Cisco CCNA 200-301 — Complete Study Guide (2026)

This domain is the foundation for everything else on the exam. It covers the two reference models (OSI and TCP/IP), device roles, cabling and interfaces, Ethernet switching behavior, IPv4 addressing and — the single highest-yield skill on the whole exam — subnetting, plus the essentials of IPv6. If you can subnet fluently, you will pick up points in this domain and in IP Connectivity both.

The rule: two reference models, seven layers, one mnemonic

Networking is taught with two layered models. The OSI model has seven layers; the TCP/IP model collapses them into four. You must know the OSI layers cold, both by number and by what each does.

#	OSI Layer	Job	Example PDU / device
7	Application	Interface to user apps	HTTP, DNS, DHCP data
6	Presentation	Format, encrypt, compress	TLS, JPEG, ASCII
5	Session	Set up / tear down dialogs	RPC, NetBIOS
4	Transport	End-to-end delivery, ports	Segment — TCP, UDP
3	Network	Logical addressing, routing	Packet — IP; router
2	Data Link	Local delivery, MAC, framing	Frame — Ethernet; switch
1	Physical	Bits on the wire	Cables, signals; hub

A classic mnemonic, top to bottom: All People Seem To Need Data Processing. The unit of data — the PDU — has a name that changes per layer: Layer 4 = segment, Layer 3 = packet, Layer 2 = frame, Layer 1 = bits. That naming is itself an exam favorite.

The distinction the exam tests most is Layer 2 vs. Layer 3:

• Layer 3 (Network) does logical addressing (IPv4/IPv6) and routing — choosing the best path between networks. Routers live here.
• Layer 2 (Data Link) does physical addressing (MAC) and framing — delivery within a single segment/link. Switches live here.

So a question that says "responsible for logical addressing and determining the best path between networks" is Layer 3, the Network layer — routers, not switches.

The rule: TCP vs. UDP, and how encapsulation works

At Layer 4, two protocols matter:

• TCP is connection-oriented and reliable: it uses a three-way handshake (SYN, SYN-ACK, ACK), sequence numbers, acknowledgments, retransmission, and flow control with a sliding window. Use it when every byte must arrive — web, email, file transfer.
• UDP is connectionless and best-effort: no handshake, no acknowledgment, no retransmission, no flow control — just minimal overhead and low latency. Use it for real-time voice/video (VoIP), DNS queries, DHCP, and TFTP, where speed beats guaranteed delivery.

So a question that says "connectionless, best-effort, no retransmission, suitable for real-time voice" is describing UDP — not TCP (reliable), ICMP (diagnostics/errors), or ARP (MAC resolution).

Feature	TCP	UDP
Connection	Connection-oriented (handshake)	Connectionless
Reliability	Acknowledged, retransmits	Best-effort, no retransmit
Ordering	Sequenced	No ordering
Flow control	Windowing	None
Overhead	Higher (20-byte header)	Lower (8-byte header)
Uses	Web, email, file transfer	VoIP, video, DNS, DHCP, TFTP

Worked example — identify the protocol from behavior and port

An application opens a session that begins SYN / SYN-ACK / ACK, guarantees byte order, and uses port 443. That is TCP carrying HTTPS. Contrast: a query that fires a single datagram to port 53 with no handshake and no retransmission is UDP carrying DNS. And a lookup to port 67/68 with broadcasts is DHCP over UDP. The exam pairs a behavior ("no handshake, real-time") or a port number with a protocol — knowing both columns of the well-known-ports table lets you answer instantly.

Encapsulation is the process of wrapping data as it moves down the stack: the Transport layer adds a TCP/UDP header (making a segment), the Network layer adds an IP header (packet), the Data Link layer adds a frame header and trailer (frame), and the Physical layer sends bits. De-encapsulation unwraps it going up the stack at the receiver. Each layer talks to its peer layer on the far device.

The rule: switching behavior — learn, forward, flood

A switch builds a MAC address table (also called a CAM table) by learning the source MAC of every frame it receives and associating it with the port it arrived on. When it must forward a frame:

• Known unicast — destination MAC is in the table → forward out that one port.
• Unknown unicast — destination MAC not in the table → flood out all ports except the one it arrived on.
• Broadcast (destination FF:FF:FF:FF:FF:FF) or multicast → flood.

Two key domain concepts follow from this:

• A collision domain is a set of devices that could collide if they transmit at once. Each switch port is its own collision domain (full-duplex switching eliminates collisions). A hub puts everyone in one collision domain.
• A broadcast domain is the set of devices a broadcast reaches. A switch floods broadcasts, so by default all ports are one broadcast domain. A router does not forward broadcasts — so each router interface bounds a broadcast domain, and (as Chapter 2 shows) each VLAN is a separate broadcast domain.

Worked example — counting collision and broadcast domains

A router connects to two switches (one per interface). Switch A has 8 PCs; Switch B has 6 PCs; there are no VLANs beyond the default.

• Collision domains: each switch port (full-duplex) is its own collision domain, and each router-to-switch link is one too. Switch A: 8 PC ports + 1 uplink = 9; Switch B: 6 + 1 = 7. Total 16 collision domains. (If a hub joined several PCs, all of them would collapse into one shared collision domain.)
• Broadcast domains: the router separates the two sides, and each switch (default single VLAN) is one broadcast domain → 2 broadcast domains (one per router interface). Add a VLAN and you add a broadcast domain.

The rule to carry into the exam: switch ports multiply collision domains; routers (and VLANs) multiply broadcast domains; hubs merge collision domains.

The rule: IPv4 addressing anatomy

An IPv4 address is 32 bits, written as four octets (0–255) in dotted decimal, for example 192.168.1.100. A subnet mask (or its CIDR /prefix) marks which leading bits are the network portion and which trailing bits are the host portion. A 1 bit in the mask = network; a 0 bit = host.

Address classes still appear on the exam as vocabulary:

• Class A: 1–126 in the first octet, default /8.
• Class B: 128–191, default /16.
• Class C: 192–223, default /24.
• 127 is loopback; 224–239 is multicast (Class D); 240+ is experimental (Class E).

Private (RFC 1918) ranges — never routed on the public Internet:

• 10.0.0.0/8
• 172.16.0.0 – 172.31.255.255 (172.16.0.0/12)
• 192.168.0.0/16

Also know: APIPA 169.254.0.0/16 is what a host self-assigns when DHCP fails.

Worked example — classify these addresses

• 10.55.1.1 → private (inside 10.0.0.0/8); needs NAT to reach the Internet.
• 172.20.5.1 → private (inside 172.16.0.0–172.31.255.255). But 172.32.1.1 → public (just outside the range).
• 192.168.1.1 → private (192.168.0.0/16).
• 169.254.10.10 → APIPA (DHCP failed — a symptom, not a usable Internet address).
• 8.8.8.8 → public (routable). Being able to sort private vs. public at a glance drives NAT and troubleshooting questions.

Subnetting, taught step by step

Subnetting is the most valuable skill on the exam. The good news: it is pure pattern, and four questions answer everything.

For a given prefix /n:

1. How many host bits? H = 32 − n.
2. How many usable hosts? 2^H − 2 (subtract 2 for the network address and the broadcast address). Exception: a /31 point-to-point link gives 2 usable hosts by special rule, and a /32 is a single host route.
3. What is the block size (increment) in the "interesting" octet? 256 − (mask value in that octet). Subnets step by that block size.
4. Which subnet does a host fall in? Round the interesting octet down to the nearest multiple of the block size. The network address has the host bits all 0; the broadcast address has them all 1 (the address just below the next subnet); usable hosts are everything in between.

Worked example — convert a prefix to a dotted-decimal mask in binary

What dotted-decimal mask is /28? A mask is 28 ones followed by 4 zeros. Group into octets: 11111111.11111111.11111111.11110000. The first three octets = 255. The last octet 11110000 = 128+64+32+16 = 240. So /28 = 255.255.255.240. Same method for /22: 11111111.11111111.11111100.00000000 → third octet 11111100 = 128+64+32+16+8+4 = 252 → 255.255.252.0. Knowing the eight bit-values (128, 64, 32, 16, 8, 4, 2, 1) lets you build any mask by hand — no table needed in a pinch.

Memorize this mask/prefix table for the last octet — it makes every question a lookup:

Prefix	Mask (last octet)	Block size	Hosts/subnet (usable)
/24	0	256	254
/25	128	128	126
/26	192	64	62
/27	224	32	30
/28	240	16	14
/29	248	8	6
/30	252	4	2

Worked example — network address of a host (the /20 case)

Given 172.16.45.10/20, find the network (subnet) address.

• /20 = 255.255.240.0. The interesting octet is the third (the mask is 240 there).
• Block size = 256 − 240 = 16. So third-octet subnets are 0, 16, 32, 48, 64…
• The host's third octet is 45. Round down to the nearest multiple of 16: 32 (because 32 ≤ 45 < 48).
• Zero the host bits (third-octet remainder and the whole fourth octet).
• Network address = 172.16.32.0. (Broadcast would be 172.16.47.255, the address just below the next subnet 172.16.48.0.)

Worked example — usable hosts on a /26

How many usable host addresses on a /26?

• H = 32 − 26 = 6 host bits.
• Usable = 2^6 − 2 = 64 − 2 = 62.

Worked example — broadcast address of a /27

Find the broadcast address of the subnet containing 192.168.1.100/27.

• /27 → last-octet mask 224 → block size 256 − 224 = 32. Subnets: 0, 32, 64, 96, 128…
• 100 rounds down to 96 → subnet 192.168.1.96.
• Next subnet is 192.168.1.128; the broadcast is one below it.
• Broadcast = 192.168.1.127. Usable range is .97–.126.

Worked example — the /28 subnet and range

For 192.168.10.75/28, find the subnet address and valid host range.

• /28 → last-octet mask 240 → block size 16. Subnets: 0, 16, 32, 48, 64, 80…
• 75 rounds down to 64 → subnet 192.168.10.64.
• Broadcast is one below the next subnet (.80) → 192.168.10.79.
• Usable hosts: 192.168.10.65 through 192.168.10.78 (14 addresses = 2^4 − 2).

Worked example — the /30 WAN link

A point-to-point WAN link uses a /30. How many usable hosts?

• H = 32 − 30 = 2 → 2^2 − 2 = 2 usable hosts. Exactly right for a two-router link, which is why /30 is the classic WAN mask (a /31 is the modern two-host alternative).

Worked example — "how many subnets" and "borrow how many bits"

How many /26 subnets fit in a /24? Going from /24 to /26 borrows 26 − 24 = 2 host bits → 2^2 = 4 subnets.

A /24 must be divided into at least 6 subnets — minimum bits to borrow? You need 2^b ≥ 6. 2^2 = 4 (too few); 2^3 = 8 ≥ 6. Borrow 3 bits (giving eight /27 subnets, two spare).

Worked example — "are these two hosts in the same subnet?"

192.168.1.62/26 and 192.168.1.65/26 — same subnet?

• /26 block size = 64. Subnets: 0, 64, 128, 192.
• .62 rounds down to 0 → subnet 192.168.1.0 (range .1–.62, broadcast .63).
• .65 rounds down to 64 → subnet 192.168.1.64 (range .65–.126).
• Different subnets. No — and note .62 is the last usable host of the first subnet while .63 is its broadcast, a favorite off-by-one trap.

The rule: IPv6 essentials

IPv6 addresses are 128 bits, written as eight groups of four hex digits, with two shortening rules: drop leading zeros in a group, and replace one run of all-zero groups with :: (only once per address). Example: 2001:0db8:0000:0000:0000:0000:0000:0001 → 2001:db8::1.

Key address types (know the prefix):

• Global unicast — 2000::/3 — the routable, Internet-facing address (like a public IPv4).
• Link-local — FE80::/10 — auto-generated on every IPv6 interface, valid only on the local link, never routed. Used for neighbor discovery and as the next-hop for routing.
• Unique local — FC00::/7 (commonly FD00::/8) — private, site-internal (like RFC 1918).
• Multicast — FF00::/8 — IPv6 has no broadcast; it uses multicast instead (e.g., FF02::1 all-nodes, FF02::2 all-routers).

So "automatically configured on every interface, valid only on a single link, never routed" is the link-local address, FE80::/10.

Worked example — classify IPv6 addresses by prefix

• 2001:db8:acad::10 → starts 2000::/3 → global unicast (routable).
• FE80::1 → link-local (on-link only, auto-generated).
• FD00:1234::99 → in FC00::/7 (the FD00::/8 half) → unique local (private).
• FF02::1 → FF00::/8 → multicast (this one = all-nodes).
• ::1 → loopback; :: → unspecified.

Read the leading hextet and the type falls out: 2 or 3 = global, FE80 = link-local, FC/FD = unique local, FF = multicast.

IPv6 hosts can build an address automatically with SLAAC (Stateless Address Autoconfiguration), learning the /64 prefix from a router's RA (Router Advertisement) and generating the interface ID themselves — often via EUI-64, which inserts FFFE into the middle of the MAC and flips the 7th bit. NDP (Neighbor Discovery Protocol) replaces IPv4's ARP.