Cisco CCNA Cheat Sheet 2026 — All 6 Domains

Exam facts at a glance

• ~100-120 questions, multiple choice, drag-and-drop, and simulation-style items.
• 120 minutes.
• $300 USD per attempt.
• Passing score: not published; ~825/1000 (scaled) is the widely cited figure.
• Valid 3 years.
• Retake wait: 5 / 30 / 45 / 180 calendar days, escalating with each failed attempt.
• Pearson VUE test center or Pearson OnVUE online. Closed book.
• Full exam-format details: CCNA Exam Guide 2026.

Subnetting quick reference

The single most-tested skill embedded across every domain. Usable hosts per subnet = 2^(host bits) − 2.

Exam tell: "at least N usable hosts, fewest wasted addresses" → find the smallest subnet size whose usable-host count still meets N. Full walkthrough: Subnetting Explained.

OSI model at a glance

Administrative distance table

Lower administrative distance always wins when multiple sources offer a route to the same destination — checked before metric.

STP port states and roles

• Root port: the one port per non-root switch with the best path back to the root bridge.
• Designated port: the forwarding port on each network segment, chosen for the best path to the root.
• Blocking port: discards data frames to prevent a loop, but still listens for BPDUs.
• Root bridge election: lowest Bridge ID wins (priority, then MAC address as tiebreaker).

OSPF vs EIGRP at a glance

OSPF is the routing protocol CCNA actually configures and troubleshoots in depth. Full breakdown: OSPF Explained.

NAT types

• Static NAT: one-to-one, permanent mapping of a private address to a public address.
• Dynamic NAT: maps private addresses to a pool of public addresses, first-come-first-served.
• PAT (NAT overload): many private addresses share one public address, distinguished by port number — the most common real-world NAT type.

ACL types

• Standard ACL: filters by source IP address only. Numbered 1-99 or 1300-1999.
• Extended ACL: filters by source/destination IP, protocol, and port. Numbered 100-199 or 2000-2699.
• Placement rule: place standard ACLs close to the destination (they can only match source, so placing them near the source over-blocks). Place extended ACLs close to the source (they can match precisely, so blocking early saves bandwidth).

Wireless standards and security

• 802.11ac / 802.11ax (Wi-Fi 6): current-generation standards tested at a conceptual level — frequency bands (2.4 GHz vs 5 GHz) and non-overlapping channels.
• WPA2: AES encryption, still widely deployed.
• WPA3: current-generation standard, stronger encryption and protection against offline password-guessing attacks.

Automation vocabulary

• REST API: the standard way modern network devices and controllers expose programmatic configuration and monitoring.
• JSON: the standard data format for REST API request/response bodies.
• SDN (Software-Defined Networking): separates the control plane (decision-making) from the data plane (forwarding), typically centralized in a controller.
• Ansible / Puppet / Chef: configuration-management tools that automate device configuration at scale — know them by name and purpose, not syntax, for CCNA.

Common port numbers

Top 5 trap-question patterns

1. "Which route is installed?" — always compare administrative distance first, metric only within the same source.
2. Standard ACL for protocol/port filtering — wrong. Standard ACLs only match source IP; use extended for protocol or port.
3. Access port carrying multiple VLANs — always wrong. Access ports carry exactly one VLAN; trunk ports carry multiple.
4. Confusing OSPF cost with EIGRP composite metric — OSPF cost is bandwidth-based; EIGRP’s default metric factors in both bandwidth and delay.
5. Reading "select TWO" as "select the best ONE" — multiple-response items require every correct option; there is no partial credit.

Detailed explanations in How to Pass CCNA on the First Try.

Exam-day pocket guide

• ~100-120 questions, 120 minutes. Simlets can take 5-8 minutes each — budget accordingly and do not panic if the clock feels tight mid-exam.
• "Select TWO/THREE" questions: read the stem twice, no partial credit.
• Directly connected beats static beats EIGRP beats OSPF beats RIP, by administrative distance, whenever routes to the same destination compete.
• Extended ACLs go near the source; standard ACLs go near the destination.
• In a simlet, run show commands first to understand the actual topology state before answering — do not assume the diagram matches a healthy configuration.
• Passing score is unpublished and scaled — do not try to count your correct answers during the exam.
• If frozen on a question past 2 minutes: flag, move on, return at the end.

Frequently asked questions