Cisco CCNA (200-301) — All Questions

What is the primary function of the Physical layer (Layer 1) of the OSI model?

• a.Routes packets between networks using logical addresses
• b.Transmits raw bits as electrical, optical, or radio signals✓
• c.Provides reliable end-to-end delivery with retransmission
• d.Establishes and manages sessions between applications

The Physical layer moves raw bits across the medium as electrical voltages, light pulses, or radio waves, defining connectors, pinouts, and signaling. It does not interpret the data; higher layers handle addressing, sessions, and reliability.

Which pair of protocols operates at the Transport layer of the TCP/IP model?

• a.ARP and RARP
• b.IP and ICMP
• c.HTTP and DNS
• d.TCP and UDP✓

TCP and UDP are the two Transport layer protocols: TCP is connection-oriented and reliable, while UDP is connectionless and low-overhead. IP and ICMP work at the Internet (Network) layer, and HTTP and DNS are application protocols.

Which TCP header field lets the receiver reorder segments that arrive out of order?

• a.Sequence number✓
• b.Checksum
• c.Window size field advertising available buffer space
• d.Source port

TCP assigns a sequence number to the bytes in each segment, so the receiver can place data back in the correct order and detect gaps for retransmission. The checksum validates integrity and the window field handles flow control, but ordering relies on sequence numbers.

Which TCP mechanism regulates how much data a sender can transmit before receiving an acknowledgment?

• a.Windowing (sliding window)✓
• b.Fragmentation and reassembly performed at the network layer
• c.Broadcasting
• d.Flooding

TCP uses a sliding window to control flow: the receiver advertises how much buffer space it has, and the sender limits unacknowledged data to that window. This prevents overwhelming a slower receiver and adapts dynamically as conditions change.

Which well-known port number is used by HTTPS?

• a.22
• b.25
• c.80
• d.443✓

HTTPS runs over TCP port 443, encrypting web traffic with TLS. Plain HTTP uses port 80, SSH uses 22, and SMTP uses 25. Memorizing well-known ports helps when writing ACLs and troubleshooting application connectivity.

Which TCP port does SSH use for secure remote management?

• a.21
• b.22✓
• c.23
• d.443

SSH listens on TCP port 22 and encrypts the entire management session. Telnet uses port 23 in clear text, and FTP control uses 21. Because SSH protects credentials from eavesdropping, it is the preferred remote CLI method.

Which TCP port is used by the FTP control connection?

• a.22
• b.20
• c.69
• d.21✓

FTP uses TCP port 21 for the control channel that carries commands, and port 20 for active-mode data transfer. TFTP is different, using UDP 69. Knowing the split between control and data ports helps when permitting FTP through a firewall.

Which TCP port does Telnet use?

• a.22
• b.23✓
• c.25
• d.53

Telnet uses TCP port 23 and transmits all data, including usernames and passwords, in clear text. Because of this exposure, SSH on port 22 is recommended instead. Telnet is still occasionally seen on legacy or lab devices.

Which TCP port is used by SMTP for sending email between servers?

• a.110
• b.143
• c.587 for encrypted submission from mail clients only
• d.25✓

SMTP uses TCP port 25 for server-to-server mail transfer. POP3 uses 110 and IMAP uses 143 for retrieval, while port 587 is used for authenticated client message submission. Distinguishing send versus retrieve ports is a common troubleshooting point.

Which well-known TCP port does unencrypted HTTP use?

• a.Web traffic defaults to port 8000 on most servers
• b.80✓
• c.443
• d.8080

HTTP uses TCP port 80 by default. Port 443 is for HTTPS, and 8080 is a common alternate/proxy port but is not the default for standard web traffic. Recognizing port 80 helps identify plaintext web sessions.

What is the fixed size of a UDP header?

• a.20 bytes
• b.A variable length between 20 and 60 bytes
• c.8 bytes✓
• d.16 bytes

A UDP header is a fixed 8 bytes, containing source port, destination port, length, and checksum. Its minimal overhead (compared with TCP's 20-byte minimum) makes UDP fast and efficient for real-time and simple query/response traffic.

Which Transport layer protocol is connection-oriented and provides reliable, ordered delivery?

• a.TCP✓
• b.IP
• c.ICMP
• d.UDP

TCP is connection-oriented, establishing a session with a three-way handshake and guaranteeing ordered, reliable delivery through sequencing, acknowledgments, and retransmission. UDP is connectionless and best-effort, while IP and ICMP operate at the Internet layer.

Which protocol does the ping utility use to test reachability between hosts?

• a.ARP
• b.IGMP
• c.UDP
• d.ICMP✓

Ping relies on ICMP echo request and echo reply messages to verify Layer 3 reachability and measure round-trip time. ARP resolves IP to MAC on a local link, and IGMP manages multicast group membership; neither is used by ping.

How many bits long is an IPv4 address?

• a.48 bits
• b.128 bits
• c.32 bits✓
• d.64 bits

An IPv4 address is 32 bits, written as four 8-bit octets in dotted-decimal form. This yields roughly 4.3 billion addresses, whose exhaustion drove the adoption of the 128-bit IPv6 address space.

How many bits long is an IPv6 address?

• a.256 bits
• b.48 bits
• c.128 bits✓
• d.64 bits

An IPv6 address is 128 bits, written as eight groups of four hexadecimal digits. This vastly larger space eliminates the address scarcity of IPv4 and removes the routine need for NAT.

How many bits are in an Ethernet MAC address?

• a.64 bits
• b.128 bits
• c.48 bits✓
• d.32 bits

A MAC address is 48 bits (6 bytes), usually shown as 12 hexadecimal digits. The first 24 bits are the vendor OUI and the last 24 bits are assigned by the manufacturer to make each address unique.

What does the first half (the OUI) of a MAC address identify?

• a.The manufacturer (vendor) of the network interface✓
• b.The default gateway for the host
• c.The IP subnet the device currently belongs to
• d.The VLAN the port is assigned to

The first 24 bits of a MAC address form the Organizationally Unique Identifier (OUI), which the IEEE assigns to a specific hardware vendor. The remaining 24 bits are the device-specific serial portion. Together they make each burned-in address globally unique.

How does the EUI-64 process build an IPv6 interface ID from a 48-bit MAC address?

• a.It requests the interface ID from a DHCPv6 server
• b.It inserts FFFE into the middle of the MAC and flips the 7th bit✓
• c.It randomizes the entire 64-bit identifier for privacy
• d.It appends the host's IPv4 address to the MAC

EUI-64 splits the 48-bit MAC, inserts FFFE in the middle to reach 64 bits, and inverts the 7th bit (the universal/local bit) of the first byte. The result becomes the interface identifier appended to the /64 prefix.

What is the IPv6 loopback address?

• a.FE80::1
• b.127.0.0.1
• c.::
• d.::1✓

The IPv6 loopback address is ::1, the equivalent of IPv4's 127.0.0.1, used by a host to test its own TCP/IP stack. The all-zeros address :: is the unspecified address, and FE80::/10 is link-local.

Which IPv6 address is the unspecified address, often used as a source before an address is assigned?

• a.::1
• b.FF02::1
• c.0.0.0.0
• d.::✓

The unspecified IPv6 address is :: (all zeros), used as a source address during processes like duplicate address detection before a real address is configured. ::1 is loopback and FF02::1 is the all-nodes multicast address.

Which IPv6 multicast address reaches all IPv6 nodes on the local link?

• a.FF02::2
• b.FF02::1✓
• c.FF05::1
• d.FF02::5

FF02::1 is the all-nodes link-local multicast address, reaching every IPv6 host on the segment (similar to a broadcast). FF02::2 targets all routers on the link. The FF02:: prefix denotes link-local multicast scope.

Which IPv6 multicast address is used to reach all routers on the local link?

• a.FF02::9
• b.FF02::1
• c.FF02::2✓
• d.FF02::1:2

FF02::2 is the all-routers link-local multicast address, used by hosts to reach every router on the segment, such as when sending Router Solicitation messages. FF02::1 reaches all nodes, not just routers.

In IPv6, which Neighbor Discovery messages replace IPv4 ARP for resolving a neighbor's link-layer address?

• a.ARP request and ARP reply broadcast frames
• b.ICMPv6 Echo request and Echo reply diagnostic messages
• c.Neighbor Solicitation and Neighbor Advertisement✓
• d.DHCP Discover and DHCP Offer messages

IPv6 uses ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages (part of NDP) to map an IPv6 address to a MAC address, replacing IPv4's ARP. NDP also handles router discovery and duplicate address detection on the link.

How many usable host addresses does a /24 subnet provide?

• a.254✓
• b.256
• c.253
• d.255

A /24 has 8 host bits, giving 2^8 = 256 total addresses. Removing the network address and the broadcast address leaves 254 usable host addresses, the familiar count for a standard Class C-sized LAN.

Which cable type connects a PC's serial/USB port to a Cisco router or switch console port for CLI management?

• a.A shielded straight-through cable wired T568B on both ends
• b.Crossover
• c.Rollover (console) cable✓
• d.Coaxial

A rollover (console) cable connects a management PC to the device's console port for initial CLI access, with the pinout reversed end to end. Crossover and straight-through cables carry Ethernet data, not console signaling.

A straight-through Ethernet cable is traditionally used to connect which of the following?

• a.A router console port to a laptop for management access
• b.Switch to switch
• c.PC to switch (unlike devices)✓
• d.Router to router

Straight-through cables connect unlike devices, such as a PC to a switch or a switch to a router, because their transmit and receive pairs already align. Like devices (switch to switch) traditionally need a crossover cable, though Auto-MDIX now adjusts automatically.

What is a key advantage of fiber-optic cabling over copper?

• a.Immunity to electromagnetic interference✓
• b.It can also deliver electrical power to remote devices
• c.Lower material cost than copper
• d.Easier field splicing and termination

Fiber transmits light rather than electrical signals, so it is immune to electromagnetic and radio interference and supports much longer distances and higher bandwidth. Copper is cheaper and easier to terminate, but is susceptible to EMI and crosstalk.

Which statement correctly describes single-mode fiber?

• a.It carries many light paths using inexpensive LED sources
• b.It is used only for very short indoor patch cables
• c.It transmits electrical signals over copper conductors
• d.It supports longer distances using a laser light source✓

Single-mode fiber uses a very thin core and a laser source to send one light path over long distances (kilometers), ideal for backbone and WAN links. Multimode fiber uses a wider core with LED sources for shorter runs and is typically cheaper.

What is the maximum standard cable length for 1000BASE-T over Cat5e/Cat6 copper?

• a.250 meters
• b.100 meters✓
• c.55 meters
• d.100 meters, but only when run over fiber-optic cabling

1000BASE-T (Gigabit Ethernet over twisted pair) is specified for up to 100 meters on Cat5e or better copper. Beyond that distance, signal degradation requires fiber or a repeater. The 100-meter limit applies to most copper Ethernet standards.

What does the Auto-MDIX feature on a switch port do?

• a.It automatically forces the port to 10 Gbps
• b.It encrypts all Ethernet frames and authenticates connected devices
• c.It auto-detects and adjusts for straight-through vs crossover wiring✓
• d.It supplies inline power to attached endpoints

Auto-MDIX automatically senses whether a straight-through or crossover cable is connected and adjusts the port's transmit and receive pairs accordingly. This removes the need to match cable types manually and is why modern switch-to-switch links work with either cable.

What does full-duplex operation on an Ethernet link allow?

• a.Sending and receiving simultaneously with no collisions✓
• b.Only receiving data, never transmitting
• c.Sending and receiving alternately, one direction at a time using CSMA/CD
• d.Sharing bandwidth among many hosts on a hub

Full-duplex lets a device transmit and receive at the same time over dedicated pairs, eliminating collisions and disabling CSMA/CD. Half-duplex, used on hubs or legacy links, allows only one direction at a time and must detect collisions.

In which environment is CSMA/CD (carrier sense multiple access with collision detection) used?

• a.Wireless 802.11 networks
• b.Half-duplex Ethernet segments✓
• c.IPv6 routing between subnets
• d.Full-duplex switched fiber links with dedicated bandwidth

CSMA/CD manages access on shared, half-duplex Ethernet where collisions can occur, having stations listen before sending and back off after a collision. Full-duplex switched links have no collisions, and wireless uses CSMA/CA (collision avoidance) instead.

Which device operates purely at Layer 1 (the Physical layer)?

• a.A multilayer switch performing inter-VLAN routing
• b.Router
• c.Hub or repeater✓
• d.Switch

A hub or repeater works at Layer 1, simply regenerating and flooding electrical signals out all ports without reading addresses. Switches operate at Layer 2 using MAC addresses, and routers at Layer 3 using IP addresses.

What is the Layer 2 broadcast MAC address?

• a.0180.C200.0000
• b.The lowest MAC currently in the switch address table
• c.0000.0000.0000
• d.FFFF.FFFF.FFFF✓

FFFF.FFFF.FFFF is the broadcast MAC address; a frame sent to it is delivered to every host in the VLAN. Switches flood broadcast frames out all ports except the ingress port, since the destination is every node.

How does a switch populate its MAC address table?

• a.By requesting the table from a DHCP server
• b.By recording the source MAC of each incoming frame with its ingress port✓
• c.By flooding ARP requests to every VLAN on the switch
• d.By reading the destination MAC of frames it forwards upstream

A switch learns by examining the source MAC address of every incoming frame and associating it with the port it arrived on. It stores this in the CAM/MAC table so future frames to that address are forwarded only out the correct port.

What is the default MTU (maximum transmission unit) size for a standard Ethernet frame payload?

• a.576 bytes
• b.1000 bytes
• c.1500 bytes✓
• d.9000 bytes

Standard Ethernet uses a 1500-byte MTU for the IP payload. Frames larger than this (jumbo frames, up to about 9000 bytes) must be explicitly enabled end to end. An MTU mismatch can cause fragmentation or dropped packets.

What is the purpose of the TTL (Time To Live) field in an IPv4 header?

• a.It sets the QoS priority of the packet in the queue
• b.It is decremented at each router hop and the packet is dropped at zero✓
• c.It stores the destination MAC address for delivery
• d.It encrypts the packet payload end to end between the two hosts

Each router decrements the TTL by one, and when it reaches zero the packet is discarded and an ICMP time-exceeded message may be returned. This prevents packets from looping endlessly through a network and is what traceroute exploits.

An IPv4 address whose first octet is in the range 128-191 belongs to which class?

• a.Class C
• b.Class D (multicast)
• c.Class B✓
• d.Class A

First-octet ranges define legacy classes: Class A is 1-126, Class B is 128-191, Class C is 192-223, and Class D (multicast) is 224-239. So a first octet of 128-191 is Class B, with a default /16 mask.

Which address block is reserved for IPv4 loopback?

• a.127.0.0.0/8✓
• b.192.0.2.0/24
• c.10.0.0.0/8
• d.169.254.0.0/16

The 127.0.0.0/8 block is reserved for loopback, with 127.0.0.1 most commonly used to test the local TCP/IP stack. 169.254.0.0/16 is APIPA/link-local, and 10.0.0.0/8 is RFC 1918 private space.

Which address range does a host self-assign (APIPA) when no DHCP server responds?

• a.169.254.0.0/16✓
• b.127.0.0.0/8
• c.172.16.0.0/12
• d.192.168.0.0/16

When DHCP fails, a host automatically configures an APIPA (link-local) address from 169.254.0.0/16. This allows limited same-subnet communication but not Internet access, and seeing a 169.254 address is a strong sign of a DHCP problem.

How is the broadcast address of an IPv4 subnet identified?

• a.Any address in the multicast range 224.0.0.0/4
• b.The first usable address in the subnet, reserved for the router interface
• c.The last address in the subnet, with all host bits set to 1✓
• d.The address that is currently assigned to the DHCP server

The broadcast address is the final address of a subnet, formed by setting every host bit to 1, and a frame sent to it reaches all hosts on that subnet. The network address (all host bits 0) is the first address in the block.

Which statement about the relationship between prefix length and subnet size is correct?

• a.A longer prefix always yields more hosts per subnet
• b.A longer prefix yields more subnets but fewer hosts per subnet✓
• c.Every subnet supports 254 hosts regardless of the mask applied
• d.Prefix length has no effect on the number of hosts

Lengthening the prefix (for example /24 to /27) borrows host bits to create more, smaller subnets, so each subnet supports fewer hosts. There is always a trade-off: more subnets means fewer hosts each, since the 32 bits are fixed.

Which VLAN is the default VLAN on a Cisco Catalyst switch, to which all ports initially belong?

• a.VLAN 4094
• b.VLAN 0
• c.VLAN 1005
• d.VLAN 1✓

By default all switch ports are members of VLAN 1, which also carries control traffic like CDP and STP. Because VLAN 1 cannot be deleted, best practice is to move user and management traffic to other VLANs for security.

Which range represents the normal-range VLAN IDs on a Cisco switch?

• a.0-1023
• b.1-1005✓
• c.1-4094
• d.1006-4094, which are reserved for normal everyday use

Normal-range VLANs are 1-1005 and are stored in the vlan.dat file and can be advertised by VTP. Extended-range VLANs 1006-4094 require VTP transparent mode (or later versions) and are stored in the running configuration.

In VLAN configuration mode, which command assigns the name SALES to a VLAN?

• a.switchport vlan name SALES
• b.vlan name SALES
• c.name SALES✓
• d.description SALES

After entering 'vlan 20', the command 'name SALES' labels the VLAN for readability. The 'description' command is used on interfaces, not VLAN definitions, and naming a VLAN is optional but helpful for documentation.

Which interface command statically configures a port as a trunk?

• a.switchport mode trunk✓
• b.switchport trunk enable
• c.switchport access trunk
• d.switchport mode dynamic

'switchport mode trunk' forces the port into permanent trunking mode so it carries multiple tagged VLANs. Pairing it with 'switchport nonegotiate' disables DTP. Access mode, by contrast, carries a single untagged VLAN for an end device.

Which DTP mode actively attempts to form a trunk with a neighboring switch?

• a.access
• b.nonegotiate, which forces a permanent trunk without DTP
• c.dynamic auto
• d.dynamic desirable✓

'dynamic desirable' actively sends DTP frames trying to negotiate a trunk, forming one with a neighbor set to trunk, desirable, or auto. 'dynamic auto' only responds passively, so two auto ports stay in access mode.

Which command disables Dynamic Trunking Protocol negotiation on an interface?

• a.no dtp enable
• b.switchport nonegotiate✓
• c.no switchport
• d.switchport mode access

'switchport nonegotiate' stops the port from sending DTP frames, which is recommended on manually configured trunks and on access ports to prevent trunk negotiation attacks. The mode must be set statically since negotiation is turned off.

Which command restricts a trunk to carry only VLANs 10 and 20?

• a.switchport trunk allowed vlan 10,20✓
• b.switchport block vlan 30
• c.switchport filter vlan 10,20 permit only inbound
• d.switchport access vlan 10

'switchport trunk allowed vlan 10,20' limits the trunk to those VLANs, pruning all others to reduce unnecessary flooding and improve security. Using 'add' or 'remove' keywords lets you modify the list without overwriting it entirely.

Which command changes the native VLAN on an 802.1Q trunk to VLAN 99?

• a.native vlan 99
• b.switchport trunk native vlan 99✓
• c.switchport trunk allowed native 99
• d.switchport native vlan 99

'switchport trunk native vlan 99' sets the untagged native VLAN and must match on both ends of the trunk. Moving the native VLAN off the default VLAN 1 is a common hardening step against VLAN hopping.