Free Cisco 200-301 CCNA practice questions

10 free Cisco 200-301 CCNA practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 1,395 questions. Work through them, then open each answer to check your reasoning.

Get all 1,395 questions (US$39) · Download these 10 as a PDF

Question 1

Refer to the exhibit.

Which type of route does R1 use to reach host 10.10.13.10/32?

Exhibit for question 1

  1. default route
  2. network route
  3. host route
  4. floating static route ✅Correct Answer: B, network route R1 forwards using the longest prefix that matches the destination. In the table the matching entry is the OSPF route 10.10.13.0/25 [110/6576] via 10.10.10.1, which covers 10.10.13.0 through 10.10.13.127. Because that entry represents a whole subnet rather than a single address, R1 reaches the host through a network route.
Show answer and explanation

The answer and explanation for this question are in the free sample PDF.

Question 2

Refer to the exhibit.

Which prefix does Router1 use for traffic to Host A?

Exhibit for question 2

  1. 10.10.10.0/28
  2. 10.10.13.0/25
  3. 10.10.13.144/28
  4. 10.10.13.208/29
Show answer and explanation

Correct answer: D. 10.10.13.208/29

Host A has IP address 10.10.13.214. Looking at Router1's routing table, multiple routes match this destination: 10.10.13.0/25 (covers 10.10.13.0-127), 10.10.13.128/28 (covers 10.10.13.128-143), 10.10.13.144/28 (covers 10.10.13.144-159), 10.10.13.160/29 (covers 10.10.13.160-167), and 10.10.13.208/29 (covers 10.10.13.208-215). Since 10.10.13.214 falls within the 10.10.13.208/29 range and this prefix has the longest match (29 bits), it is selected by the longest prefix match algorithm.

Why the other options are wrong

  • A. 10.10.10.0/28 does not contain 10.10.13.214; it covers a different subnet.
  • B. 10.10.13.0/25 matches but is less specific (shorter prefix) than 10.10.13.208/29.
  • C. 10.10.13.144/28 does not contain 10.10.13.214; it covers 10.10.13.144-159.

Question 3

A frame that enters a switch fails the Frame Check Sequence.

Which two interface counters are incremented? (Choose two.)

  1. input errors
  2. frame
  3. giants
  4. CRC
  5. runts
Show answer and explanation

Correct answer: A, D

A. input errors D. CRC A frame that fails the Frame Check Sequence is counted as a CRC error, so the 'CRC' counter increments, and because CRC errors are part of the total error count for received frames, 'input errors' increments as well. Both counters point to Layer 2 frame integrity problems such as bad cabling, duplex mismatch, or noise.

Why the other options are wrong

  • B. Frame counts only CRC errors with a non-integer octet count.
  • C. Giants counts oversized frames, not failed checksums.
  • E. Runts counts undersized frames, not failed checksums.

Question 4

How do TCP and UDP differ in the way that they establish a connection between two endpoints?

  1. TCP uses the three-way handshake, and UDP does not guarantee message delivery.
  2. TCP uses synchronization packets, and UDP uses acknowledgment packets.
  3. UDP provides reliable message transfer, and TCP is a connectionless protocol.
  4. UDP uses SYN, SYN ACK, and FIN bits in the frame header while TCP uses SYN, SYN ACK, and ACK bits.
Show answer and explanation

Correct answer: A. TCP uses the three-way handshake, and UDP does not guarantee message delivery.

TCP is connection oriented and opens a session with the three-way handshake (SYN, SYN-ACK, ACK), then confirms delivery with acknowledgments and retransmissions. UDP is connectionless: it sends datagrams with no handshake, no acknowledgments, and no guarantee that messages arrive or arrive in order.

Why the other options are wrong

  • B. UDP sends no acknowledgment packets; only TCP uses SYN and ACK segments.
  • C. This reverses the facts: TCP provides reliable transfer and UDP is the connectionless protocol.
  • D. UDP has no SYN, ACK, or FIN flags, and the handshake uses TCP header flags, not frame header bits.

Question 5

Which 802.11 frame type is Association Response?

  1. management
  2. protected frame
  3. action
  4. control
Show answer and explanation

Correct answer: A. management

Association Response is a management frame type in 802.11 wireless networks. Management frames handle connection establishment, authentication, and association between wireless devices and access points. Association Response specifically is sent by an AP in response to an association request from a client.

Why the other options are wrong

  • B. Protected frame refers to encrypted frames, not a frame type category.
  • C. Action frames are a specific management subtype used for signaling, not the category for Association Response.
  • D. Control frames handle RTS/CTS and acknowledgments, not association management.

Question 6

In which way does a spine-and-leaf architecture allow for scalability in a network when additional access ports are required?

  1. A spine switch and a leaf switch can be added with redundant connections between them.
  2. A spine switch can be added with at least 40 GB uplinks.
  3. A leaf switch can be added with connections to every spine switch.
  4. A leaf switch can be added with a single connection to a core spine switch.
Show answer and explanation

Correct answer: C. A leaf switch can be added with connections to every spine switch.

In a spine-and-leaf architecture, scalability is achieved by adding leaf switches that connect to every spine switch. This creates a non-blocking mesh topology where each new leaf switch can communicate with all spine switches, enabling horizontal scaling without oversubscription. This is the standard method for adding access ports in this design.

Why the other options are wrong

  • A. Adding spine switches is expensive and unnecessary for access port scaling.
  • B. Uplink specifications don't define scalability; the architecture itself does.
  • D. A single connection to one spine creates a bottleneck and defeats the purpose of the mesh topology.

Question 7

What identifies the functionality of virtual machines?

  1. The hypervisor communicates on Layer 3 without the need for additional resources.
  2. Each hypervisor supports a single virtual machine and a single software switch.
  3. The hypervisor virtualizes physical components including CPU, memory, and storage.
  4. Virtualized servers run efficiently when physically connected to a switch that is separate from the hypervisor.
Show answer and explanation

Correct answer: C. The hypervisor virtualizes physical components including CPU, memory, and storage.

The hypervisor's core function is to virtualize physical hardware components including CPU, memory, and storage, allowing multiple virtual machines to share physical resources. This abstraction layer enables efficient resource allocation and isolation between VMs, which is the fundamental capability that defines hypervisor functionality.

Why the other options are wrong

  • A. Hypervisors operate at Layer 2 and Layer 3, and require management resources.
  • B. Each hypervisor supports multiple virtual machines, not just one, and can support multiple virtual switches.
  • D. Virtual servers work efficiently with virtual networking; physical separation from the hypervisor is not required.

Question 8

Which command automatically generates an IPv6 address from a specified IPv6 prefix and MAC address of an interface?

  1. ipv6 address dhcp
  2. ipv6 address 2001:DB8:5:112::/64 eui-64
  3. ipv6 address autoconfig
  4. ipv6 address 2001:DB8:5:112::2/64 link-local
Show answer and explanation

Correct answer: B. ipv6 address 2001:DB8:5:112::/64 eui-64

The 'ipv6 address <prefix> eui-64' command automatically generates an IPv6 address by combining a specified IPv6 prefix with the EUI-64 identifier derived from the interface's MAC address. This creates a full /64 address without manual configuration of the host portion, using the MAC address as the basis for the interface ID.

Why the other options are wrong

  • A. DHCP requires a DHCP server; it doesn't generate from a MAC address.
  • C. Autoconfig uses stateless auto-configuration but does not specify a prefix like eui-64 does.
  • D. This specifies a full address with a link-local scope, not prefix-based auto-generation from MAC.

Question 9

When configuring IPv6 on an interface, which two IPv6 multicast groups are joined? (Choose two.)

  1. 2000::/3
  2. 2002::5
  3. FC00::/7
  4. FF02::1
  5. FF02::2
Show answer and explanation

Correct answer: D, E

D. FF02::1 E. FF02::2 When IPv6 is configured on an interface, it automatically joins two critical multicast groups: FF02::1 (All Nodes multicast address for local link communication) and FF02::2 (All Routers multicast address for router solicitation and advertisement). These groups enable fundamental IPv6 neighbor discovery and router communication on the link.

Why the other options are wrong

  • A. 2000::/3 is a global unicast address prefix, not a multicast group.
  • B. 2002::5 is a specific unicast address, not a standard multicast group.
  • C. FC00::/7 is the unique local address prefix, not a multicast group.

Question 10

What is the default behavior of a Layer 2 switch when a frame with an unknown destination MAC address is received?

  1. The Layer 2 switch forwards the packet and adds the destination MAC address to its MAC address table.
  2. The Layer 2 switch sends a copy of a packet to CPU for destination MAC address learning.
  3. The Layer 2 switch floods packets to all ports except the receiving port in the given VLAN.
  4. The Layer 2 switch drops the received frame. ✅Correct Answer: C, The Layer 2 switch floods packets to all ports except the receiving port in the given VLAN. A frame whose destination MAC is not in the MAC address table is an unknown unicast, so the switch floods it out every port in that VLAN except the port it arrived on. This is flooding, not broadcasting. The switch also learns the source MAC of that incoming frame and maps it to the receiving port.
Show answer and explanation

Answer and explanation for question 10

That was 10 of 1,395.

The full Cisco 200-301 CCNA pack has all 1,395 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack