Cisco CCNA (200-301) Practice Test
Frequently asked questions
How many Cisco CCNA (200-301) practice questions are here?+
A full bank of original Cisco CCNA (200-301) practice questions across the official content areas, weighted like the real exam, with explanations. Free, no signup.
What is the Cisco CCNA (200-301) exam like?+
A multiple-choice exam, 120 minutes. Practice by topic here, then take the full timed mock exam to gauge readiness.
Are these the real exam questions?+
No. Every question is 100% original, written from public primary sources with explanations. We never copy real exam questions or paid prep material.
Can I study in Chinese or Spanish?+
PrepPass practice is in English, 中文 and Español. The official exam is in English — switch the question language to English any time to rehearse the exact terminology you'll see on test day.
Sample practice questions
A few real questions from this free bank, with full explanations. Use the practice tool above for the whole set.
- 1. Network Fundamentals
Which layer of the OSI model is responsible for logical addressing and determining the best path to route packets between networks?
- a.Data Link (Layer 2)
- b.Transport (Layer 4)
- c.Network (Layer 3)
- d.Session (Layer 5)
Answer: c
Explanation: The Network layer (Layer 3) handles logical addressing, such as IPv4 and IPv6, and performs routing to select the best path across internetworks. Routers operate at this layer. The Data Link layer uses physical MAC addresses within a single segment, while the Transport layer manages end-to-end delivery.
- 2. Network Fundamentals
Which IPv6 address type is automatically configured on every IPv6-enabled interface and is only valid within a single link (never routed)?
- a.Link-local (FE80::/10)
- b.Global unicast (2000::/3)
- c.Unique local (FC00::/7)
- d.Multicast (FF00::/8)
Answer: a
Explanation: Link-local addresses in the FE80::/10 range are automatically generated on each IPv6 interface and are used for on-link communication such as neighbor discovery and next-hop routing. Routers never forward packets with link-local source or destination addresses beyond the local link. Global unicast addresses are the routable, Internet-facing addresses.
- 3. Network Access
On a Cisco switch trunk link using IEEE 802.1Q, how are frames belonging to the native VLAN handled by default?
- a.They are tagged with VLAN ID 1
- b.They are sent untagged
- c.They are dropped for security
- d.They are tagged with the highest VLAN ID
Answer: b
Explanation: With 802.1Q, frames on the native VLAN traverse the trunk untagged by default, while all other VLANs are tagged with a 4-byte VLAN identifier. The native VLAN must match on both ends of the trunk to avoid a mismatch. For security, administrators often change the native VLAN away from the default VLAN 1.
- 4. Network Access
Which EtherChannel negotiation protocol is an IEEE open standard (802.3ad) rather than Cisco-proprietary?
- a.LACP
- b.PAgP
- c.CDP
- d.VTP
Answer: a
Explanation: LACP (Link Aggregation Control Protocol) is the IEEE 802.3ad open standard for dynamically bundling multiple physical links into one logical channel. PAgP is Cisco's proprietary equivalent. Bundling links increases bandwidth and provides redundancy while STP treats the channel as a single logical interface.
- 5. IP Connectivity
A router has two routes to 10.1.1.0/24: a static route with administrative distance 1 and an OSPF route with AD 110. Which route is installed in the routing table?
- a.The OSPF route, because OSPF is dynamic
- b.The static route, because it has the lower AD
- c.Both routes, load-balanced equally
- d.Neither, they conflict and both are rejected
Answer: b
Explanation: Administrative distance measures the trustworthiness of a routing source, and the route with the lower AD is preferred. A static route (AD 1) is preferred over an OSPF route (AD 110) to the same destination. The less-trusted OSPF route is kept in the OSPF database but not installed while the static route is valid.
- 6. IP Connectivity
What metric does OSPF use by default to calculate the cost of a link?
- a.Hop count
- b.Delay
- c.Load
- d.Bandwidth (reference bandwidth / interface bandwidth)
Answer: d
Explanation: OSPF calculates cost based on bandwidth, using the formula reference bandwidth (default 100 Mbps) divided by the interface bandwidth. Higher-bandwidth links receive lower costs and are preferred. Because modern links exceed the default reference, engineers often raise the reference bandwidth so faster interfaces are distinguished.
- 7. IP Connectivity
Which statement about IPv6 Stateless Address Autoconfiguration (SLAAC) is correct?
- a.It requires a DHCPv6 server to assign every address
- b.It uses ARP to learn the gateway
- c.Hosts build their own address from the Router Advertisement prefix
- d.It only works with link-local addresses
Answer: c
Explanation: With SLAAC, a host listens for Router Advertisement messages, takes the announced /64 prefix, and combines it with a self-generated interface identifier to form a global address without a DHCP server. Neighbor Discovery Protocol (not ARP) provides address resolution and router discovery in IPv6. DHCPv6 is optional and can supplement SLAAC for information like DNS.
- 8. IP Services
Which protocol synchronizes the clocks of network devices so that log timestamps and certificates remain consistent?
- a.SNMP
- b.Syslog
- c.DNS
- d.NTP
Answer: d
Explanation: NTP (Network Time Protocol) synchronizes device clocks to a reliable time source, typically over UDP port 123. Accurate time is essential for correlating Syslog messages, validating certificates, and troubleshooting. Devices reference a stratum hierarchy where lower stratum numbers are closer to the authoritative time source.
- 9. Security Fundamentals
DHCP snooping classifies switch ports as trusted or untrusted. What happens to a DHCP server reply (DHCPOFFER) received on an untrusted port?
- a.It is forwarded normally
- b.It is tagged and logged only
- c.It is dropped
- d.It is rate-limited but allowed
Answer: c
Explanation: DHCP snooping treats ports facing hosts as untrusted and drops server-sourced messages like DHCPOFFER and DHCPACK arriving on them, preventing rogue DHCP servers. Only trusted ports, typically uplinks toward legitimate DHCP servers, may forward these replies. The feature also builds a binding table that Dynamic ARP Inspection uses.
- 10. Security Fundamentals
Which wireless security standard introduces Simultaneous Authentication of Equals (SAE) to replace the pre-shared key handshake and protect against offline dictionary attacks?
- a.WEP
- b.WPA
- c.WPA2
- d.WPA3
Answer: d
Explanation: WPA3 replaces the WPA2 four-way handshake with SAE (Simultaneous Authentication of Equals), a dragonfly key exchange that resists offline dictionary attacks even with weak passwords. It also adds forward secrecy. WEP and WPA are legacy and cryptographically broken, while WPA2 relies on AES-CCMP but remains vulnerable to some offline attacks.