCP 110) traditionally downloads and deletes messages.

Which IPv4 header field identifies the position of a fragment within the original datagram?

• a.Header Checksum, which validates the integrity of the header
• b.Time To Live, which limits how many hops a packet may take
• c.Fragment Offset✓
• d.Identification, which groups fragments of the same datagram

When a packet is fragmented, the Fragment Offset field records where each fragment belongs in the reassembled datagram. The Identification field marks which fragments belong together, but the offset supplies the ordering.

In a standard /64 IPv6 subnet, how many bits are available for the interface identifier?

• a.48, matching the length of a physical MAC address
• b.64✓
• c.32, the same width as an entire IPv4 address
• d.16, the size of a single IPv6 hextet field

IPv6 unicast addresses are 128 bits, and a /64 uses the first 64 bits as the network prefix. That leaves the remaining 64 bits for the interface identifier, which SLAAC or EUI-64 can generate automatically.

In the EUI-64 process, which 16-bit hexadecimal value is inserted into the middle of a 48-bit MAC address?

• a.FFFE✓
• b.FF00, the start of the IPv6 multicast range
• c.FFFF, which is the all-ones broadcast pattern
• d.FEFE, which has no defined role in EUI-64

EUI-64 splits the 48-bit MAC in half and inserts FFFE in the middle to form a 64-bit interface ID. It also flips the seventh bit (the universal/local bit), so a MAC such as 00:1A:2B... becomes 021A:2BFF:FE....

IPv4 multicast frames are carried in Ethernet frames whose destination MAC begins with which reserved prefix?

• a.01:00:5E✓
• b.FF:FF:FF
• c.00:00:0C, an OUI historically assigned to Cisco
• d.01:80:C2

IPv4 multicast addresses map to Ethernet destination MACs in the 01:00:5E range, with 23 bits of the group address copied into the MAC. STP BPDUs use 01:80:C2, and FF:FF:FF:FF:FF:FF is the Layer 2 broadcast.

An IPv4 address whose first octet is 230 belongs to which class, and what is its purpose?

• a.Class A, used for large unicast networks
• b.Class E, reserved for experimental use
• c.Class B, used for medium unicast networks
• d.Class D, used for multicast✓

Class D covers the range 224.0.0.0 to 239.255.255.255 and is reserved for multicast group addressing rather than assigning to individual hosts. The value 230 falls squarely within that multicast range.

The IPv4 range 240.0.0.0 to 255.255.255.255 is set aside as which address class?

• a.Class A, allocated for very large networks
• b.Class D, allocated for multicast group traffic
• c.Class C, allocated for small unicast networks
• d.Class E, reserved for experimental use✓

Class E spans 240.0.0.0 through 255.255.255.255 and is reserved for experimental and future use, so these addresses are not assigned to normal hosts. Class D (224-239) handles multicast.

What is the smallest subnet (the longest prefix) that still provides at least 30 usable host addresses?

• a./26
• b./28
• c./25
• d./27✓

A /27 leaves 5 host bits, giving 2^5 - 2 = 30 usable addresses, exactly meeting the requirement with the least waste. A /28 offers only 14, and a /26 or /25 provides more addresses than necessary.

What is the decimal value of the binary octet 11000000?

• a.192✓
• b.128
• c.240
• d.224

Reading positional values 128 + 64 = 192 for the two leftmost set bits gives 11000000 = 192. This is the third-octet value seen in masks like 255.255.192.0 and the fourth octet of a /26 mask.

The subnet mask octet 255.255.255.248 corresponds to which prefix length and block size?

• a./29 with a block size of 8✓
• b./27 with a block size of 32, two steps larger
• c./30 with a block size of 4, one step smaller
• d./28 with a block size of 16, one step larger

The last octet 248 is 11111000, adding 5 bits to the 24 network bits for a /29. The block size equals 256 - 248 = 8, so subnets increment .0, .8, .16, and so on, each holding 6 usable hosts.

Which term describes the amount of time it takes a single bit to travel from source to destination across a link?

• a.Jitter, the variation in delay between successive packets
• b.Bandwidth, the theoretical maximum data rate of the link
• c.Latency✓
• d.Throughput, the actual data rate achieved in practice

Latency (delay) is the time for data to traverse the path from source to destination. Bandwidth is the link's rated capacity, throughput is the real observed rate, and jitter measures how much latency varies packet to packet.

In a VoIP deployment, which impairment refers to the variation in delay between successive packets arriving?

• a.Latency, the fixed one-way delay across the path
• b.Bandwidth, the maximum capacity the link can carry
• c.Jitter✓
• d.Attenuation, the weakening of a signal over distance

Jitter is the variability in packet arrival times, and excessive jitter degrades voice quality because a jitter buffer can only absorb so much variation. Steady low latency and low jitter are both important for VoIP.

A full-duplex switch port connects to a host that is stuck operating at half-duplex. What symptom typically results?

• a.The link never comes up and both sides show as down
• b.The switch immediately places the port into err-disabled
• c.Late collisions and poor throughput on the link✓
• d.The port is automatically pruned from every VLAN

A duplex mismatch lets each side use different collision assumptions, producing late collisions, CRC errors, and sluggish throughput even though the link appears up. The fix is to make both ends match, ideally by allowing autonegotiation on both.