200-301
Free Cisco Certified Network Associate (CCNA) Practice Test
12 exam-style questions with full explanations — no sign-up. Score yourself, then close your gaps with the full course.
Exam fee ~$3006 exam domainsLevel Intermediate2 timed practice tests in the course
✅ Free practice — no sign-up📝 Real exam-style questions💡 Detailed explanations💸 30-day money-back via Udemy
A network engineer must create a subnet from 192.168.10.0/24 that supports exactly 30 usable host addresses with the least amount of wasted address space. Which subnet mask should be used?
A /27 mask provides 5 host bits (2^5 - 2 = 30 usable addresses), exactly matching the requirement with the least wasted space.
A switch port connects to a single end-user PC. The PC should belong only to VLAN 20 and should not receive any tagged frames. Which configuration is correct for this port?
An end-user host needs an access port, not a trunk. 'switchport mode access' combined with 'switchport access vlan 20' assigns the port to VLAN 20 untagged, which is exactly what a single-host connection requires.
A router learns the following routes to reach destination network 172.16.10.0/24: an OSPF route with administrative distance 110 and metric 20, an EIGRP route with administrative distance 90 and metric 3072, and a static route with administrative distance 1 (no AD specified in the configuration). Which route is installed in the routing table?
When multiple sources advertise a route to the same destination, the router selects the route with the lowest administrative distance. A static route defaults to AD 1, which beats EIGRP (90) and OSPF (110), so it is installed regardless of metric.
A network administrator needs internal hosts on 10.1.1.0/24 to access the internet using a single public IP address, 203.0.113.5, which is already assigned to the router's outside interface. Which configuration BEST meets this requirement?
Using 'ip nat inside source list 1 interface GigabitEthernet0/1 overload' performs PAT (NAT overload) using the IP address already configured on the outside interface, allowing all hosts matched by ACL 1 to share that single public address via unique port mappings — exactly what the requirement calls for.
A network engineer configures port security on an access-layer switch port. The requirement states: when an unauthorized MAC address is detected, the offending frames must be dropped, a syslog/SNMP notification must be generated, and the port must remain in a forwarding (up) state. Which port security violation mode satisfies this requirement?
The restrict violation mode drops traffic from the unauthorized MAC address, increments the violation counter, and generates a syslog message and SNMP trap, while leaving the interface operational.
A network engineer manages 200 switches individually via SSH and CLI, making configuration changes one device at a time, which is time consuming and error-prone. The engineer wants to push consistent VLAN configurations to all switches simultaneously from a single management platform. Which approach BEST meets this requirement?
Cisco DNA Center provides centralized, controller-based management that lets an engineer define and push consistent configuration policies (like VLANs) to many devices at once through northbound APIs and templates, eliminating per-device CLI work.
Which IPv6 address range is automatically assigned to every IPv6-enabled interface, is used for on-link communication such as neighbor discovery, and is never routed beyond the local segment?
FE80::/10 is the link-local address range, automatically configured on every interface and required for protocols like Neighbor Discovery Protocol; it is never forwarded by routers.
Two switches are connected by an 802.1Q trunk. SW1 is configured with native VLAN 1 and SW2 with native VLAN 99. CDP reports a native VLAN mismatch, and untagged traffic intended for VLAN 1 is being delivered incorrectly. Which action resolves this issue?
A native VLAN mismatch occurs when each end of an 802.1Q trunk treats a different VLAN as untagged. Matching the native VLAN on both ends eliminates the mismatch and restores correct forwarding of untagged frames.
A router's routing table contains the following entries: 10.1.0.0/16 via 192.168.1.1, 10.1.1.0/24 via 192.168.2.1, and 10.0.0.0/8 via 192.168.3.1. A packet arrives destined for 10.1.1.50. Which next hop does the router use to forward the packet?
By default, Cisco IOS routers use the longest match (most specific prefix) rule to forward packets. The /24 route is the most specific match for 10.1.1.50, so the router forwards via 192.168.2.1 even though the /16 and /8 routes also technically match.
Which statement accurately describes NTP stratum levels as tested on the CCNA exam?
NTP stratum defines distance from the reference clock: stratum 0 devices are the reference clocks themselves (not directly polled over the network), stratum 1 servers are directly attached to them, and each subsequent hop increases the stratum number by one, up to a maximum of 15.
An attacker connects an unauthorized DHCP server to an access switch port and begins issuing rogue IP configurations, including a malicious default gateway, to clients on the VLAN. Which security feature should be enabled on the switch to prevent this specific attack?
DHCP snooping classifies switch ports as trusted or untrusted and blocks DHCP server responses (OFFER/ACK) arriving on untrusted ports, directly preventing rogue DHCP servers from serving clients.
A REST API returns the following JSON data:
{
"interface": {
"name": "GigabitEthernet0/1",
"status": "up",
"vlans": [10, 20, 30]
}
}
Which statement about this JSON data is correct?
The value of "vlans" is enclosed in square brackets [10, 20, 30], which is JSON syntax for an array containing three numeric elements.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →200-301 exam — quick answers
How much does the 200-301 exam cost?
The exam fee is approximately $300 and varies by region — confirm current pricing with the certification vendor before you book.
What topics are on the exam?
It covers 6 domains: Network Fundamentals (20%), Network Access (20%), IP Connectivity (25%), IP Services (10%), Security Fundamentals (15%), Automation and Programmability (10%). The full course has a dedicated chapter, lab and practice-test coverage for each.
Is this practice test really free?
Yes — all questions on this page are free with explanations and no sign-up. The paid Udemy course adds two full-length timed exams, video lessons and hands-on labs.
Will this prepare me for the real exam?
The questions mirror the real exam's style and are mapped to the official domains. This is exam-focused preparation — combine the free test with the full course's timed simulations to gauge your readiness.