Free CCNA 200-301 practice test: 20 questions
Twenty questions across the five v2.0 CCNA domains, split roughly by weight: five on infrastructure, five on switching, four on routing, four on services and security, and two on AI and operations. These are original scenario questions. Find the constraint in each before you look at the options, and do not stop at the right answer: read why the others fail.
Network Infrastructure and Connectivity
Question 1. A subnet uses the mask 255.255.255.224. How many usable host addresses does it provide?
- A. 14
- B. 32
- C. 30
- D. 62
Show answer
Answer: C
255.255.255.224 is /27, which leaves 5 host bits: 2^5 = 32 addresses, minus the network and broadcast addresses gives 30 usable hosts. 14 is a /28, 62 is a /26 and 32 forgets to subtract the two reserved addresses.
Want more questions like this? Full 200-301 practice tests →
Question 2. Which address is a valid host address in the subnet 192.168.10.128/26?
- A. 192.168.10.128
- B. 192.168.10.150
- C. 192.168.10.191
- D. 192.168.10.192
Show answer
Answer: B
A /26 has blocks of 64, so this subnet runs from 192.168.10.128 (network) to 192.168.10.191 (broadcast). .150 is inside the usable range. .128 is the network address, .191 is the broadcast address and .192 belongs to the next subnet.
Want more questions like this? Full 200-301 practice tests →
Question 3. Your office has five APs in the 2.4 GHz band, and users on one floor complain of slow wireless even though signal strength is high. A survey shows two neighboring APs on channel 6 and a third on channel 7. What is the most likely issue?
- A. Co-channel and adjacent-channel interference between APs
- B. Insufficient signal strength from the APs
- C. A duplex mismatch on the AP uplink
- D. The DHCP lease time is too long
Show answer
Answer: A
Strong signal with poor throughput points to interference. Two APs on the same channel share airtime (co-channel interference) and channel 7 overlaps channel 6, causing adjacent-channel interference. Moving to the non-overlapping channels 1, 6 and 11 fixes it. Weak signal, a duplex mismatch or the DHCP lease length would not match a strong-signal, slow-wireless symptom.
Want more questions like this? Full 200-301 practice tests →
Question 4. Clients in VLAN 20 receive addresses starting with 169.254, while clients in VLAN 10 work. The DHCP server sits in a different subnet. What should you check first?
- A. The spanning tree root bridge location
- B. The EtherChannel load-balancing method
- C. The static default route on the core
- D. ip helper-address on the VLAN 20 interface
Show answer
Answer: D
A 169.254 address is an APIPA address, assigned when no DHCP reply arrives. Because the server is on another subnet, the VLAN 20 SVI or router interface needs ip helper-address to relay the broadcast as unicast. A trunk allowed list or channel problem would affect more than DHCP, and a static default route does not affect broadcasts from clients.
Want more questions like this? Full 200-301 practice tests →
Question 5. Which statement correctly contrasts virtual machines and containers?
- A. Containers each run a full guest operating system
- B. Containers share the host kernel; each VM runs its own guest OS on a hypervisor
- C. Virtual machines share a single kernel with each other
- D. A hypervisor runs on top of containers
Show answer
Answer: B
Containers share the host operating system kernel and are lighter, while each virtual machine runs its own guest OS on a hypervisor. Containers do not need a full OS each, and VMs do not share a kernel. Type 1 hypervisors run on bare metal, not on top of containers.
Want more questions like this? Full 200-301 practice tests →
Switching and Network Access
Question 6. A Layer 3 switch has SVIs for VLAN 10 and VLAN 20, both up/up, and hosts in each VLAN use their SVI as the gateway. Hosts cannot reach each other across VLANs. What is missing?
- A. The ip routing command
- B. An EtherChannel between the access switches
- C. A matching native VLAN
- D. CDP on the SVIs
Show answer
Answer: A
A Layer 3 switch routes between SVIs only when ip routing is enabled. Without it the switch behaves like a Layer 2 device with management interfaces. An EtherChannel, native VLAN or CDP setting does not provide routing between VLANs.
Want more questions like this? Full 200-301 practice tests →
Question 7. You need to confirm which port of a non-Cisco switch connects to your switch's Gi0/24 so you can update the cabling documentation. Which protocol and command are most appropriate?
- A. CDP and show cdp traffic
- B. DHCP snooping and show ip dhcp binding
- C. OSPF and show ip route
- D. LLDP and show lldp neighbors
Show answer
Answer: D
LLDP is the vendor-neutral discovery protocol, so show lldp neighbors works with non-Cisco devices if LLDP is enabled on both. CDP is Cisco proprietary and will not hear from other vendors. DHCP snooping and show ip route do not list Layer 2 neighbors.
Want more questions like this? Full 200-301 practice tests →
Question 8. A new switch is connected to the distribution layer with a lower bridge priority than the current root. You want to prevent it from ever becoming root. Which feature do you enable on the distribution ports facing it?
- A. PortFast
- B. Root guard
- C. Loop guard
- D. Storm control
Show answer
Answer: B
Root guard puts a port into a root-inconsistent state if it receives superior BPDUs, so the existing root stays in place. BPDU guard would err-disable the port entirely, loop guard protects against unidirectional links, and PortFast does not stop BPDUs from influencing the root election.
Want more questions like this? Full 200-301 practice tests →
Question 9. Gi0/1 is configured as an access port and Gi0/2 as a trunk, and both are placed in channel-group 1 with LACP active. The channel is not working. Why?
- A. LACP active is not a valid mode
- B. A channel can contain at most one port
- C. The member ports have inconsistent switchport configuration
- D. Port channels cannot carry VLAN traffic
Show answer
Answer: C
Member ports of an EtherChannel must have consistent configuration, including switchport mode. A mix of access and trunk settings suspends the inconsistent port or the bundle. LACP active on both ends is valid, a bundle can have more than two links, and the LACP mode does not depend on the VLAN list alone.
Want more questions like this? Full 200-301 practice tests →
Question 10. An IP phone and a PC share one switch port. The phone must use VLAN 150 and the PC VLAN 10. Which configuration is correct?
- A. switchport mode trunk with no further settings
- B. switchport mode access, switchport access vlan 10, switchport voice vlan 150
- C. switchport access vlan 150 only
- D. switchport voice vlan 10 and switchport access vlan 150
Show answer
Answer: B
The port is an access port in the data VLAN (10) with a separate voice VLAN (150) configured. The phone tags its own traffic in the voice VLAN while the PC stays untagged. A full trunk without restriction is not the standard approach, and placing both devices in a single access VLAN cannot give the phone its own VLAN.
Want more questions like this? Full 200-301 practice tests →
IP Routing
Question 11. A routing table entry reads O 10.5.0.0/16 [110/2] via 10.1.1.2. What does the value 2 represent?
- A. The hop count
- B. The administrative distance
- C. The OSPF cost (metric)
- D. The number of equal-cost paths
Show answer
Answer: C
In the brackets the first number is the administrative distance (110 for OSPF) and the second is the protocol metric, which for OSPF is cost. It is not the hop count, the prefix length or the number of equal-cost paths.
Want more questions like this? Full 200-301 practice tests →
Question 12. A router has Loopback0 10.0.0.1, Loopback1 10.0.0.9 and GigabitEthernet0/0 192.168.1.1, all up, and no router-id command in OSPF. Which router ID is chosen?
- A. 10.0.0.1
- B. 192.168.1.1
- C. 0.0.0.0
- D. 10.0.0.9
Show answer
Answer: D
Without a configured router-id, OSPF picks the highest IP address on an up loopback interface, which is 10.0.0.9. Physical interface addresses are used only if no loopback exists, and the lowest address is never preferred.
Want more questions like this? Full 200-301 practice tests →
Question 13. R1 has HSRP priority 110 and R2 has priority 100 for the same group. R1 reloads, R2 becomes active, and after R1 returns it stays standby. What explains this?
- A. Preemption is not configured on R1
- B. R1 has a lower priority than R2
- C. The HSRP virtual IP address is wrong
- D. HSRP cannot fail back
Show answer
Answer: A
Without preempt, a higher-priority router does not take back the active role from a working active router. Priority 110 is higher than 100, so the priority is not the cause, and HSRP version or the virtual IP address mismatches would have prevented the group from forming at all.
Want more questions like this? Full 200-301 practice tests →
Question 14. Which IPv6 default static route is valid when the next hop is the link-local address fe80::1 reachable through GigabitEthernet0/0?
- A. ipv6 route ::/0 fe80::1
- B. ipv6 route ::/0 GigabitEthernet0/0 fe80::1
- C. ip route 0.0.0.0 0.0.0.0 fe80::1
- D. ipv6 route 0.0.0.0/0 GigabitEthernet0/0
Show answer
Answer: B
A link-local next hop is only meaningful on a specific link, so the command must include the exit interface. Omitting it fails for a link-local address. The ipv6 prefix for default is ::/0, not 0.0.0.0/0, and the ip route command is for IPv4.
Want more questions like this? Full 200-301 practice tests →
Network Services and Security
Question 15. Which statement about TACACS+ is correct?
- A. It uses UDP and encrypts only the password
- B. It combines authentication and authorization in one process
- C. It uses TCP and encrypts the entire payload
- D. It cannot provide accounting
Show answer
Answer: C
TACACS+ runs over TCP port 49 and encrypts the whole body of the packet, and it separates authentication, authorization and accounting, which allows per-command authorization. RADIUS uses UDP and encrypts only the password. TACACS+ is not UDP-based and does not combine the three functions.
Want more questions like this? Full 200-301 practice tests →
Question 16. An engineer must copy a new IOS XE image to a router across an untrusted network. Which option protects the transfer?
- A. TFTP
- B. FTP
- C. HTTP
- D. SCP
Show answer
Answer: D
SCP runs over SSH, so the image and credentials are encrypted in transit. TFTP and FTP send data in clear text, and HTTP without TLS is also unprotected.
Want more questions like this? Full 200-301 practice tests →
Question 17. Users on access ports occasionally receive wrong default gateways from an unauthorised DHCP server plugged into the network. Which feature stops this?
- A. DHCP snooping with trusted ports only toward the real server
- B. Port security with a maximum of one MAC address
- C. Storm control on access ports
- D. Root guard on the uplinks
Show answer
Answer: A
DHCP snooping marks only uplinks toward legitimate DHCP servers as trusted and drops DHCP server messages arriving on untrusted access ports. Port security limits MAC addresses, storm control limits floods, and root guard influences spanning tree.
Want more questions like this? Full 200-301 practice tests →
Question 18. A site-to-site IPsec VPN between two gateways must protect the entire original IP packet, including the original IP header. Which mode is used?
- A. Transport mode
- B. Tunnel mode
- C. Aggressive mode
- D. Main mode
Show answer
Answer: B
Tunnel mode encapsulates the whole original packet inside a new IP header, which is why it is typical between gateways. Transport mode protects only the payload and keeps the original header. Main mode and aggressive mode are IKE negotiation modes, not IPsec encapsulation modes.
Want more questions like this? Full 200-301 practice tests →
AI, and Network Operations and Management
Question 19. Which description best fits agentic AI in network operations?
- A. A protocol that polls interface counters every five minutes
- B. A chatbot that never uses external tools
- C. A system that plans steps, uses tools and acts on the results toward a goal
- D. A replacement that removes the need to review changes
Show answer
Answer: C
Agentic AI works toward a goal by planning steps and using tools, such as running read-only commands, then acting on the results, with human oversight. A system that only formats a single answer is plain generative AI, SNMP polling is classic monitoring, and nothing in network operations makes human review unnecessary.
Want more questions like this? Full 200-301 practice tests →
Question 20. A team keeps its desired device configuration in a version-controlled repository and a pipeline applies it to the network when a change is merged. Which management approach is this?
- A. Infrastructure as code
- B. Device-based management
- C. Cloud portal management
- D. SNMP-based management
Show answer
Answer: A
Storing the desired state in version-controlled files and applying it automatically is infrastructure as code. Device-based management is per-device and manual, cloud-based management is defined by the vendor portal, and SNMP is a monitoring protocol.
Want more questions like this? Full 200-301 practice tests →
Scoring
| Score | Meaning |
|---|---|
| 18-20 | Ready; confirm with a timed full-length test |
| 14-17 | Close; revisit the domains where you slipped |
| Below 14 | Study the domain guides and retry in a week |
Cisco does not publish a passing score, so aim for a consistent 85% or more on realistic material. Use the study plan to schedule the gaps.