ExamSprintLab

Free CCNA 200-301 sample questions

Updated October 9, 2026

Here are five free CCNA 200-301 sample questions, one per major area of the v2.0 blueprint, with the answer and the reasoning behind it. Try each question before opening the answer. These are original scenario questions written against the published exam topics, not questions from the real exam.

Question 1. A host is configured with the address 172.16.45.200/20. What is the broadcast address of its subnet?

  • A. 172.16.32.255
  • B. 172.16.47.255
  • C. 172.16.45.255
  • D. 172.16.48.0
Show answer

Answer: B

A /20 mask is 255.255.240.0, so the third octet increments in blocks of 16. 45 falls in the block starting at 32, so the network is 172.16.32.0 and the broadcast address is the last address in the block, 172.16.47.255. 172.16.32.255 is only a host address inside the block. 172.16.45.255 and 172.16.48.0 do not match the block boundaries.

Want more questions like this? Full 200-301 practice tests →

Question 2. An access port connects a user PC and must start forwarding immediately. If someone later plugs in a switch, the port must shut itself down. Which configuration meets both requirements on a Rapid PVST+ switch?

  • A. PortFast and root guard
  • B. Loop guard and BPDU filter
  • C. PortFast and BPDU guard
  • D. Switchport mode trunk and PortFast
Show answer

Answer: C

PortFast moves an edge port straight to forwarding, and BPDU guard places the port in err-disabled if a BPDU arrives, which is what a switch would send. Root guard only stops a neighbor from becoming root and does not shut the port for any BPDU. Loop guard protects non-designated ports against unidirectional links. Setting the port as a trunk would not make it edge or protect it.

Want more questions like this? Full 200-301 practice tests →

Question 3. Two routers share an Ethernet segment, are in the same subnet and area 0, and both interfaces are up. The command show ip ospf neighbor on each router returns nothing. Which cause is consistent with this?

  • A. The routers use different OSPF process IDs
  • B. The routers have different router IDs
  • C. The interfaces have different OSPF costs
  • D. The hello and dead intervals do not match
Show answer

Answer: D

OSPF neighbors must agree on hello and dead intervals, so mismatched timers keep adjacency from forming. Different process IDs are only locally significant, router IDs must differ rather than match, and different interface costs do not prevent adjacency.

Want more questions like this? Full 200-301 practice tests →

Question 4. Hosts in 10.1.1.0/24 must not reach the web server 10.2.2.10 on TCP port 80, but everything else must still work. Which extended ACL entries achieve this?

  • A. deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80, then permit ip any any
  • B. deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80 only
  • C. deny 10.1.1.0 0.0.0.255 as a standard ACL, then permit any
  • D. deny tcp 10.1.1.0 255.255.255.0 host 10.2.2.10 eq 80, then permit ip any any
Show answer

Answer: A

The first line denies only TCP port 80 from the source subnet to that single host using a wildcard mask, and the permit ip any any prevents the implicit deny at the end of the list from blocking everything else. A list without the final permit blocks all traffic. A standard ACL cannot match ports or destinations. Using 255.255.255.0 as a wildcard mask matches the wrong addresses.

Want more questions like this? Full 200-301 practice tests →

Question 5. A team wants to push the same configuration change to 40 switches from a central host without installing software on the switches. Which description fits Ansible?

  • A. It polls device counters using community strings
  • B. It requires an agent running on every switch
  • C. It connects to devices without agents and runs tasks from YAML playbooks
  • D. It requires a controller-based fabric to function
Show answer

Answer: C

Ansible is agentless: the control node connects to devices over SSH or an API and runs tasks from YAML playbooks against an inventory. It does not require an agent on each switch. It is not a polling monitoring protocol like SNMP, and it does not require a controller-based fabric, so options A, B and D are wrong.

Want more questions like this? Full 200-301 practice tests →

How did you do?

Questions 1 and 3 catch the most candidates. Block-size subnetting under pressure leads to off-by-one mistakes, and OSPF adjacency problems hide behind a list of plausible but harmless differences. If either slowed you down, read the network infrastructure guide or the IP routing guide.

Question 2 is worth a second look as well. Rapid PVST+ protections each solve a different problem, and the exam likes to offer two that sound similar.

What these questions have in common

None asks for a definition. Each states a requirement and gives options that all sound reasonable, with the answer hinging on one detail: the block size, the interface type, the timer, the implicit deny, the agentless model. Underline the constraint before you read the options.

For a longer check, take the 20-question practice test.