CCNA 200-301 and Answers Practice Test – 131 Free Exam Questions with Answers

Correct answer: A. Data Link

RSTP operates at the Data Link layer using BPDUs to prevent loops. The trap is confusing it with network-layer routing protocols.

Correct answer: B. Layer 2

PPP operates at Layer 2 to encapsulate datagrams over point-to-point links. Other layers handle different network functions.

Correct answer: E. They handle both standard and extended ACLs

Named ACLs support both standard and extended filtering. They do not filter Layer 7 traffic or rate-limit networks.

Correct answer: D. Allows instant data transfer without spanning tree delays

PortFast bypasses spanning tree delays for ports connected to end devices. Other options describe BPDU Guard or filtering.

Correct answer: C. Community strings

SNMPv2 uses community strings for authentication. SNMPv3 introduces stronger security like HMAC-SHA and CBC-DES.

Correct answer: E. Subnets: 256 · F. Hosts: 254

A Class B subnet mask of 255.255.255.0 creates 256 subnets and 254 hosts per subnet. Other options provide incorrect calculations.

Correct answer: B. 22

B is correct; SSH uses port 22. Other options are for email, FTP, HTTP, and Telnet.

Correct answer: B. Discovers distinct networks · C. Chooses packet forwarding paths

Routers discover networks and choose forwarding paths, dividing broadcast domains. The first option is incorrect.

Correct answer: D. OUI

The first 24 bits of a MAC address are the OUI, identifying the vendor. NIC refers to the hardware itself.

Correct answer: A. Accounting and billing · B. Security analysis · D. Network, app, and user monitoring

Netflow provides accounting, security analysis, and network monitoring. Network planning is not a primary Netflow advantage.

Correct answer: A. Router with subinterfaces on the switch-connected interface

Inter-VLAN routing requires a Layer 3 device with subinterfaces to route traffic between VLANs. Option D is a common trap as it lacks subinterfaces.

Correct answer: B. Verifies IP-MAC correspondence · D. Prevents ARP spoofing · F. Uses DHCP Snooping Binding Database

DAI verifies IP-MAC correspondence to prevent ARP spoofing using DHCP Snooping bindings. Option A is incorrect as DAI doesn't examine MAC from IPv4.

Correct answer: A. (Config) # spanning-tree portfast default

The 'spanning-tree portfast default' command enables PortFast globally on all access ports. Option B is incorrect as PortFast doesn't apply to trunks.

Correct answer: B. EIGRP-learned route

EIGRP wins due to its lowest Administrative Distance (90). Metrics only matter within the same routing protocol.

Correct answer: C. Static NAT

Static NAT provides a one-to-one mapping of an inside address to an outside address.

Correct answer: A. 11001100-00111111-00011000

The OUI is the first 24 bits of the MAC, CC-3F-18, converting correctly to binary.

Correct answer: D. cdp run

The global command 'cdp run' enables CDP to discover Cisco devices on the network.

Correct answer: C. Bootstrap

The bootstrap program locates the IOS image during router boot. Option B is wrong; Mini-IOS is a fallback, not the main step.

Correct answer: C. 172.16.0.0/20

172.16.0.0/20 covers all subnets efficiently. Option A is too broad; option D is too narrow for the exhibit.

Correct answer: B. 3-way handshake

TCP's 3-way handshake establishes a reliable connection before data transfer. Option C is part of it, not the full process.

Correct answer: A. One domain can have multiple IPs · C. Multiple domains can share one IP

DNS supports one-to-many domains to IPs for load balancing and many-to-one for hosting multiple services.

Correct answer: E. Maps multiple hosts to one global address

'Overload' enables PAT, mapping multiple internal hosts to one public IP using port numbers.

Correct answer: F. 'Enable Secret' uses MD5 encryption

'Enable Secret' uses MD5 encryption and overrides 'Enable Password' if both are configured.

Correct answer: B. Passive-interface

Passive-interface blocks routing protocol hellos and updates on an interface.

Correct answer: B. 206.140.3.0/27

255.255.255.224 uses 27 bits, so the correct notation is 206.140.3.0/27.

Correct answer: B. Operates as a PULL mechanism · F. Relies on manifests

Puppet uses a PULL mechanism and relies on manifests. Chef uses Recipes and Cookbooks, while Ansible uses SSH and Netconf.

Correct answer: A. Seven levels

By default, the console displays all seven syslog severity levels. Other options misstate the default configuration.

Correct answer: B. Set a VTY password · C. Assign an IP address · D. Define a default gateway · E. Configure an enable password

Telnet access requires a VTY password, IP address, default gateway, and enable password. Port security is not required.

Correct answer: D. LACP

LACP is the IEEE standard for EtherChannel. PAGP is a Cisco-proprietary alternative, while OSPF and NTP are unrelated.

Correct answer: A. Adjusts the auto-recovery timer

The command sets the auto-recovery timer to 400 seconds for err-disabled ports. Option C incorrectly specifies port security recovery.

Correct answer: D. Dynamic MACs are retained in running-config

Sticky MAC addresses are dynamically learned and saved to the running-config. Option B is wrong because they're not in startup-config.

Correct answer: C. Only EIGRPv6 needs a router ID in the routing process

EIGRPv6 requires a manually configured router ID if no IPv4 address exists. Option A is a trap because AS numbers are used in both versions.

Correct answer: C. Can divide broadcast domains · D. Routes based on IP addresses

Layer 3 switches divide broadcast domains and route IP traffic. Option A is a trap because Layer 3 switches support routing.

Correct answer: A. ipv6 address 2001:db8:2222:7272::72/64

The 'ipv6 address' command manually configures an IPv6 address. Option C is a trap because 'autoconfig' is for stateless address autoconfiguration.

Correct answer: B. Each VLAN has its own address space · D. Inter-VLAN connectivity needs a Layer 3 device · E. Switches keep a unique bridging table per VLAN

VLANs have separate address spaces and require Layer 3 devices for inter-VLAN communication. Option A is a trap because switches default to VLAN 1.

Correct answer: B. fd15:db8::700:3:400F:572B · D. fd15:0db8:0000:0000:700:3:400F:527B

Option B correctly removes leading zeros and compresses zeros with double colons. Option D also compresses but misses leading zero removal.

Correct answer: D. Unicast · E. Multicast

D and E are correct; IPv6 uses unicast and multicast, not broadcast. All cast and fast cast are invalid.

Correct answer: B. 2031:0:130F::9C0:876A:130B

B is valid; it uses proper hex and single '::' compression. G/H and double '::' in D are invalid.

Correct answer: E. Dual stack

Dual stack supports both IPv4 and IPv6 simultaneously, making it the correct term. NAT and STP are unrelated technologies.

Correct answer: A. HTTPS

HTTPS is used to access RESTful APIs in SDN controllers like Cisco DNA Center. OpenFlow is a Southbound protocol.

Correct answer: A. Data Link

The Data Link layer handles frame checksums and discards damaged frames. Network layer deals with IP packets.

Correct answer: A. VLANs increase broadcast domains · B. In redundant networks, each segment has one root bridge with all ports forwarding · C. Microsegmentation cuts collision occurrences

Microsegmentation creates individual collision domains per device, reducing collisions. VLANs increase broadcast domains, not decrease them.

Correct answer: A. MAC address

The data link layer uses the MAC address to identify the destination device. IP addresses are Layer 3.

Correct answer: C. Is an industry-standard protocol · D. Operates with UDP · F. Supports accounting

RADIUS uses UDP for transport and supports authentication, authorization, and accounting. It does not separate authentication from authorization.

Correct answer: B. Trunking mode · D. Switch port type (access/trunk/Layer 3) · E. Speed and duplex settings

Ports in an EtherChannel must have matching trunking mode, port type, and speed/duplex settings to form a bundle.

Correct answer: B. switch-mdf-c1(config)#hostname switch-mdf1

The hostname is configured in global configuration mode. Option A incorrectly tries to set it in interface configuration mode.

Correct answer: B. Longest match

Longest match is the first priority for route selection. Option C, administrative distance, is the second priority.

Correct answer: A. 192.168.16.44 · C. 192.168.16.33 · D. 192.168.16.45

The /28 subnet has usable IPs from .33 to .46. Option B is the network address, and option E is the broadcast.

Correct answer: D. A new broadcast domain emerges

Each VLAN creates a new broadcast domain. Option C is incorrect as full duplex eliminates collisions.

Correct answer: C. show startup-config

The startup-config is loaded on reboot. Option E shows the running-config, which is lost on power cycle unless saved.

Correct answer: C. Native VLAN traffic is tagged with VLAN 1 by default

Native VLAN traffic is untagged by default, not tagged with VLAN 1. CDP uses the native VLAN, but Option D is incorrect.

Correct answer: A. Collision domains increase · F. Broadcast domains remain unchanged

Replacing a hub with a switch increases collision domains per port but keeps broadcast domains the same. Options B and D are traps.

Correct answer: B. Lower edge-1's MTU to 1500 · C. Run 'ip ospf mtu-ignore' on edge-1's Gi0/0

OSPF adjacency fails due to MTU mismatch. Lowering MTU or using 'ip ospf mtu-ignore' bypasses the check.

Correct answer: A. ASCII · E. HEX

WPA/WPA2 PSK supports ASCII and HEX formats. OCT, BIN, and DEC are not valid options.

Correct answer: A. Requires pre-configuration on the target device · F. Sends data in plain text

Telnet requires pre-configuration on the target device and sends data in plain text. Option B is a trap as SSH is independent of Telnet.

Correct answer: A. 23 (Telnet) · E. 22 (SSH)

VTY access requires permitting SSH (22) and Telnet (23) in extended ACLs. Other ports like HTTP or TFTP are unrelated to VTY.

Correct answer: D. SNMPv3

SNMPv3 offers the highest security with authentication and encryption. SNMPv2C uses insecure community strings.

Correct answer: B. Cisco Express Forwarding

Cisco Express Forwarding creates a FIB and adjacency table for faster packet forwarding compared to process switching.

Correct answer: C. Stops broadcast storms · D. Auto-switches routes on failure · E. Prevents switching loops

STP prevents switching loops, which stops broadcast storms and allows for automatic failover.

Correct answer: B. BPDU Guard

BPDU Guard disables a PortFast port if it receives a BPDU to prevent loops from unauthorized devices.

Correct answer: B. Port number · C. Protocol · D. Source IP address · E. Destination IP address

Extended ACLs can filter by protocol, source IP, destination IP, and port number.

Correct answer: A. Lets you pick the OS · D. Allows CPU and memory selection

IaaS allows OS and hardware choices like CPU and memory, unlike SaaS examples like Office 365.

Correct answer: B. Worm

Worms self-replicate across networks, unlike viruses or Trojans which require user interaction.

Correct answer: E. Source IP address

Standard IP ACLs filter only source IP, unlike extended ACLs which include ports and protocols.

Correct answer: A. CDP off globally prevents per-interface disabling · B. Disable CDP globally in config mode · D. Disable CDP per interface in interface config mode

CDP is enabled by default globally; disabling it with 'cdp run' prevents per-interface changes. Option E is incorrect because global CDP enables per-interface disabling.

Correct answer: B. Switch link needs trunking

Trunk ports are required between switches to carry multiple VLANs. Option A is wrong because access links carry only one VLAN.

Correct answer: B. It's a network address

10.24.24.24/29 is the network address, unusable for hosts. Option A is wrong; 31 is the broadcast address.

Correct answer: B. Optimizes root switch placement per VLAN

PVST+ optimizes root placement per VLAN for better load balancing. Option C is wrong; root selection is manual or via STP priorities.

Correct answer: D. spanning-tree mode rapid-pvst

The 'spanning-tree mode rapid-pvst' command enables RSTP on Cisco switches, which is the standard for loop prevention.

Correct answer: E. FTP

FTP uses TCP for connection-oriented transfers; the other options are connectionless or not file transfer.

Correct answer: A. Converges faster than STP on failure · B. Adds alternate and backup port roles · F. Enables timer-free convergence on point-to-point links

RSTP converges faster, adds alternate/backup ports, and achieves timer-free convergence on point-to-point links.

Correct answer: A. Bootstrap

The bootstrap step finds the IOS image, while POST performs hardware checks.

Correct answer: B. 192.168.2.40 · C. 192.168.2.15 · F. 192.168.2.32

The valid host IPs range from 192.168.2.1 to 192.168.2.62 for /26 subnet.

Correct answer: A. Sets IP parameters from server to host · B. Assigns and renews IPs from a pool

DHCP assigns IP addresses and parameters like DNS and gateway to hosts.

Correct answer: A. DOWN → INIT → 2WAY → EXSTART → Exchange → Loading → Full

OSPF router state sequence starts with DOWN and progresses to Full via INIT, 2WAY, and Exchange.

Correct answer: A. Shifts from blocking to forwarding instantly

PortFast shifts a port directly from blocking to forwarding, skipping listening and learning states.

Correct answer: B. Dead timer values differ between the routers

Dead timer mismatches prevent OSPF adjacency. Process IDs are locally significant and do not affect neighbor formation.

Correct answer: A. Set the port as a trunk

Configuring a port as a trunk disables DTP to prevent negotiation. Option C is a trap because static access mode alone doesn't disable DTP.

Correct answer: A. They streamline wireless LAN management and rollout · D. They oversee mobility policies system-wide

WLAN controllers streamline management and enforce mobility policies. Option B is a trap because CLI is also available for setup.

Correct answer: B. 192.168.252.8 255.255.255.248

B fits three hosts with 248 mask. Cuses .0 but doesn’t specify host IP, while 252 only allows two hosts.

Correct answer: A. Switch · B. VLAN

A and B are correct; switches use VLANs to separate traffic. Routers and subinterfaces are overkill here.

Correct answer: A. Linking an ISP router to a corporate network

A static route is ideal for linking an ISP router to a corporate network as it's a simple, fixed path. Low administrative distance protocols are a distractor.

Correct answer: D. Overload

NAT Overload (PAT) allows multiple PCs to share four global IPs using port translation. Static NAT is 1:1 and insufficient.

Correct answer: A. FHRP

FHRP provides virtual IP failover, with HSRP as a common Cisco implementation. DHCP is unrelated to redundancy.

Correct answer: D. Maximum packet size sent in one go

MTU is the largest packet size that can be sent in one transfer. Option A is too vague.

Correct answer: B. 'Reliability' indicates interface trustworthiness · D. Most reliable is '255/255', least is '0/255'

The 'Reliability' field shows trustworthiness; '255/255' is full reliability. 'TXLOAD' and 'RXLOAD' measure load, not reliability.

Correct answer: C. Shut down then re-enable the interface with 'shutdown' and 'no shutdown'

You must first shut down the port with 'shutdown', then re-enable it with 'no shutdown'.

Correct answer: A. HFD(config)# ip route 10.5.6.0 255.255.255.0 10.5.4.6 · B. HFD(config)# ip route 10.5.6.0 255.255.255.0 fa0/0

The correct syntax is 'ip route {dest-net} {mask} {next-hop | exit-interface}'. Option C reverses the destination and next-hop.

Correct answer: A. transport input all

The 'transport input all' command allows both SSH and Telnet. Option B, 'output', is a distractor as the command is 'input'.

Correct answer: A. IaaS

IaaS provides virtualized hardware like servers. Option D, PaaS, is platforms, and option B, SaaS, is software.

Correct answer: E. Access layer

The access layer uses a star topology, connecting devices radially to a central switch. Core and distribution layers typically use partial mesh for redundancy.

Correct answer: A. show ip cache flow

show ip cache flow displays general Netflow data. Other options are for specific features like top-talkers or sampling.

Correct answer: A. It's the default PSK format · D. Sets keys with 8-63 alphanumeric characters

ASCII PSK is the default format with 8-63 alphanumeric characters. HEX uses 64 hex digits.

Correct answer: A. Use a firewall to limit outside access · B. Employ SSH or encrypted transport for config access

Firewalls and encrypted SSH protect configs. Open access or Telnet are insecure, so Options C, D, E are traps.

Correct answer: A. Interface as access port with voice VLAN ID

An IP phone needs a voice VLAN configured on the switch port to separate voice traffic. Option C is incorrect as it's only required on the interface.

Correct answer: A. Autoconfiguration · B. DHCPv6

Autoconfiguration and DHCPv6 (stateless mode) enable stateless IPv6 address assignment. DHCP is for IPv4 only.

Correct answer: A. show ip interface

The 'show ip interface' command displays ACLs applied to interfaces, not the rules themselves.

Correct answer: B. IPv6 Route 2001:DB8:1234:5678::/128 Serial0/0 FE80::1 · D. IPv6 Route 2001:DB8:1234:5678::/128 2001:DB8:9ABC::DEF · F. IPv6 Route 2001:DB8:1234:5678::/128 GigabitEthernet1/0/1

The correct syntax is 'IPv6 Route' followed by the prefix, exit interface, and next hop.

Correct answer: A. Switch(config)#vlan 20\nSwitch(config)#Interface gig x/y\nSwitch(config-if)#switchport access vlan 20

First create VLAN 20, then enter the interface and assign it with 'switchport access vlan 20'.

Correct answer: C. IEEE 802.11n

802.11n operates on both 2.4 GHz and 5 GHz bands, while earlier standards use single bands.

Correct answer: C. One ACL per direction per Layer 3 protocol

One ACL per protocol per direction per interface is the correct rule, avoiding confusion about unlimited use.

Correct answer: A. Platinum

Platinum is the highest QoS profile for voice, ensuring priority over other traffic types.

Correct answer: B. Routes over links, not networks · C. Handles multiple IPv6 subnets per link

OSPFv3 routes per link, not subnet, and supports multiple IPv6 subnets per link. Option A is incorrect; OSPF doesn't limit instances per link.

Correct answer: A. Overlapping channel frequencies · E. Poor AP placement

Overlapping channels cause interference, and poor AP placement reduces signal strength. Option B is irrelevant; authentication failure disconnects devices entirely.

Correct answer: B. New conditions append to the end · C. Extended ACLs filter by protocol

Standard ACLs filter source IP; extended adds protocol. New rules append, with an implicit deny all at the end.

Correct answer: E. 4444

In a /64 global unicast address, the first 48 bits are provider-assigned, and the next 16 bits form the subnet.

Correct answer: C. 124.192.168.5 · E. 10.255.255.170

Class A ranges from 0.0.0.0 to 127.255.255.255; 172.x.x.x is Class B.

Correct answer: A. Creates a static route to 172.16.3.0 · B. Uses default administrative distance

This command creates a static route to 172.16.3.0 using 192.168.2.4 with default AD.

Correct answer: A. (config)#interface FastEthernet 0/1\n(config-if)#switchport access vlan 2 · B. (config-vlan)#name Ping-t · F. (config)#vlan 2

Commands include creating VLAN 2, naming it, and assigning it to an interface.

Correct answer: A. PVC status on the router · C. Local DLCI value

Local DLCI and PVC status appear in 'show frame-relay map' output. BECN/FECN counts are not shown.

Correct answer: A. PortFast

PortFast bypasses STP delays, moving ports straight to forwarding for single-device connections.

Correct answer: D. SNMP

SNMP can overload CPU with high polling rates. Other options are performance tools but not CPU hogs.

Correct answer: C. Flow monitor

Flow monitor attaches to interfaces. Flow records define data, and exporters send it to collectors.

Correct answer: A. Cisco Wireless LAN Controller

Cisco IOS-XE validates ACLs, unlike other platforms which may require external tools. The Wireless LAN Controller is a distractor.

Correct answer: A. Increases port density with efficient resource use

Switch stacking increases port density efficiently. Redundancy and performance are secondary benefits.

Correct answer: E. Late collisions

Late collisions indicate a duplex mismatch. Option C, CRC errors, can also suggest issues but are not specific to duplex.

Correct answer: D. Checks for added hardware

POST checks for added hardware. The config register and IOS image boot are handled later in the boot process.

Correct answer: C. Windowing · D. Congestion avoidance · E. Buffering

Windowing, congestion avoidance, and buffering are flow control types. Load balancing and cut-through are unrelated.

Correct answer: A. 115.64.7.64 · B. 115.64.6.255 · D. 115.64.5.128

115.64.7.64, 115.64.6.255, and 115.64.5.128 fall within the /22 CIDR block range.

Correct answer: B. Multiple users accessing resources

Resource sharing means multiple users access pooled resources, a key cloud computing characteristic.

Correct answer: A. Router(config)# interface fastethernet 0/0\nRouter(config-if)# no shut down\nRouter(config)#interface fastethernet 0/0.1\nRouter(config-subif)#encapsulation dot1q 10\nRouter(config-subif)# ip address 192.168.10.1 255.255.255.0\nRouter(config)# interface fastethernet 0/0.2\nRouter(config-subif)# encapsulation dot1q 20\nRouter(config-subif)# ip address 192.168.20.1 255.255.255.0 · B. Switch1(config)# interface fastethernet 0/1\nSwitch1(config-if)# switchport mode trunk

Router subinterfaces with VLANs and a trunked switch link enable inter-VLAN communication.

Correct answer: A. SwitchA, Fa0/2, designated · C. SwitchA, Fa0/1, root · D. SwitchD, Gi0/2, root

RSTP port roles depend on topology and switch positions. The question lacks sufficient details to definitively select the correct options.

Correct answer: C. (CONFIG-IF) #IP OSPF NETWORK POINT-to-POINT

C is correct as interface config mode is required. Trap: E uses 'Point-to-Point' which is invalid syntax.

Correct answer: A. Most efficient for multi-receiver delivery · D. Delivers multiple streams at once

Multicast is efficient for multi-receiver delivery but uses bandwidth proportional to streams.

Correct answer: E. Manager IP address

The command shows the SNMP manager's IP address, not the agent's details.

Correct answer: B. Blocks all traffic leaving E0

B is correct; the ACL lacks a 'permit' statement, blocking all traffic. Trap: A misstates source IP range.

Correct answer: A. 32768: 11-22-33-44-55-66

The switch with the lowest Bridge ID (BID) becomes the root bridge. Option A is correct as it has a lower BID than the others.

Correct answer: C. switch 0004.9A1A.C182

The switch with the lowest MAC address becomes the new root bridge in STP.

Correct answer: A. Network A – 172.16.3.128/25 · C. Link A – 172.16.3.0/30

The exhibit is not provided, so the answer cannot be verified without visual context.

Correct answer: B. Limits instability to one area · C. Offers detailed routing update control

OSPF is a link-state protocol, not an EGP, so 'A' and 'F' are incorrect.

Correct answer: A. Seven collision domains exist

The answer key is incorrect as it only provides one option for a two-part question. A diagram is needed to verify the number of collision and broadcast domains.