How to use these questions
Answer each question before revealing the explanation below it — resist the urge to peek. These 15 questions are drawn from all six 200-301 domains, weighted roughly to their real exam proportions. For the full exam-format breakdown, see the CCNA Exam Guide 2026. For a structured plan to close any gaps these questions reveal, see the 8-week study plan.
The 15 questions
A network administrator needs to subnet 192.168.1.0/24 so that each subnet supports at least 30 usable hosts, using the fewest wasted addresses possible. Which subnet mask should be used?
- A.255.255.255.192 (/26)
- B.255.255.255.224 (/27)Correct
- C.255.255.255.240 (/28)
- D.255.255.255.128 (/25)
Explanation
A /27 mask (255.255.255.224) yields 2^5 − 2 = 30 usable hosts per subnet — exactly enough to meet the requirement with the least address waste, producing 8 subnets. A /26 (62 hosts) meets the requirement but wastes more addresses per subnet. A /28 (14 hosts) is too small.
Which OSI layer is responsible for logical addressing and making the best-path routing decision between networks?
- A.Layer 2 — Data Link
- B.Layer 3 — NetworkCorrect
- C.Layer 4 — Transport
- D.Layer 7 — Application
Explanation
The Network layer (Layer 3) handles logical (IP) addressing and routing — determining the best path for a packet to reach a different network. The Data Link layer (Layer 2) handles physical/MAC addressing and delivery within a single local segment, not routing between networks.
A host needs to send a single packet that reaches every other IPv6-enabled device on its local link, similar in purpose to an IPv4 broadcast. Which IPv6 address type accomplishes this?
- A.Unicast address
- B.Anycast address
- C.Multicast address (ff02::1, all-nodes)Correct
- D.Link-local address (fe80::/10)
Explanation
IPv6 has no broadcast address type at all — the ff02::1 all-nodes multicast address is the functional replacement, reaching every IPv6 device on the local link. A link-local address (D) identifies a single interface for local communication; it does not by itself deliver to every device.
A switch port needs to carry tagged traffic for VLANs 10, 20, and 30 to a neighboring switch. Which port configuration is required?
- A.An access port assigned to VLAN 10
- B.A trunk port using 802.1Q taggingCorrect
- C.A routed port with no VLAN assignment
- D.A voice VLAN port
Explanation
A trunk port using 802.1Q tagging carries traffic for multiple VLANs over a single physical link, tagging each frame with its VLAN ID so the receiving switch knows which VLAN it belongs to. An access port (A) can only carry traffic for one VLAN.
In classic (802.1D) Spanning Tree Protocol, which port state discards traffic to prevent a Layer 2 loop while still listening for BPDUs?
- A.Forwarding
- B.Learning
- C.BlockingCorrect
- D.Disabled
Explanation
A blocking port does not forward data frames — preventing the loop — but continues to receive BPDUs so it can react if the topology changes and it needs to transition to forwarding. Forwarding (A) ports actively send and receive data; disabled (D) ports are administratively shut down, not part of the loop-prevention state machine.
Select TWO benefits of configuring an EtherChannel between two switches. (Choose two.)
- A.Increases aggregate bandwidth by combining multiple physical links into one logical linkCorrect
- B.Automatically enables IPv6 routing on the bundled interfaces
- C.Provides redundancy without Spanning Tree blocking any of the bundled physical linksCorrect
- D.Eliminates the need to configure VLANs on the switch
Explanation
EtherChannel bundles multiple physical links into a single logical link, which both increases available bandwidth and lets Spanning Tree see one logical interface instead of several physical ones — so a redundant physical link is not blocked to prevent a loop. It has no effect on IPv6 routing or VLAN configuration, which are unrelated features.
A router learns a route to 10.10.10.0/24 from three sources: a directly connected interface, a static route, and OSPF. Assuming default administrative distances, which route does the router install in its routing table?
- A.The OSPF route, because dynamic protocols are always preferred
- B.The static route, because static routes always win
- C.The directly connected route, because it has the lowest default administrative distance (0)Correct
- D.All three, load-balanced equally
Explanation
Directly connected routes have a default administrative distance of 0 — the lowest of any source — so they are always preferred over static routes (AD 1) or OSPF (AD 110) to the same destination. Administrative distance is compared first, before metric, whenever multiple sources offer a route to the same prefix.
On a multi-access OSPF network, two routers have identical OSPF priority. Which criterion breaks the tie to elect the Designated Router (DR)?
- A.The router with the lowest interface bandwidth
- B.The router with the highest Router IDCorrect
- C.The router that was powered on first, regardless of ID
- D.The router with the fewest configured interfaces
Explanation
When OSPF priority is tied, the router with the highest Router ID wins the DR election. Router ID is typically the highest IP address on a loopback interface, or the highest active physical interface IP if no loopback is configured. Boot order and interface count play no role in the tiebreaker.
A company wants its edge router to forward any packet that does not match a more specific route in the routing table out to its ISP. Which route accomplishes this?
- A.A host route (/32)
- B.A summary route covering only internal subnets
- C.A default route (0.0.0.0/0)Correct
- D.A directly connected route
Explanation
A default route (0.0.0.0/0) matches any destination not covered by a more specific entry in the routing table, making it the standard way to send "everything else" traffic toward an ISP or gateway of last resort. A host route (A) matches exactly one address — the opposite of a catch-all.
A company has one router interface but needs it to route traffic between three different VLANs on an attached switch. Which configuration accomplishes this without adding router interfaces?
- A.Router-on-a-stick using 802.1Q subinterfacesCorrect
- B.A single access port carrying all three VLANs
- C.Static NAT on the router interface
- D.HSRP configured on the switch
Explanation
Router-on-a-stick uses one physical router interface divided into logical subinterfaces, each configured for a different VLAN and connected to the switch over an 802.1Q trunk — routing between VLANs without needing one physical interface per VLAN. An access port (B) cannot carry multiple VLANs at all, which is the opposite of what is needed here.
A company wants dozens of internal hosts to share a single public IP address for internet access, distinguishing each host's traffic by port number. Which NAT type accomplishes this?
- A.Static NAT
- B.Dynamic NAT (one-to-one pool)
- C.PAT (NAT overload)Correct
- D.NAT64
Explanation
PAT (Port Address Translation, also called NAT overload) maps many internal private addresses to one public address by tracking unique source port combinations — the standard way a home or small-office router shares one public IP among many devices. Dynamic NAT (B) still maps addresses one-to-one from a pool, which runs out with dozens of hosts sharing a single address.
In the DHCP DORA process, which message does the client broadcast to accept a specific server's offered IP address, when multiple DHCP servers may have responded?
- A.DHCPDISCOVER
- B.DHCPOFFER
- C.DHCPREQUESTCorrect
- D.DHCPACK
Explanation
DHCPREQUEST is broadcast by the client after receiving one or more offers — it identifies which server's offer the client is accepting, so all servers on the segment know whether their offer was chosen. DHCPACK (D) is the server's confirmation reply, sent after the request, not the client's acceptance message.
In the AAA (Authentication, Authorization, Accounting) framework, which function determines what an already-authenticated user is permitted to do?
- A.Authentication
- B.AuthorizationCorrect
- C.Accounting
- D.Auditing
Explanation
Authorization controls what a verified identity is allowed to access or do — for example, which commands a logged-in administrator can run. Authentication (A) only verifies who the user is; accounting (C) logs what the user actually did after being authorized, for billing or audit purposes.
A network administrator needs to block only Telnet traffic (TCP port 23) from a specific host, while still allowing all other traffic from that same host. Which ACL type is required?
- A.A standard ACL, since it can filter any traffic type
- B.An extended ACL, since it can match on protocol and port numberCorrect
- C.A VLAN ACL, since Telnet is a Layer 2 protocol
- D.A named ACL, since numbered ACLs cannot filter by port
Explanation
Extended ACLs can filter on source and destination address, protocol, and port number — enabling a precise rule like "block only TCP port 23 from this host." Standard ACLs (A) can filter only by source IP address, so they could only block all traffic from the host, not just Telnet.
A network engineer is writing a script that sends configuration data to a controller's REST API and needs to format the request body. Which data format is most commonly used for REST API payloads in network automation?
- A.YAML
- B.JSONCorrect
- C.CSV
- D.Raw binary
Explanation
JSON (JavaScript Object Notation) is the most common data format for REST API request and response bodies in network automation, including Cisco's own APIs. YAML (A) is widely used for automation tooling like Ansible playbooks, but REST API payloads themselves are overwhelmingly JSON.
Scoring guide
| Score | What it suggests |
|---|---|
| 13-15 correct | You are likely close to exam-ready on the multiple-choice portion. Move on to Packet Tracer labs and full-length timed mocks. |
| 10-12 correct | Solid foundation with specific gaps. Review the domains you missed and drill those with hands-on lab time. |
| Under 10 correct | Plan for another 2-3 weeks of structured study before your next practice checkpoint. |
What to do next
These 15 questions are a sample. The full CertSharp CCNA bank has 500 questions across all six domains, with an explanation on every one — enough depth to build real pattern recognition rather than memorizing 15 specific answers. Try 30 more free questions, or read the CCNA cheat sheet for a fast final review.
Frequently asked questions
Are these real Cisco exam questions?
No. These are original practice questions written to mirror the style, difficulty, and domain weighting of the real 200-301 exam, mapped to Cisco’s published exam topics. Cisco does not release retired exam questions, and using leaked or braindump content violates the Cisco certification agreement.
How representative are these of the real exam difficulty?
These 15 sample questions span the range you will see: straightforward recall, multi-step routing and subnetting scenarios, and one multiple-response item. They do not include simulation-style (simlet) items, which require an interactive Cisco IOS environment — practice those separately in Cisco Packet Tracer. The full 500-question CertSharp bank is calibrated slightly above real exam difficulty, so consistent 85%+ performance there predicts a comfortable pass on the multiple-choice portion.
Which domain should I focus my practice on most?
Weight your practice roughly to the exam: IP Connectivity (25%) and the combined Network Fundamentals and Network Access domains (40% together) should get the most questions in your rotation — together they are 65% of the scored content.
I got several of these wrong — does that mean I will fail?
Not necessarily, but treat it as a signal. Missing 4+ of these 15 suggests you need another 2-3 weeks of domain-specific study, plus hands-on lab time, before booking. Review every explanation below, not just for the questions you missed — the distractor explanations often teach a second related fact.
Get 30 free questions right now
No signup for the first 30. Full 500-question bank is $11.99 lifetime, or $9.99/month Pro unlocks CCNA plus every other CertSharp certification.