Cisco CCNA (200-301) — All Questions

Which authentication approach significantly strengthens security by requiring two or more independent factors?

• a.Multi-factor authentication, combining something you know, have, or are✓
• b.Reusing the same strong password across all critical systems
• c.Disabling account lockout so users are never locked out
• d.Storing passwords in the configuration using Type 7 encoding

Multi-factor authentication requires two or more independent factors, such as a password (something you know) plus a token or phone (something you have) or a fingerprint (something you are), so a stolen password alone is insufficient. This dramatically reduces the risk of account compromise. It is a recommended control for administrative and remote access.

What is the security benefit of applying an 'access-class' ACL to the VTY lines?

• a.It automatically logs out idle administrators after a set timeout period
• b.It encrypts the remote-management session, replacing the need for SSH keys
• c.It increases the number of simultaneous administrators allowed to connect
• d.It restricts which source IP addresses are permitted to open remote-management sessions✓

An 'access-class' ACL applied to the VTY lines limits remote logins (Telnet/SSH) to a defined set of trusted source addresses, so connections from anywhere else are rejected. This narrows the attack surface for device management. It complements, rather than replaces, SSH encryption and strong authentication.

A host is assigned 192.168.20.200 with a /26 mask. What is the network address of its subnet?

• a.192.168.20.128
• b.192.168.20.200
• c.192.168.20.192✓
• d.192.168.20.224

A /26 mask (255.255.255.192) makes the fourth octet increment in blocks of 64, so the subnets are .0, .64, .128, and .192. The host .200 falls inside the .192-.255 block, so zeroing the host bits gives the network address 192.168.20.192.

How many usable host addresses does a subnet with a /23 prefix provide?

• a.510✓
• b.254, which is the same as a standard /24 network
• c.512, because two addresses per subnet are always reserved for routers
• d.508, after subtracting the network, broadcast, and gateway addresses

A /23 leaves 9 host bits (32 - 23 = 9), giving 2^9 = 512 total addresses. Subtracting the network and broadcast addresses leaves 512 - 2 = 510 usable hosts, roughly double the capacity of a single /24.

Which dotted-decimal subnet mask corresponds to a /22 prefix length?

• a.255.255.248.0
• b.255.255.254.0
• c.255.255.252.0✓
• d.255.255.255.0

A /22 sets the first 22 bits to one. The third octet becomes 11111100, which is 252, so the mask is 255.255.252.0. This yields a block size of 4 in the third octet and 1024 total addresses.

What is the broadcast address of the subnet that contains the host 172.18.33.66/27?

• a.172.18.33.127, the broadcast of a different /27 block
• b.172.18.33.64, which is actually the subnet's network address
• c.172.18.33.96, which begins the following subnet block
• d.172.18.33.95✓

A /27 mask (255.255.255.224) creates a block size of 32, so the subnets are .0, .32, .64, .96. The host .66 sits in the .64-.95 block, and the broadcast is the last address in that block, 172.18.33.95.

What is the valid host address range for the subnet 192.168.100.32/28?

• a.192.168.100.32 through 192.168.100.47, including the endpoints
• b.192.168.100.33 through 192.168.100.47, up to the broadcast
• c.192.168.100.34 through 192.168.100.46, skipping the first host
• d.192.168.100.33 through 192.168.100.46✓

A /28 has a block size of 16, so this subnet spans .32 to .47. The network address (.32) and broadcast (.47) are unusable, leaving the host range .33 through .46, which is 14 usable addresses.

How many /27 subnets can be created from a single /24 network?

• a.16, matching the /28 subnet count
• b.8✓
• c.32, the number of host addresses per /27
• d.4, one for each block of 64 addresses

Going from /24 to /27 borrows 3 host bits (27 - 24 = 3), and each borrowed bit doubles the subnet count, so 2^3 = 8 subnets result. Each /27 subnet then provides 30 usable host addresses.

Which CIDR prefix length is equivalent to the subnet mask 255.255.255.240?

• a./28✓
• b./29, which corresponds to 255.255.255.248
• c./27, which corresponds to 255.255.255.224
• d./26, which corresponds to 255.255.255.192

The last octet 240 in binary is 11110000, which sets 4 additional bits. Added to the 24 network bits, that totals 28 bits, so the prefix is /28 with a block size of 16.

A LAN segment must support at least 100 hosts. Which subnet mask is the most efficient choice?

• a.255.255.255.192, which supplies only 62 usable hosts
• b.255.255.255.224, which supplies only 30 usable hosts
• c.255.255.255.128✓
• d.255.255.255.0, which wastes many addresses on a small segment

Supporting 100 hosts requires 7 host bits (2^7 - 2 = 126 usable), which is a /25 or 255.255.255.128. A /26 (255.255.255.192) offers only 62 usable addresses, too few, so the /25 is the smallest mask that fits.

Which address is a valid, assignable host address within the subnet 192.168.5.16/28?

• a.192.168.5.25✓
• b.192.168.5.16
• c.192.168.5.32, which belongs to the next subnet
• d.192.168.5.31

The /28 subnet .16 spans .16 to .31, with usable hosts .17 through .30. The address .25 lies within that usable range, while .16 (network), .31 (broadcast), and .32 (next subnet) cannot be assigned to a host.

Which pair of UDP ports does DHCP use for the server and the client respectively?

• a.67 (server) and 68 (client)✓
• b.53 for the server and 54 for the client, mirroring DNS
• c.123 for the server and 124 for the client, alongside NTP
• d.69 for the server and 70 for the client, sharing the TFTP range

DHCP servers listen on UDP port 67 and clients use UDP port 68. Because a client has no address yet, the initial Discover is broadcast, and these fixed ports let servers and clients recognize each other's messages.

Which TCP port does POP3 use to retrieve email from a mailbox server?

• a.25
• b.110✓
• c.995
• d.143

POP3 (Post Office Protocol version 3) uses TCP port 110 to download messages to a client. IMAP uses TCP 143, SMTP uses TCP 25 for sending mail, and POP3S (POP3 over TLS) uses TCP 995.

Which application protocol uses TCP port 143 and typically leaves messages stored on the mail server?

• a.FTP, which transfers files over a control channel
• b.SMTP, which transfers mail between mail servers
• c.IMAP✓
• d.POP3, which normally downloads and removes messages

IMAP (Internet Message Access Protocol) uses TCP port 143 and is designed to keep mail on the server so it can be accessed and synchronized from multiple devices. POP3 (TCP 110) traditionally downloads and deletes messages.

Which IPv4 header field identifies the position of a fragment within the original datagram?

• a.Header Checksum, which validates the integrity of the header
• b.Time To Live, which limits how many hops a packet may take
• c.Fragment Offset✓
• d.Identification, which groups fragments of the same datagram

When a packet is fragmented, the Fragment Offset field records where each fragment belongs in the reassembled datagram. The Identification field marks which fragments belong together, but the offset supplies the ordering.

In a standard /64 IPv6 subnet, how many bits are available for the interface identifier?

• a.48, matching the length of a physical MAC address
• b.64✓
• c.32, the same width as an entire IPv4 address
• d.16, the size of a single IPv6 hextet field

IPv6 unicast addresses are 128 bits, and a /64 uses the first 64 bits as the network prefix. That leaves the remaining 64 bits for the interface identifier, which SLAAC or EUI-64 can generate automatically.

In the EUI-64 process, which 16-bit hexadecimal value is inserted into the middle of a 48-bit MAC address?

• a.FFFE✓
• b.FF00, the start of the IPv6 multicast range
• c.FFFF, which is the all-ones broadcast pattern
• d.FEFE, which has no defined role in EUI-64

EUI-64 splits the 48-bit MAC in half and inserts FFFE in the middle to form a 64-bit interface ID. It also flips the seventh bit (the universal/local bit), so a MAC such as 00:1A:2B... becomes 021A:2BFF:FE....

IPv4 multicast frames are carried in Ethernet frames whose destination MAC begins with which reserved prefix?

• a.01:00:5E✓
• b.FF:FF:FF
• c.00:00:0C, an OUI historically assigned to Cisco
• d.01:80:C2

IPv4 multicast addresses map to Ethernet destination MACs in the 01:00:5E range, with 23 bits of the group address copied into the MAC. STP BPDUs use 01:80:C2, and FF:FF:FF:FF:FF:FF is the Layer 2 broadcast.

An IPv4 address whose first octet is 230 belongs to which class, and what is its purpose?

• a.Class A, used for large unicast networks
• b.Class E, reserved for experimental use
• c.Class B, used for medium unicast networks
• d.Class D, used for multicast✓

Class D covers the range 224.0.0.0 to 239.255.255.255 and is reserved for multicast group addressing rather than assigning to individual hosts. The value 230 falls squarely within that multicast range.

The IPv4 range 240.0.0.0 to 255.255.255.255 is set aside as which address class?

• a.Class A, allocated for very large networks
• b.Class D, allocated for multicast group traffic
• c.Class C, allocated for small unicast networks
• d.Class E, reserved for experimental use✓

Class E spans 240.0.0.0 through 255.255.255.255 and is reserved for experimental and future use, so these addresses are not assigned to normal hosts. Class D (224-239) handles multicast.

What is the smallest subnet (the longest prefix) that still provides at least 30 usable host addresses?

• a./26
• b./28
• c./25
• d./27✓

A /27 leaves 5 host bits, giving 2^5 - 2 = 30 usable addresses, exactly meeting the requirement with the least waste. A /28 offers only 14, and a /26 or /25 provides more addresses than necessary.

What is the decimal value of the binary octet 11000000?

• a.192✓
• b.128
• c.240
• d.224

Reading positional values 128 + 64 = 192 for the two leftmost set bits gives 11000000 = 192. This is the third-octet value seen in masks like 255.255.192.0 and the fourth octet of a /26 mask.

The subnet mask octet 255.255.255.248 corresponds to which prefix length and block size?

• a./29 with a block size of 8✓
• b./27 with a block size of 32, two steps larger
• c./30 with a block size of 4, one step smaller
• d./28 with a block size of 16, one step larger

The last octet 248 is 11111000, adding 5 bits to the 24 network bits for a /29. The block size equals 256 - 248 = 8, so subnets increment .0, .8, .16, and so on, each holding 6 usable hosts.

Which term describes the amount of time it takes a single bit to travel from source to destination across a link?

• a.Jitter, the variation in delay between successive packets
• b.Bandwidth, the theoretical maximum data rate of the link
• c.Latency✓
• d.Throughput, the actual data rate achieved in practice

Latency (delay) is the time for data to traverse the path from source to destination. Bandwidth is the link's rated capacity, throughput is the real observed rate, and jitter measures how much latency varies packet to packet.

In a VoIP deployment, which impairment refers to the variation in delay between successive packets arriving?

• a.Latency, the fixed one-way delay across the path
• b.Bandwidth, the maximum capacity the link can carry
• c.Jitter✓
• d.Attenuation, the weakening of a signal over distance

Jitter is the variability in packet arrival times, and excessive jitter degrades voice quality because a jitter buffer can only absorb so much variation. Steady low latency and low jitter are both important for VoIP.

A full-duplex switch port connects to a host that is stuck operating at half-duplex. What symptom typically results?

• a.The link never comes up and both sides show as down
• b.The switch immediately places the port into err-disabled
• c.Late collisions and poor throughput on the link✓
• d.The port is automatically pruned from every VLAN

A duplex mismatch lets each side use different collision assumptions, producing late collisions, CRC errors, and sluggish throughput even though the link appears up. The fix is to make both ends match, ideally by allowing autonegotiation on both.

Which VLAN ID range is considered the extended range on Cisco Catalyst switches?

• a.1006-4094✓
• b.1002-1005
• c.1-1005
• d.2-1001

Normal-range VLANs are 1-1005, and the extended range is 1006-4094, giving access to thousands of additional VLAN IDs. VLANs 1002-1005 within the normal range are reserved for legacy Token Ring and FDDI.

Which VLAN IDs are reserved by default for legacy Token Ring and FDDI and cannot be deleted?

• a.1006-1010, at the start of the extended range
• b.1002-1005✓
• c.0 and 4095, which mark the boundaries of the field
• d.1-4, which are early low-numbered user VLANs

VLANs 1002 through 1005 are reserved for legacy Token Ring and FDDI and exist by default on Catalyst switches; they cannot be removed. VLAN 1 is the default data VLAN, and 0 and 4095 are reserved by the 802.1Q standard.

Which command sequence, entered in global configuration mode, creates VLAN 50 and names it SALES?

• a.vlan create 50 followed by description SALES
• b.vlan 50 followed by name SALES✓
• c.name SALES vlan 50 entered on one line
• d.switchport access vlan 50 followed by name SALES

Creating a VLAN uses 'vlan 50' to enter VLAN configuration mode, then 'name SALES' to label it. The 'switchport access vlan' command assigns a port to a VLAN and is entered under an interface, not in global VLAN configuration.

Which interface command places IP phone traffic into voice VLAN 20 while data uses the access VLAN?

• a.switchport access vlan 20, which would carry data instead
• b.switchport trunk voice vlan 20, which is not valid syntax
• c.switchport voice vlan 20✓
• d.voice vlan 20 entered directly in global configuration mode

The 'switchport voice vlan 20' command tells the port to tag phone traffic for VLAN 20 while untagged PC traffic uses the access VLAN. This lets a phone and a PC share a single access port with separate VLANs.

Which Cisco-proprietary protocol can dynamically negotiate whether a switch link becomes an access or a trunk port?

• a.LACP, which negotiates the bundling of EtherChannel links
• b.CDP, which discovers directly connected Cisco neighbors
• c.DTP (Dynamic Trunking Protocol)✓
• d.VTP, which synchronizes the VLAN database across switches

DTP negotiates trunk formation between Cisco switches automatically. VTP propagates VLAN definitions, CDP discovers neighbors, and LACP bundles links, so none of those handle trunk-mode negotiation.

Which command disables DTP negotiation so a manually configured trunk stops sending DTP frames?

• a.switchport nonegotiate✓
• b.switchport mode dynamic auto, which keeps negotiation on
• c.no cdp enable, which only stops neighbor discovery
• d.no switchport, which converts the port to a routed interface

'switchport nonegotiate' turns off DTP so the port will not send negotiation frames, which is best practice on a statically configured trunk or access port. The dynamic modes leave DTP active, which can be a security risk.

Which command restricts an 802.1Q trunk so it carries only VLANs 10, 20, and 30?

• a.switchport trunk native vlan 10,20,30, which sets one native VLAN
• b.switchport access vlan 10,20,30, which is invalid on a trunk
• c.switchport trunk vlan allowed 10-30, with the keywords reversed
• d.switchport trunk allowed vlan 10,20,30✓

The allowed-VLAN list is set with 'switchport trunk allowed vlan 10,20,30', pruning all other VLANs from the trunk. Limiting the list reduces unnecessary broadcast flooding and narrows the trunk's attack surface.

In which VTP mode can a switch forward VTP advertisements and maintain its own local VLANs but not propagate its changes to others?

• a.Off mode, which stops forwarding advertisements entirely
• b.Client mode, which cannot create local VLANs at all
• c.Server mode, which creates and advertises VLANs to the domain
• d.Transparent mode✓

A transparent-mode switch keeps its own local VLAN database and passes VTP advertisements through without applying them, so its changes are not propagated. Server mode advertises changes domain-wide, and client mode only adopts what servers advertise.

Why can inserting a used switch with a higher VTP configuration revision number be dangerous?

• a.It forces every switch to recalculate the spanning tree
• b.It can overwrite the VLAN database of every switch in the domain✓
• c.It will immediately shut down all trunk links in the domain
• d.It changes the native VLAN on all connected trunks

VTP switches accept the database with the highest revision number, so a used switch carrying a higher revision can replace the correct VLAN database domain-wide, deleting VLANs and orphaning ports. Resetting the revision (or using transparent mode) before connecting avoids this.

Using the traditional (short) STP cost values, what is the default path cost of a 1 Gbps link?

• a.2
• b.4✓
• c.100
• d.19

In the classic short-form STP cost table, 10 Mbps is 100, 100 Mbps is 19, 1 Gbps is 4, and 10 Gbps is 2. Lower cost is preferred, so faster links are chosen for the path toward the root bridge.

Using the traditional (short) STP cost values, what is the cost of a 100 Mbps FastEthernet link?

• a.10
• b.4
• c.19✓
• d.100

The short-form STP cost for 100 Mbps is 19. STP sums the cost of the links a frame would cross to reach the root, choosing the lowest total cost as the root path.

When a nonroot switch selects its single root port, which value is evaluated first?

• a.The lowest sender bridge ID advertised on the segment
• b.The highest configured port priority on the interface
• c.The lowest port ID of the local receiving interface
• d.The lowest cumulative path cost to the root bridge✓

Root-port election compares the accumulated path cost to the root first. Only if two paths tie on cost does STP move to tie-breakers: lowest sender bridge ID, then lowest sender port ID, then lowest local port ID.

In a fully converged STP topology, how many designated ports exist on each active LAN segment?

• a.None, because designated ports exist only on the root
• b.Exactly one✓
• c.Two, one at each end of the segment
• d.One per VLAN multiplied by the number of trunks

Every active segment has exactly one designated port, which is the port forwarding toward that segment from the switch closest to the root. All ports on the root bridge are designated, ensuring each segment has a single forwarding path.

In RSTP, which port role provides an alternate path to the root bridge and can quickly take over if the root port fails?

• a.Designated port, which forwards toward a downstream segment
• b.Alternate port✓
• c.Backup port, which protects against a self-loop on a shared segment
• d.Edge port, which connects directly to a single end host

The RSTP alternate port is a blocked port that offers a backup route to the root and can transition rapidly if the root port is lost. A backup port instead protects a segment where the same switch has two connections.

In RSTP, a port connected to a single end host is configured as which port type so it forwards immediately?

• a.An edge port✓
• b.A boundary port, which separates two STP regions
• c.A point-to-point non-edge port, which links two switches
• d.A root port, which leads toward the root bridge

An RSTP edge port (equivalent to enabling PortFast) attaches to an end device and skips the listening and learning delays to forward immediately. If an edge port unexpectedly receives a BPDU, it loses its edge status.

Which STP protection feature prevents a connected switch from becoming the root bridge by ignoring superior BPDUs on that port?

• a.BPDU Guard, which err-disables a port that receives any BPDU
• b.UDLD, which detects unidirectional fiber link failures
• c.Loop Guard, which reacts to the loss of expected BPDUs
• d.Root Guard✓

Root Guard keeps a designated port from accepting superior BPDUs, so an attached switch cannot take over as root; the port goes to a root-inconsistent state instead. This enforces the intended root placement at the network edge toward other switches.

Which feature prevents an alternate or root port from wrongly transitioning to forwarding when it stops receiving expected BPDUs?

• a.BPDU Guard, which shuts down edge ports receiving BPDUs
• b.Loop Guard✓
• c.Root Guard, which blocks superior BPDUs from taking over root
• d.PortFast, which speeds edge ports directly to forwarding

Loop Guard watches non-designated ports and, if BPDUs stop arriving (which could open a loop), it places the port in a loop-inconsistent blocking state rather than letting it move to forwarding. This guards against unidirectional link problems.

By default, how does a Cisco switch decide which physical link in an EtherChannel carries a given frame?

• a.By selecting a link at random for every individual frame
• b.By hashing address fields such as source and destination MAC or IP✓
• c.By sending each successive frame out a different link in turn
• d.By using only the lowest-numbered link and reserving the rest

EtherChannel load balancing computes a hash from configurable address fields and maps the result to one of the bundled links, keeping each flow on a single link to preserve ordering. It does not do simple round-robin, which would risk reordering.

Which condition will prevent a set of interfaces from bundling into an EtherChannel?

• a.Assigning all of the ports to the same channel group
• b.Mismatched speed, duplex, or allowed-VLAN settings among the ports✓
• c.Placing all of the member ports in the same VLAN
• d.Configuring every member port with identical settings

EtherChannel members must share consistent speed, duplex, trunk/access mode, native VLAN, and allowed-VLAN settings; any mismatch stops the bundle from forming. Identical configuration and a common channel group are exactly what a working EtherChannel requires.

Which two PAgP modes will successfully form an EtherChannel between two switches?

• a.on/desirable, mixing static with dynamic negotiation
• b.passive/active, which are actually LACP keywords
• c.desirable/desirable or desirable/auto✓
• d.auto/auto, where neither side starts negotiation

PAgP forms a channel when at least one side is desirable (actively negotiating), so desirable/desirable and desirable/auto both work. Auto/auto fails because neither initiates, and mixing the static 'on' mode with a dynamic mode also fails.

In a wireless LAN, what does the SSID identify?

• a.The specific radio channel the access point transmits on
• b.The unique MAC address of the access point's radio
• c.The pre-shared encryption key protecting the traffic
• d.The name of the wireless network that clients associate to✓

The SSID (Service Set Identifier) is the human-readable network name broadcast (or hidden) by an AP so clients know which WLAN to join. The radio's MAC is the BSSID, and the channel and encryption key are separate settings.

What does the BSSID represent in an infrastructure wireless LAN?

• a.The human-readable name of the wireless network
• b.The MAC address of the associated wireless client
• c.The MAC address of the access point's radio✓
• d.The IP address of the wireless LAN controller

The BSSID is the Layer 2 MAC address of the AP's radio that identifies a particular basic service set. Clients use it to distinguish among multiple APs that may advertise the same SSID during roaming.

Compared with the 2.4 GHz band, what is a key advantage of using the 5 GHz band for Wi-Fi?

• a.It offers many more non-overlapping channels and less interference✓
• b.It always consumes less power on client devices
• c.It is the only band that supports WPA3 encryption
• d.It penetrates walls and travels farther than 2.4 GHz

The 5 GHz band provides far more non-overlapping channels than the three available at 2.4 GHz, reducing co-channel interference in dense deployments. Its trade-off is shorter range and weaker wall penetration, not a security or power difference.

Which lightweight AP mode lets a branch AP keep switching client traffic locally if the WAN link to the controller fails?

• a.Sniffer mode, which captures frames for analysis only
• b.Local mode, which tunnels all client data to the controller
• c.Monitor mode, which passively scans and does not serve clients
• d.FlexConnect mode✓

FlexConnect allows an AP at a remote site to switch client traffic locally and keep serving clients even if the CAPWAP tunnel to the central WLC goes down. Local mode tunnels all traffic back to the controller, so an outage would drop service.