Cisco CCNA (200-301) — All Questions

Which UDP ports does CAPWAP use for its control and data channels?

• a.UDP 67 for control and UDP 68 for data
• b.TCP 22 for control and TCP 23 for data
• c.UDP 5246 for control and UDP 5247 for data✓
• d.TCP 80 for control and TCP 443 for encrypted data forwarding

CAPWAP uses UDP port 5246 for the control channel and UDP port 5247 for the data channel between the AP and the WLC. Knowing these ports is useful when permitting CAPWAP through a firewall between remote APs and the controller.

Which of the following is a common source of interference in the 2.4 GHz Wi-Fi band?

• a.OSPF hello packets on the wired network
• b.Straight-through Ethernet cables in the wiring closet
• c.Fiber-optic cabling in the ceiling
• d.Microwave ovens and Bluetooth devices✓

Microwave ovens, Bluetooth devices, and cordless phones share the unlicensed 2.4 GHz band and cause interference, degrading Wi-Fi performance. This crowding, plus only three non-overlapping channels, is a key reason the 5 GHz band is often preferred.

What is Cisco DNA Center?

• a.A Layer 2 access switch for wiring closets
• b.A dedicated DHCP and DNS appliance for assigning client addresses
• c.A handheld cable-certification tester
• d.A central controller for intent-based network management and automation✓

Cisco DNA Center is the central controller and dashboard for intent-based networking, providing design, provisioning, policy, and assurance across the enterprise. It abstracts device-by-device CLI into centralized, automated workflows and telemetry.

What does the northbound interface of an SDN controller do?

• a.Connects the controller down to the managed switches and routers
• b.Lets applications and orchestration tools request services from the controller✓
• c.Carries end-user data packets across the fabric
• d.Is the physical console cable attached to the controller

The northbound interface (typically REST APIs) faces upward toward applications and automation tools, letting them request network behavior from the controller. The southbound interface faces down to program the network devices themselves.

In a REST API, which action does the POST method typically perform?

• a.Create a new resource✓
• b.Delete an existing resource
• c.Replace an entire existing resource in place
• d.Retrieve an existing resource

POST is used to create a new resource on the server, mapping to the 'Create' operation in CRUD. GET reads, PUT replaces/updates, and DELETE removes. Unlike GET, POST changes server state and is not considered idempotent.

In a REST API, what does the PUT method generally do?

• a.Only read data without changing it
• b.Permanently delete the whole collection of resources
• c.Update or replace an existing resource✓
• d.Open a persistent TCP session to the server

PUT updates or replaces a resource at a known URI and is idempotent, meaning repeating the same request yields the same result. GET reads, POST creates, and PATCH applies a partial update rather than replacing the whole resource.

In a REST API, what does the DELETE method do?

• a.Create a new resource on the server
• b.Duplicate the resource into a backup collection
• c.Read a resource without modifying it
• d.Remove the specified resource✓

DELETE removes the resource identified by the URI, completing the CRUD set alongside POST (create), GET (read), and PUT/PATCH (update). It is idempotent because deleting an already-deleted resource leaves the same end state.

What does the HTTP PATCH method do in a REST API?

• a.Applies a partial update to a resource✓
• b.Fully replaces the entire resource
• c.Creates an entirely new nested resource tree
• d.Reads the resource without changes

PATCH modifies part of a resource, sending only the fields to change, whereas PUT typically replaces the whole resource. PATCH is efficient when you need to update just one attribute of a large configuration object.

What does an HTTP 200 status code indicate in a REST API response?

• a.The request succeeded (OK)✓
• b.The request was redirected elsewhere
• c.A server-side error occurred
• d.The client sent a malformed, unauthorized request

HTTP 200 (OK) means the request succeeded and the response contains the expected data. 2xx codes indicate success, 3xx redirection, 4xx client errors, and 5xx server errors. Reading status codes is essential when working with controller APIs.

What does an HTTP 401 status code indicate?

• a.Unauthorized: authentication is required or has failed✓
• b.A server-side failure occurred while processing
• c.The requested resource does not exist on the server
• d.The request succeeded and the resource was returned to the caller

HTTP 401 Unauthorized means the request lacks valid authentication credentials, so the client must authenticate (for example with a token) before access is granted. It differs from 403 Forbidden, where the identity is known but lacks permission.

What does an HTTP 404 status code mean?

• a.The client is unauthorized to access the resource
• b.The gateway timed out waiting for an upstream server
• c.The requested resource was not found✓
• d.The request completed successfully

HTTP 404 Not Found means the server could not locate the requested resource at that URI, often due to a wrong endpoint path. As a 4xx code it points to a client-side issue such as a typo in the request URL.

What does an HTTP 500 status code indicate?

• a.A server-side error prevented fulfilling a valid request✓
• b.A fully successful response with data
• c.The resource was created successfully
• d.The client is unauthorized and must provide valid credentials first

HTTP 500 Internal Server Error is a 5xx code indicating the server encountered an unexpected condition and could not complete an otherwise valid request. The fix usually lies on the server side, not with the client's request format.

What does it mean that REST is stateless?

• a.Each request is self-contained; no session is stored between calls✓
• b.It requires a permanent encrypted tunnel to remain open
• c.The server stores and tracks every client's ongoing session state
• d.It works only between devices inside the same VLAN

Statelessness means each REST request carries all the information the server needs (such as an auth token), and the server keeps no client session between requests. This makes REST APIs scalable and easy to load-balance across servers.

How is a client commonly authenticated to a REST API?

• a.Only through a directly attached serial console
• b.By exchanging OSPF hello packets between the two peers
• c.It never requires any form of authentication
• d.With a token or API key supplied in the request header✓

REST APIs typically authenticate clients using a token or API key (often a bearer token in the HTTP Authorization header), sometimes obtained via a prior login call. This proves identity on each stateless request without a persistent session.

In JSON, what does a pair of square brackets [ ] denote?

• a.A key that maps directly to one boolean value
• b.A comment block ignored by parsers
• c.A single string value
• d.An array, an ordered list of values✓

Square brackets define a JSON array, an ordered list that can hold strings, numbers, objects, or other arrays. Curly braces define objects (key-value collections). Recognizing this structure is essential when parsing API responses.

Which of the following correctly lists valid JSON value types?

• a.Only string values are permitted
• b.Tags and attributes wrapped in angle brackets as in XML
• c.String, number, boolean, null, object, array✓
• d.Only integers and floating-point numbers

JSON values may be a string, number, boolean (true/false), null, object, or array, and objects and arrays can nest. This small, well-defined type set is what makes JSON simple to parse across programming languages.

How does JSON generally compare with XML as a data-interchange format?

• a.JSON is unable to represent nested or hierarchical data
• b.JSON is more lightweight and less verbose than XML✓
• c.XML is always smaller and simpler than the equivalent JSON document
• d.JSON and XML are byte-for-byte identical in structure

JSON's minimal syntax (braces, brackets, and key-value pairs) makes it more compact and easier to read than XML's opening and closing tags. Both can represent nested data, but JSON is now the more common choice for REST APIs.

What is the basic syntax style of YAML?

• a.Indentation with key: value pairs and dashes for lists✓
• b.A compact binary encoding that humans cannot read
• c.Curly braces and commas only, exactly like JSON
• d.Angle-bracket opening and closing tags

YAML uses indentation to show structure, with 'key: value' pairs and leading dashes for list items, making it very human-readable. This readability is a major reason Ansible playbooks are written in YAML.

How does XML structure its data?

• a.Using opening and closing angle-bracket tags around each element✓
• b.Using indentation levels only, with no delimiters around values
• c.Using square brackets to wrap each element
• d.Using key: value pairs separated by colons

XML wraps each piece of data in matching opening and closing tags (for example <name>R1</name>) and supports attributes within tags. This verbose, hierarchical markup is used by NETCONF, though JSON and YAML are often preferred for readability.

Which statement best describes Puppet as a configuration management tool?

• a.It is a dynamic routing protocol for enterprise cores
• b.It is agent-based, uses a pull model, and defines state in manifests✓
• c.It is agentless and pushes over SSH, like Ansible
• d.It is a REST verb used to update device configuration files

Puppet traditionally uses an agent installed on each managed node that periodically pulls its desired state (written in Puppet's declarative language) from a master. This contrasts with Ansible's agentless push model over SSH.

Which statement best describes the Chef configuration management tool?

• a.It uses Ruby-based recipes and cookbooks with an agent-based model✓
• b.It is a wireless controller feature for onboarding access points
• c.It uses YAML playbooks pushed over SSH with no agent
• d.It is a Layer 2 switching protocol

Chef organizes configuration into recipes and cookbooks written in a Ruby-based DSL, applied by an agent (chef-client) that pulls policy from a Chef server. Like Puppet, it is agent-based, whereas Ansible is agentless.

How does Ansible's delivery model differ from Puppet's and Chef's?

• a.All three require a compiled agent installed on every device
• b.Ansible pushes configuration, while Puppet and Chef typically pull✓
• c.All three are strictly pull-based with mandatory agents
• d.Ansible needs a compiled binary agent installed on every device

Ansible is agentless and pushes configuration to devices over SSH, whereas Puppet and Chef usually rely on an installed agent that pulls policy from a central server. Ansible's push, agentless approach simplifies network device automation.

What does idempotency mean in configuration automation?

• a.It requires a device reboot after every single task
• b.It automatically encrypts the playbook before running
• c.Re-running the same task yields the same end state with no extra changes✓
• d.Each run doubles the configuration already present

An idempotent operation produces the same result no matter how many times it runs, so applying an already-correct configuration causes no additional change. This safety property lets automation tools re-run reliably without unintended side effects.

What is a CI/CD pipeline in the context of network automation?

• a.An automated pipeline that tests and deploys configuration changes✓
• b.A variant of Network Address Translation
• c.A method of manually copying configs device by device at night
• d.A spanning-tree redundancy feature

CI/CD (continuous integration/continuous delivery) automates testing and deployment so configuration changes are validated and pushed consistently. Applied to networks, it reduces manual error and speeds safe rollout of changes across many devices.

What is configuration drift?

• a.A routing loop caused by a missing default route
• b.Cabling that slowly comes loose from the patch panel over time
• c.Signal attenuation over a long fiber run between buildings
• d.Devices diverging from their intended configuration baseline✓

Configuration drift is the gradual divergence of a device's running configuration from its documented, intended baseline, often from ad-hoc manual changes. Automation and infrastructure-as-code detect and correct drift to keep devices consistent.

What is infrastructure as code (IaC)?

• a.A special wireless AP operating mode
• b.Running each configuration command by hand on every device nightly
• c.Defining and version-controlling infrastructure configuration in code files✓
• d.A cabling standard for structured wiring closets

IaC manages network and system configuration through machine-readable definition files kept under version control, so infrastructure is provisioned consistently and repeatably. This brings software practices like review, testing, and rollback to network changes.

How do NETCONF and RESTCONF differ in transport and encoding?

• a.NETCONF is a spanning-tree extension for faster convergence
• b.Both use Telnet exclusively for transport
• c.Both are wireless roaming protocols
• d.NETCONF uses XML over SSH; RESTCONF uses HTTP with JSON or XML✓

NETCONF exchanges XML-encoded data over an SSH session, while RESTCONF uses REST-style HTTP methods with JSON or XML payloads. Both let tools programmatically configure devices using structured data models such as YANG.

What is YANG in the context of network automation?

• a.A data-modeling language describing device configuration and state✓
• b.A routing metric used by link-state protocols
• c.A shielded twisted-pair cable rated for 10-gigabit Ethernet
• d.A symmetric encryption cipher for management traffic

YANG is a data-modeling language that defines the structure of configuration and operational data used by NETCONF and RESTCONF. Standardized models let automation tools interact with devices in a consistent, vendor-neutral way.

What is OpenFlow in a software-defined networking architecture?

• a.A southbound protocol that programs the forwarding tables of network devices✓
• b.A structured cabling specification for data centers
• c.A northbound application programming interface used by orchestration tools
• d.A wireless client roaming standard for large campuses

OpenFlow is a southbound protocol that lets an SDN controller directly program the flow (forwarding) tables in switches. Southbound interfaces face the devices, while northbound interfaces face the applications requesting network services.

What is an overlay network?

• a.A virtual network tunneled on top of the physical underlay✓
• b.A single VLAN spanning one access switch
• c.The out-of-band management console port on a router
• d.The physical cabling and switches that carry the underlying transport

An overlay is a virtual network (often using tunnels such as VXLAN) built logically on top of the physical underlay that provides basic IP connectivity. Overlays enable flexible segmentation and mobility independent of the underlying topology.

What is intent-based networking?

• a.A physical Layer 1 cabling standard
• b.A backup power supply system for core switches
• c.The administrator declares the desired outcome and the controller implements it✓
• d.Manually typing the same CLI commands on each device one at a time

Intent-based networking lets administrators express what they want (business intent), and the controller translates that into device configuration, then continuously verifies it. It shifts effort from box-by-box CLI to declarative, automated policy.

What is a key benefit of software-defined networking (SDN)?

• a.It eliminates the need for IP addressing entirely
• b.It removes all need for network security controls
• c.Centralized automation enabling faster, more consistent changes✓
• d.Every device must still be touched by hand for each change

SDN centralizes control so policy is defined once and pushed programmatically, improving speed, consistency, and agility while reducing manual errors. Security remains essential and devices still forward traffic; only the control decisions are centralized.

What is a major drawback of traditional per-device CLI management?

• a.It requires no engineers to operate or maintain
• b.It scales instantly to thousands of devices without effort
• c.It is slow and error-prone because each device is configured by hand✓
• d.It is fully automated and applies every change across all devices at once

Configuring devices one at a time via CLI is time-consuming and prone to inconsistent, human-introduced errors, especially at scale. Automation and controller-based approaches address this by applying consistent configuration programmatically.

What advantage do structured data models provide for network configuration?

• a.They make configuration structured and machine-readable for automation✓
• b.They are readable only by humans, never by machines
• c.They physically replace the need for network cabling
• d.They are a type of spanning-tree BPDU exchanged between switches

Data models such as those written in YANG give configuration a consistent, machine-readable structure, so tools can reliably generate, validate, and apply it. This structure is the foundation that lets APIs automate devices predictably.

How does a webhook differ from polling?

• a.A cable-certification test performed on new installs
• b.An event-driven callback the server pushes when something changes✓
• c.A trunk carrying multiple VLANs between two switches
• d.A continuous polling loop where the client repeatedly asks for updates

A webhook is an event-driven callback: the server proactively sends data to a client URL when an event occurs, avoiding constant checking. Polling, by contrast, has the client repeatedly ask the server for updates, which is less efficient.

What does the Assurance function in Cisco DNA Center provide?

• a.A physical patch panel for structured cabling
• b.Telemetry and analytics for network health and troubleshooting✓
• c.A trunking mode for inter-switch links
• d.A DHCP scope that hands out addresses to wireless clients

DNA Center Assurance collects telemetry from devices and clients to give health scores, insights, and guided troubleshooting across the network. This visibility helps operators find and resolve issues proactively rather than reactively.

What is Cisco Software-Defined Access (SD-Access)?

• a.A spanning-tree convergence timer setting
• b.A legacy hub-and-spoke Frame Relay WAN design from the 1990s
• c.A legacy serial cable wiring standard
• d.A policy-based fabric overlay managed by DNA Center✓

SD-Access is Cisco's intent-based campus solution that builds a VXLAN fabric overlay with group-based policy, provisioned and managed centrally through DNA Center. It automates segmentation and policy instead of manual VLAN and ACL configuration.

What is one function a network controller performs during onboarding?

• a.It discovers and inventories the managed devices in the network✓
• b.It physically supplies electrical power to the switches
• c.It replaces the need for any IP addressing on the network
• d.It is itself a type of copper cabling

A controller discovers devices and maintains an inventory so it can manage, provision, and monitor them centrally. Discovery and inventory are prerequisites for pushing consistent policy and gathering assurance data across the network.

In JSON, an entry such as "hostname": "R1" is an example of what?

• a.A key-value pair✓
• b.A closing angle-bracket tag for an element
• c.A comment ignored by the parser
• d.An array element in an ordered list

In JSON, data is expressed as key-value pairs, where a string key maps to a value (here the key 'hostname' maps to the string 'R1'). Multiple pairs inside curly braces form an object, the basic building block of JSON documents.

Which data format uses 'key: value' syntax with dashes for list items and relies on indentation?

• a.XML
• b.JSON
• c.A compiled binary configuration blob
• d.YAML✓

YAML uses indentation, 'key: value' pairs, and leading dashes for lists, making it highly readable. JSON uses braces and brackets, and XML uses angle-bracket tags. YAML's clarity is why Ansible chose it for playbooks.

In a REST API, what is an endpoint (URI)?

• a.It is the shared encryption key for the session
• b.The MAC address of the controller's management port
• c.A URI that identifies a specific resource to act on✓
• d.A VLAN number assigned to management traffic

A REST endpoint is a URI that identifies a specific resource, such as /api/v1/devices, that the client acts on with methods like GET or POST. Well-structured endpoints make an API predictable and easy to automate against.

What is a primary benefit of network automation?

• a.It completely removes the need for any security controls on the network
• b.It makes physical cabling optional for connectivity
• c.Consistency, speed, and fewer human errors across many devices✓
• d.It intentionally slows deployment to allow manual review

Automation applies configuration consistently and quickly across many devices, reducing the manual, repetitive work that leads to human error. Security still matters and hardware still forwards traffic; automation improves how changes are delivered.

What is the fundamental difference between a routing protocol and a routed protocol?

• a.There is no practical difference; the two terms are interchangeable synonyms used by different vendors
• b.A routed protocol elects the root bridge, while a routing protocol builds the spanning tree across the switched network
• c.A routing protocol carries user data end to end, while a routed protocol only advertises administrative distances between neighbors Cisco groups both under the same heading in every version of the exam blueprint.
• d.A routing protocol (such as OSPF) exchanges reachability information to build the routing table, while a routed protocol (such as IP) carries user data✓

A routing protocol like OSPF, EIGRP, or RIP dynamically exchanges network reachability so routers can build and maintain their routing tables. A routed (or routable) protocol such as IPv4 or IPv6 is the protocol that actually carries user traffic across those learned paths. One learns the paths; the other travels them.

A router must forward a packet to 10.20.30.40. It has matching entries for 10.0.0.0/8, 10.20.0.0/16, and 10.20.30.0/24. Which entry is selected?

• a.All three are used together in a round-robin load-sharing arrangement
• b.10.20.30.0/24✓
• c.10.20.0.0/16, because a /16 balances specificity and summarization
• d.10.0.0.0/8, because the classful boundary always takes priority over subnets

Forwarding always uses the longest prefix match, meaning the entry with the greatest number of matching mask bits. Here 10.20.30.0/24 matches 24 bits and is more specific than the /16 or /8, so it is chosen. Prefix length is compared before administrative distance or metric when the prefixes differ.

Which three sources can populate a Cisco router's IPv4 routing table?

• a.Spanning-tree BPDUs, CDP neighbor advertisements, and ARP table entries combined
• b.Directly connected networks, static routes, and dynamic routing protocols✓
• c.Only statically configured routes entered by an administrator at the console
• d.Only dynamic routing protocols such as OSPF, EIGRP, and RIP running on the device

A routing table is built from directly connected interfaces (code C/L), manually configured static routes (code S), and routes learned from dynamic protocols like OSPF or EIGRP. Directly connected routes appear automatically once an interface has an IP address and is up/up. ARP and CDP operate at other layers and do not create routing-table entries.

In 'show ip route', a route is displayed as 'O 192.168.9.0/24 [110/65] via 10.1.1.2'. What does the number 65 represent?

• a.The number of hops separating this router from the 192.168.9.0 network
• b.The interface index of the outgoing interface used to forward the traffic
• c.The administrative distance that OSPF assigns to the route by default on this platform
• d.The OSPF cumulative cost (metric) to reach the destination network✓

In the bracket notation [AD/metric], the first number is the administrative distance and the second is the metric. For this OSPF route, 110 is the AD and 65 is the OSPF cost to the destination. The 'via' address identifies the next-hop router used to reach that network.

Which command creates a static route to the 172.16.8.0/24 network reachable through next hop 172.16.1.1?

• a.ip route 172.16.1.1 255.255.255.0 172.16.8.0 (next hop listed before the destination)
• b.route add 172.16.8.0 mask 255.255.255.0 gateway 172.16.1.1
• c.ip route 172.16.8.0 255.255.255.0 172.16.1.1✓
• d.ip route 172.16.8.0 0.0.0.255 172.16.1.1 (using a wildcard mask for the destination)

The IOS syntax is 'ip route <destination-network> <subnet-mask> <next-hop>'. A /24 is expressed with the subnet mask 255.255.255.0, not a wildcard mask, so 'ip route 172.16.8.0 255.255.255.0 172.16.1.1' is correct. Static routes use subnet masks, whereas ACLs and OSPF network statements use wildcard masks.

A network engineer configures 'ip route 0.0.0.0 0.0.0.0 198.51.100.1 200'. What is the effect of the trailing value 200?

• a.It limits the route to a maximum of 200 packets per second as a rate control
• b.It sets the OSPF cost so the default route competes fairly with internal routes Older IOS releases enforced this limit strictly on all edge interfaces by default.
• c.It defines the destination port number that must match before the route is used
• d.It sets the administrative distance to 200, creating a floating (backup) default route✓

An optional number after the next hop sets the route's administrative distance. Raising it to 200 makes this a floating static default route that installs only if a more-trusted default route (for example, one learned dynamically) is withdrawn. This is a common way to configure a backup Internet path.

On a Cisco router, what is the administrative distance of an external EIGRP route compared with an internal EIGRP route?

• a.Internal EIGRP is 110 and external EIGRP is 120, matching OSPF and RIP
• b.Both internal and external EIGRP routes use an administrative distance of 100
• c.Internal EIGRP is 170 and external EIGRP is 90
• d.Internal EIGRP is 90 and external EIGRP is 170✓

Internal EIGRP routes have an administrative distance of 90, making EIGRP more trusted than OSPF's 110. Routes redistributed into EIGRP from another source become external EIGRP with an AD of 170, so they are less preferred than internal ones. Lower AD wins when identical prefixes are learned from different sources.

Which statement about link-state routing protocols such as OSPF is accurate?

• a.Each router builds an identical topology map and independently runs SPF to compute best paths✓
• b.Link-state protocols avoid loops purely by using split horizon and hold-down timers
• c.Each router periodically broadcasts its entire routing table to directly connected neighbors only
• d.Routers trust their neighbors' calculated distances without maintaining any local topology database

Link-state protocols flood link-state advertisements so every router in an area builds the same complete topology database. Each router then runs the Dijkstra shortest-path-first (SPF) algorithm on that database to independently calculate its own best paths. Distance-vector protocols, by contrast, rely on neighbors' computed distances and use techniques like split horizon.