CCNA 200-301 network infrastructure explained
Network Infrastructure and Connectivity is worth 25% of the v2.0 CCNA, tied for the largest domain. It covers physical interface and cable faults, hypervisors and containers, IPv4 and IPv6 troubleshooting including subnetting, wireless principles, client connectivity and DHCPv4. The verb throughout is troubleshoot: you are shown a symptom and asked for the cause.
Interfaces and cabling
Collisions, errors, a duplex or speed mismatch, distance limits, signal levels, pinouts and cable types are all named in the objectives.
| Symptom | Usual cause |
|---|---|
| Late collisions and runts on one side | Duplex mismatch |
| CRC or FCS errors rising | Bad cable, connector or interference |
| Interface up/down or down/down | Cable, speed mismatch or remote side shut |
| No link on fiber | Transmit and receive swapped, or wrong fiber type |
A classic duplex mismatch happens when one side is hard-coded to full duplex and the other autonegotiates: the autonegotiating side cannot see the setting and falls back to half duplex. Fix it by matching both ends. Copper runs are limited to 100 metres; single-mode fiber reaches much further than multimode.
IPv4 subnetting
Subnetting is the skill the rest of the exam leans on. Learn the block-size method: subtract the interesting octet of the mask from 256.
| Prefix | Mask | Block size | Usable hosts |
|---|---|---|---|
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /20 | 255.255.240.0 | 16 (third octet) | 4094 |
Know the private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and that 169.254.0.0/16 means a client failed to get DHCP. Troubleshooting questions give a host address, mask and gateway and ask why it cannot communicate: the gateway is often outside the host’s subnet.
IPv6
Know the address types (global unicast, unique local, link-local, multicast) and prefix sizes; a typical LAN gets a /64. Modified EUI-64 builds the interface ID from the MAC: split the MAC, insert FFFE in the middle and flip the seventh bit of the first byte.
Wireless principles
| Topic | What to know |
|---|---|
| Bands | 2.4 GHz reaches farther and is crowded; 5 GHz has more channels and less range |
| Channels | In the 2.4 GHz band, 1, 6 and 11 do not overlap in the US |
| Interference | Microwave ovens, Bluetooth and neighboring APs; co-channel overlap |
| Security | WPA2 and WPA3 with personal or enterprise authentication |
Client troubleshooting adds IP configuration and reachability checks on Windows, macOS and Linux: ipconfig, ifconfig or ip, ping and nslookup.
DHCPv4 and virtualisation
DHCP is a four-step exchange (discover, offer, request, acknowledge). A client on a different subnet from the server needs a relay, configured with ip helper-address on the interface facing the clients. Hypervisors let several virtual machines share hardware, each with its own operating system. Containers share the host kernel and are lighter.
Example questions
Question 1. Users on a switch port report slow file transfers to a server. The port shows many late collisions and runts. The server NIC is hard-coded to 100 Mbps full duplex and the switch port is set to auto. What is the best fix?
- A. Replace the patch cable with a longer one
- B. Configure both ends with the same speed and duplex settings
- C. Increase the MTU on the switch port
- D. Disable spanning tree on the port
Show answer
Answer: B
Late collisions and runts indicate a duplex mismatch: the autonegotiating switch port cannot detect a hard-coded NIC’s duplex and falls back to half duplex. Setting both ends to the same fixed speed and duplex, or both to auto, resolves it. Replacing the cable does not fix a configuration mismatch, a larger MTU is unrelated, and disabling spanning tree does not affect collisions.
Want more questions like this? Full 200-301 practice tests →
Question 2. An interface has MAC address 0200.1122.3344 and the router should create its IPv6 address with modified EUI-64 on the prefix 2001:db8:1:1::/64. Which address results?
- A. 2001:db8:1:1:0:11ff:fe22:3344
- B. 2001:db8:1:1:200:11ff:fe22:3344
- C. 2001:db8:1:1:0200:1122:3344::
- D. 2001:db8:1:1:fffe:0200:1122:3344
Show answer
Answer: A
Insert FFFE in the middle of the MAC to get 0200:11FF:FE22:3344, then flip the seventh bit of the first byte: 02 becomes 00. The interface ID is 0:11ff:fe22:3344. Leaving 02 unflipped gives option B, and the other options omit the FFFE insertion or reorder the MAC.
Want more questions like this? Full 200-301 practice tests →
Question 3. Three access points are placed in adjacent coverage areas in the 2.4 GHz band in the United States. Which channel assignment minimises co-channel interference?
- A. Channels 1, 2 and 3
- B. All three on channel 6
- C. Channels 4, 8 and 12
- D. Channels 1, 6 and 11
Show answer
Answer: D
In the 2.4 GHz band only channels 1, 6 and 11 are non-overlapping in the US, so assigning one to each AP avoids interference between them. Adjacent channels such as 1, 2 and 3 overlap heavily. Using the same channel makes the APs compete for airtime, and 4, 8 and 12 still overlap with their neighbors.
Want more questions like this? Full 200-301 practice tests →
If you sit v1.1 before February 3, 2027
This page follows the v2.0 outline. The v1.1 exam, which Cisco lists as bookable until February 2, 2027, opens its Network Fundamentals domain (20%) with an objective that v2.0 no longer names. v2.0 candidates can skip this section.
Network components (v1.1 objective 1.1)
Objective 1.1 asks you to explain the role and function of network components: routers, Layer 2 and Layer 3 switches, next-generation firewalls and IPS, access points, controllers, endpoints, servers and PoE. Questions are about matching a requirement to the device that meets it, so learn each device by what it looks at and what it decides.
| Component | Looks at | Function |
|---|---|---|
| Layer 2 switch | Destination MAC address and VLAN | Forwards frames within a VLAN using its MAC address table; floods unknown destinations |
| Layer 3 switch | MAC and IP addresses | Switches within a VLAN and routes between VLANs, usually through SVIs |
| Router | Destination IP address | Forwards packets between networks using the routing table; connects LAN to WAN |
| Next-generation firewall | Addresses, ports, connection state and the application | Permits or blocks traffic by policy, including by application and user |
| IPS | Traffic passing through it | Sits inline and drops traffic that matches known attack signatures or abnormal behaviour |
The distinctions Cisco tests sit between neighbouring rows. A Layer 2 switch alone cannot let two VLANs talk to each other; that needs a router or a Layer 3 switch. A router separates broadcast domains, a switch does not. A traditional firewall filters on addresses, ports and connection state; a next-generation firewall adds application awareness, so it can allow a business application while blocking another that uses the same port, and it commonly includes an IPS. An IPS must be in the traffic path to stop an attack. An IDS receives a copy of the traffic, for example from a SPAN port, and can only alert.
The remaining items are short: access points bridge wireless clients onto the wired network, a wireless LAN controller manages lightweight APs centrally, endpoints and servers are the hosts at the edge, and PoE lets a switch port power an AP, phone or camera over the data cable.
Exam-style pitfall: picking a Layer 2 switch when the requirement is routing between VLANs, or an IDS when the requirement is to block. “Detect and alert” is an IDS; “stop” or “drop” requires an inline IPS or NGFW. For a packet walk through each device and the IDS versus IPS placement, see network devices: switch, router, firewall, IDS and IPS.
Question 4. (v1.1) Hosts in VLAN 10 and VLAN 20 are connected to the same access switch and must communicate with each other. The switch only performs Layer 2 forwarding. Which device can provide the connectivity?
- A. A second Layer 2 switch
- B. An IDS connected to a SPAN port
- C. A Layer 3 switch or a router
- D. An access point
Show answer
Answer: C
Traffic between VLANs must be routed, so a router or a Layer 3 switch is required. A Layer 2 switch forwards frames only within a VLAN. An IDS only monitors a copy of traffic, and an access point bridges wireless clients onto the network; neither routes between VLANs.
Want more questions like this? Full 200-301 practice tests →
Revision tips
Do five subnetting problems every day for the first week. Say the block size aloud before you write anything. For troubleshooting items, name the symptom first and then the cause; if two options both sound plausible, pick the one that explains every symptom in the scenario.
Next, continue with switching and network access, or return to the exam format.