Cisco CCNA Practice Questions: 25 Exam-Style Examples With Answers and Explanations (200-301 v1.1, 2026)

Most free CCNA practice questions online test whether you can recall a fact. The real 200-301 exam tests whether you can read a scenario, spot the one detail that changes the answer, and rule out three distractors that all look plausible. These 25 CCNA practice questions are written the second way.

They are weighted to match the current 200-301 v1.1 blueprint, so the count per domain reflects how much of the real exam each topic actually occupies. Work through them with a pen and paper, write your answer down before you scroll, and treat every question you get right for the wrong reason as a question you got wrong.

What the CCNA 200-301 Exam Actually Looks Like

Before the questions, the numbers that shape how you should practise.

That works out at roughly 60 to 70 seconds per question. Pace matters more on CCNA than on most associate-level exams, because a single subnetting question can eat four minutes if you calculate it the long way.

Exam Tip: The widely quoted 825 out of 1000 passing score is a community estimate assembled from reported results, not a figure Cisco publishes. Cisco sets the cut score per exam form and does not disclose it. Aim to be comfortably above 85% on practice material rather than targeting a specific scaled number.

How the Six Domains Are Weighted

The v1.1 blueprint splits into six domains. The question mix below follows these weights.

IP Connectivity is the biggest single domain at 25%, and it is where most failed attempts lose their marks. If your revision time is limited, routing and subnetting are where it goes.

Domain 1: Network Fundamentals (5 CCNA Practice Questions)

Question 1. A network administrator subnets 192.168.10.0/24 into /26 networks. How many usable host addresses does each subnet provide?

A. 32 B. 62 C. 64 D. 126

Answer: B. A /26 leaves 6 host bits, giving 2^6 = 64 total addresses per subnet, minus the network address and the broadcast address, so 62 usable. Option C is the total address count and forgets to subtract the two reserved addresses, which is the single most common subnetting slip on the exam. Option D would be correct for a /25, and option A for a /27.

Question 2. A host is configured with the address 172.16.5.130/25. What is the network address of the subnet it belongs to?

A. 172.16.5.0 B. 172.16.5.64 C. 172.16.5.128 D. 172.16.5.130

Answer: C. A /25 mask creates two subnets in the fourth octet with a block size of 128: 172.16.5.0 and 172.16.5.128. The host address 130 falls in the second block, so the network address is 172.16.5.128 and the broadcast is 172.16.5.255. Option A is the first subnet, which would only apply to hosts .1 through .126.

Question 3. Which cable type is required to run 10GBASE-T over a full 100-metre channel?

A. Cat5e B. Cat6 C. Cat6a D. Multimode fibre

Answer: C. Cat6a supports 10 Gbps over the full 100 metres. Cat6 carries 10 Gbps only to around 55 metres because of alien crosstalk, so it fails the full-length requirement in the question. Cat5e tops out at 1 Gbps for standard runs. Fibre would work but the question specifies a copper twisted-pair category by asking about 10GBASE-T.

Question 4. An engineer sees the address FE80::1A2B:3C4D:5E6F:7A8B on a router interface. What type of IPv6 address is this?

A. Global unicast B. Unique local C. Link-local D. Multicast

Answer: C. The FE80::/10 range is reserved for link-local addresses, which every IPv6-enabled interface generates automatically and which are never routed off the local link. Unique local addresses start with FC00::/7 (in practice FD00::/8), global unicast currently comes from 2000::/3, and IPv6 multicast begins with FF00::/8.

Question 5. Which statement correctly describes a difference between TCP and UDP?

A. UDP guarantees delivery through sequence numbers and acknowledgements B. TCP establishes a session using a three-way handshake before sending data C. TCP is preferred for real-time voice traffic because of its low overhead D. UDP retransmits any segment that is not acknowledged

Answer: B. TCP opens a connection with SYN, SYN-ACK, ACK before any application data moves. Options A and D describe TCP behaviour but attribute it to UDP, which is connectionless and does not track or retransmit anything. Option C inverts the real design choice: voice uses UDP precisely because retransmitting a late audio packet is worse than dropping it.

Domain 2: Network Access (5 CCNA Practice Questions)

Question 6. Two switches are connected by a trunk. SW1 has the native VLAN set to 1 and SW2 has it set to 99. What is the most likely symptom?

A. The trunk link will not come up at all B. Traffic from the native VLAN on one switch appears in a different VLAN on the other C. All VLANs are blocked across the trunk D. Spanning tree disables both access ports

Answer: B. A native VLAN mismatch does not stop the trunk forming, because untagged frames still cross it. They simply land in the wrong VLAN on the far side, which creates a VLAN hopping risk and usually triggers a CDP native VLAN mismatch message in the logs. Option A describes an encapsulation or mode mismatch, not a native VLAN one.

Question 7. In a spanning tree topology, a non-root switch has two paths to the root bridge. What role does spanning tree assign to the port on the higher-cost path?

A. Root port B. Designated port C. Alternate port D. Disabled port

Answer: C. The lowest-cost path becomes the root port. The redundant path is placed in a discarding state as an alternate port, ready to take over if the root port fails. Option B is wrong because designated ports forward traffic on a segment away from the root. Option D refers to a port that has been administratively shut down.

Question 8. SW1 is configured with channel-group 1 mode passive and SW2 with channel-group 1 mode passive. What is the result?

A. An LACP EtherChannel forms normally B. A PAgP EtherChannel forms normally C. No EtherChannel forms D. The ports enter an err-disabled state

Answer: C. Passive mode waits for the other side to start LACP negotiation. With both sides waiting, nothing initiates, so no channel forms. At least one side must be set to active. The common pairings worth memorising are active/active and active/passive for LACP, and desirable/desirable and desirable/auto for PAgP.

Question 9. Which WPA3 feature replaces the WPA2 pre-shared key handshake that was vulnerable to offline dictionary attacks?

A. TKIP B. Simultaneous Authentication of Equals C. WPS D. Open System authentication

Answer: B. SAE, sometimes marketed as WPA3-Personal, uses a Dragonfly key exchange so an attacker who captures the handshake cannot take it away and brute-force the passphrase offline. TKIP is the deprecated WPA1-era cipher. WPS is a separate convenience feature with its own well-documented PIN weakness.

Question 10. An engineer needs to restrict a trunk so that only VLANs 10, 20 and 30 traverse it. Which command achieves this?

A. switchport trunk native vlan 10,20,30 B. switchport access vlan 10,20,30 C. switchport trunk allowed vlan 10,20,30 D. switchport mode trunk vlan 10,20,30

Answer: C. The allowed VLAN list controls which VLANs the trunk carries. Be careful with this command in production: issuing it without the add keyword replaces the entire existing list rather than appending to it, which is a classic way to drop VLANs you did not intend to touch.

Domain 3: IP Connectivity (6 CCNA Practice Questions)

Question 11. A router learns a route to 10.1.1.0/24 through both OSPF and internal EIGRP. Which route is installed in the routing table, and why?

A. The OSPF route, because OSPF is a link-state protocol B. The EIGRP route, because its administrative distance of 90 is lower than OSPF's 110 C. Both, because they are different protocols D. The OSPF route, because its metric is based on bandwidth

Answer: B. When two protocols offer the same prefix, the router compares administrative distance first and metric is never considered across protocols. Internal EIGRP is 90, OSPF is 110, so EIGRP wins. Worth memorising: directly connected 0, static 1, external BGP 20, internal EIGRP 90, OSPF 110, RIP 120, external EIGRP 170, internal BGP 200.

Question 12. Which command configures a default route that sends all unmatched traffic to the next hop 203.0.113.1?

A. ip route 0.0.0.0 255.255.255.255 203.0.113.1 B. ip route 0.0.0.0 0.0.0.0 203.0.113.1 C. ip default-gateway 203.0.113.1 D. ip route default 203.0.113.1

Answer: B. A default route uses the all-zeros network with an all-zeros mask, which matches every destination and therefore always loses the longest-prefix-match comparison to any more specific route. Option C is used on a Layer 2 switch or on a router with IP routing disabled, not on a routing router.

Question 13. Four routers share an OSPF broadcast segment. R1 has priority 1, R2 has priority 0, R3 has priority 100, and R4 has priority 100 with the highest router ID. Which router becomes the DR?

A. R1 B. R2 C. R3 D. R4

Answer: D. The highest OSPF interface priority wins, and the router ID breaks a tie. R3 and R4 both hold priority 100, so R4's higher router ID makes it the DR and R3 becomes the BDR. R2 is ineligible entirely: a priority of 0 removes a router from the election.

Question 14. A routing table holds 10.0.0.0/8 via OSPF, 10.1.0.0/16 via EIGRP, and 10.1.1.0/24 via a static route. Which entry forwards a packet destined for 10.1.1.55?

A. The OSPF route B. The EIGRP route C. The static route D. The packet is dropped as ambiguous

Answer: C. Longest prefix match is evaluated before administrative distance, and /24 is the most specific prefix containing 10.1.1.55. Administrative distance only settles a contest between identical prefixes. Candidates who memorise the AD table without understanding this ordering routinely get this style of question wrong.

Question 15. What is the default OSPF reference bandwidth, and what cost does a 10 Gbps interface receive as a result?

A. 100 Mbps, and the interface receives a cost of 1 B. 1 Gbps, and the interface receives a cost of 1 C. 100 Mbps, and the interface receives a cost of 10 D. 10 Gbps, and the interface receives a cost of 1

Answer: A. The default reference bandwidth is 100 Mbps, so cost is calculated as 100 Mbps divided by interface bandwidth, rounded to a minimum of 1. Every interface at 100 Mbps or faster therefore lands on cost 1, which means a gigabit link and a 10-gigabit link look identical to OSPF. Raising the reference bandwidth consistently across all routers is the fix.

Question 16. Three routers run HSRP on the same segment. R1 has priority 110 with preemption disabled, R2 has priority 120 with preemption enabled, and R3 has the default priority. R1 is currently active when R2 boots. What happens?

A. R2 becomes active immediately because its priority is higher B. R1 stays active because preemption is configured on R2, not R1 C. R3 becomes active because it booted first D. Both R1 and R2 become active

Answer: A. Preemption is configured on the router that wants to take over, and R2 has both the higher priority and preemption enabled, so it seizes the active role from R1. The setting on R1 is irrelevant here. Without preemption on R2, R1 would keep the role until it failed.

Domain 4: IP Services (3 CCNA Practice Questions)

Question 17. An office of 200 hosts shares a single public IPv4 address for internet access. Which NAT variant makes this possible?

A. Static NAT B. Dynamic NAT C. PAT, also called NAT overload D. Twice NAT

Answer: C. PAT multiplexes many inside local addresses onto one public address by rewriting the source port as well as the source IP, tracking each session in the translation table. Dynamic NAT maps addresses one to one from a pool, so 200 hosts would need 200 public addresses. Static NAT is a fixed one-to-one mapping, normally used for inbound access to a server.

Question 18. A router synchronises its clock from an NTP server operating at stratum 2. What stratum does the router report?

A. 1 B. 2 C. 3 D. 0

Answer: C. Each hop away from the reference clock increments the stratum by one, so a client of a stratum 2 server becomes stratum 3. Stratum 0 is the reference hardware itself, such as an atomic clock or GPS receiver, and is never assigned to a network device. Accurate time matters more than candidates expect, because log correlation and certificate validation both depend on it.

Question 19. Clients on VLAN 20 receive no addresses from a DHCP server located on a different subnet. Which configuration resolves this?

A. Enable ip dhcp snooping on the VLAN 20 access ports B. Configure ip helper-address on the VLAN 20 gateway interface pointing at the server C. Configure a static route to the DHCP server on each client D. Set the DHCP lease time to infinite

Answer: B. DHCP Discover messages are broadcasts, and routers do not forward broadcasts between subnets. The ip helper-address command converts the broadcast into a unicast aimed at the server. Option A is a security feature that filters rogue DHCP responses and does nothing to solve a relay problem.

Domain 5: Security Fundamentals (4 CCNA Practice Questions)

Question 20. Which port security violation mode drops offending frames and generates a syslog message and SNMP trap, while leaving the port operational?

A. Protect B. Restrict C. Shutdown D. Err-disable

Answer: B. Restrict drops the traffic and tells you about it. Protect drops the traffic silently, which makes troubleshooting unpleasant because nothing is logged. Shutdown is the default and places the port into err-disabled, taking it out of service until it is recovered manually or by errdisable recovery. Err-disable is a resulting port state, not a violation mode you can configure.

Question 21. Which AAA protocol encrypts the entire packet payload and separates authentication from authorisation?

A. RADIUS B. TACACS+ C. LDAP D. Kerberos

Answer: B. TACACS+ encrypts the whole payload and splits the three A's into independent functions, which is why it is preferred for device administration where per-command authorisation matters. RADIUS encrypts only the password field and combines authentication with authorisation, which suits network access control. TACACS+ also uses TCP port 49 rather than RADIUS's UDP ports.

Question 22. Where should a standard IPv4 access control list be applied, and why?

A. As close to the source as possible, to save bandwidth B. As close to the destination as possible, because it can only match source addresses C. On the router with the lowest administrative distance D. On every interface in the path, for defence in depth

Answer: B. A standard ACL matches on source address only. Placing it near the source would block that source's traffic to every destination, not only the one you intended, so it belongs near the destination. Extended ACLs match source, destination, protocol and port, which is exactly why the guidance for those is the opposite: apply them close to the source.

Question 23. After enabling DHCP snooping on a switch, clients stop receiving addresses from the legitimate DHCP server connected to GigabitEthernet0/1. What is the cause?

A. DHCP snooping requires a static ARP entry for the server B. Gi0/1 has not been configured as a trusted port C. DHCP snooping is incompatible with VLANs D. The server must be moved into VLAN 1

Answer: B. DHCP snooping treats every port as untrusted by default and discards server-sourced messages such as OFFER and ACK arriving on them. The uplink or port facing the real server must be marked trusted with ip dhcp snooping trust. This is one of the most common self-inflicted outages in the whole blueprint.

Domain 6: Automation and Programmability (2 CCNA Practice Questions)

Question 24. A script retrieves interface statistics from a controller's REST API without altering any configuration. Which HTTP method does it use, and what does a 200 response indicate?

A. POST, and the resource was created B. GET, and the request succeeded C. PUT, and the resource was replaced D. DELETE, and the resource was removed

Answer: B. GET is the read-only method, and 200 OK confirms the request succeeded and the body contains the requested data. POST creates and typically returns 201, PUT replaces an entire resource, and PATCH modifies part of one. Knowing which methods are safe and idempotent is the level of REST detail the CCNA expects.

Question 25. Which configuration management tool is agentless and uses SSH to push configuration to network devices?

A. Puppet B. Chef C. Ansible D. SaltStack

Answer: C. Ansible connects over SSH and needs nothing installed on the managed device, which is why it dominates network automation where you cannot install an agent on a switch. Puppet and Chef are agent-based and pull configuration from a central server. The CCNA also expects you to know that Ansible describes desired state in YAML playbooks.

How to Score Your Attempt

Mark yourself honestly, then look at where the losses clustered rather than the total.

• 22 to 25 correct. You are tracking well. Move on to timed full-length practice exams and simulation-style questions.
• 18 to 21 correct. Solid foundation with specific gaps. Identify which domains the misses came from and rebuild those before testing again.
• 13 to 17 correct. You know the vocabulary but not the behaviour. Lab the topics you missed rather than rereading notes about them.
• Under 13 correct. Go back to structured study. Our 12-week CCNA study plan sequences the blueprint in the order the topics build on each other.

One pattern is worth flagging. If you lost marks on questions 11, 14 and 15, the problem is routing logic rather than memory, and that is the 25% domain. Those three questions all reward understanding the order of operations: longest prefix match first, then administrative distance, then metric.

Should You Sit 200-301 v1.1 or Wait for v2.0?

Cisco announced CCNA v2.0 on 20 May 2026, and it becomes the only option from 3 February 2027. Every question above is written to v1.1, the version you can still sit today.

If you can be exam-ready before February 2027, sit v1.1. The material is stable, the study resources are mature, and there is no advantage to holding a newer version number on the same certification. If you are starting from zero now, plan for v2.0 instead and study the new blueprint from the outset, because v2.0 brings back troubleshooting-style questions and adds AI in network operations. We break the changes down in our guide to the CCNA v2.0 switchover.

Still deciding between Cisco and CompTIA for your first networking certification? Network+ versus CCNA compares the two on cost, depth and hiring signal.

Frequently Asked Questions

Is the CCNA a hard exam?

It is harder than most associate-level certifications because it tests configuration behaviour rather than definitions. The difficulty is concentrated in IP Connectivity and subnetting, where you have to calculate under time pressure. Candidates with hands-on lab time consistently report it as manageable, and candidates who only read report it as brutal.

Where can I find free practice questions for the CCNA exam?

The 25 questions on this page are free and written to the current v1.1 blueprint. Cisco also publishes sample questions, and Packet Tracer gives you free lab practice for the configuration topics. Be cautious with question sets that do not state which blueprint version they target, because much of the free material online still reflects the older 200-125 exam.

Is CCNA still worth it in 2026?

Yes, for network-facing roles. CCNA remains the most widely requested networking certification in job adverts, and the v2.0 refresh arriving in 2027 signals that Cisco is continuing to invest in it. It carries less weight for candidates aiming directly at cloud or security roles, where a cloud or security certification does more work on a CV.

How long does it take to prepare for the CCNA?

Most candidates with some IT experience need 10 to 14 weeks at around 10 hours a week. Complete beginners should plan for closer to six months. The variable is lab time rather than reading time, because the configuration topics do not stick from a book.

What is the CCNA passing score?

Cisco does not publish it. Scores are reported on a scaled range commonly given as 300 to 1000, and the cut score is set per exam form. The frequently repeated figure of 825 is a community estimate, not an official number, so treat it as a rough target rather than a threshold.

Ready to Start Practising?

Twenty-five questions tell you where your gaps are. Closing them takes volume, timed conditions, and explanations that tell you why the distractor was tempting.

CertCrush gives you full-length practice exams with worked explanations for every option, progress tracking per domain, and study guides written to the current blueprint. Create your free account and start with a timed practice set, or browse the full course catalogue to see what is covered.