CCNA 200-301 cheat sheet
Last-minute reference for CCNA 200-301 on the v2.0 outline. Infrastructure and switching are half the exam; AI and operations is the smallest domain.
Exam facts
| Duration | 120 minutes |
| Questions / passing score | Not published |
| Price | 300 USD at time of writing |
| Languages | English, Japanese |
| Validity | 3 years |
Domains
| Domain | Weight |
|---|---|
| 1.0 Network Infrastructure and Connectivity | 25% |
| 2.0 Switching and Network Access | 25% |
| 3.0 IP Routing | 20% |
| 4.0 Network Services and Security | 20% |
| 5.0 AI, and Network Operations and Management | 10% |
Subnetting
| Prefix | Block | Hosts |
|---|---|---|
| /24 | 256 | 254 |
| /25 | 128 | 126 |
| /26 | 64 | 62 |
| /27 | 32 | 30 |
| /28 | 16 | 14 |
| /29 | 8 | 6 |
| /30 | 4 | 2 |
Usable hosts = 2^(host bits) - 2. Wildcard mask = 255.255.255.255 minus the subnet mask. A 169.254.x.x address means no DHCP reply.
IPv6
Modified EUI-64: split the MAC, insert FFFE, flip the seventh bit. A typical LAN prefix is /64. A link-local next hop in a static route needs an exit interface.
Rapid PVST+
- Root bridge: lowest priority, then lowest MAC. Default 32768 plus VLAN ID; steps of 4096.
- Port roles: root, designated, alternate, backup. States: discarding, learning, forwarding.
- PortFast for edge ports, BPDU guard to err-disable on BPDU, root guard to protect the root, loop guard for unidirectional links.
Trunks and EtherChannel
Match the native VLAN and allowed list. LACP: active/active and active/passive work; passive/passive does not. Member ports need identical settings.
Routing
| Rule | Order |
|---|---|
| Route selection | Longest prefix, then administrative distance, then metric |
| Source | AD |
|---|---|
| Connected | 0 |
| Static | 1 |
| EIGRP | 90 |
| OSPF | 110 |
| RIP | 120 |
Floating static: AD above the primary route. OSPF neighbors need matching area, subnet, hello/dead timers and unique router IDs. DR: highest priority then highest router ID; priority 0 never. Router ID: configured, else highest up loopback, else highest up physical IP. HSRP needs preempt to reclaim active.
Services and security
| Item | Remember |
|---|---|
| PAT | ip nat inside source list N interface X overload |
| TACACS+ | TCP 49, encrypts payload, separate AAA |
| RADIUS | UDP, encrypts password only |
| SCP/SFTP | Secure; TFTP/FTP are not |
| ACL | Top-down, implicit deny, wildcard masks, standard near destination, extended near source |
| Port security | Shutdown (default), restrict (log), protect (silent) |
| DHCP snooping | Trusted ports only toward real server; DAI uses its table |
| IPsec | Tunnel mode wraps the whole packet; transport protects the payload |
| DNS | A, AAAA, CNAME, MX, NS, PTR |
Operations
Syslog: 0 emergencies, 1 alerts, 2 critical, 3 errors, 4 warnings, 5 notifications, 6 informational, 7 debugging; a logging level includes all lower numbers. Ansible is agentless with YAML playbooks. Management approaches: device, cloud, controller, automation, infrastructure as code. A good AI prompt has persona, instruction, sanitised data, output format.
Traps
- The /26 route beats a lower-AD /24 route for addresses inside the /26.
- A hard-coded NIC with an autonegotiating switch port causes a duplex mismatch.
- Standard ACLs cannot match ports.
- The default ACL ending is deny.
- Never paste secrets into an AI prompt.
For the day itself, see the exam day guide and the glossary.