kwizza
Cisco logo

Cisco CCNA (200-301) practice questions

8 sample questions from our 300-question CCNA bank — one from each official domain, with the answer and a full explanation under each. Every question is original, written against the published exam objectives, and quality-checked before it reaches you.

200-301AssociateIntermediate

Question 1 · Network Fundamentals

Marisol, a network technician at Verdant Sprouts Garden Centre, is assigned the block 172.22.48.0/21 for the greenhouse network. She must carve out a subnet that supports at least 500 irrigation sensors while wasting as few addresses as possible. Which subnet should she configure on the sensor VLAN?

  1. A.172.22.48.0/22
  2. B.172.22.48.0/25
  3. C.172.22.48.0/23
  4. D.172.22.48.0/24
Show answer & explanation

Answer: C

A /23 provides 512 total addresses and 510 usable hosts, which covers the 500 sensors with the least waste. A /22 would also fit but supplies 1022 usable hosts, consuming twice the address space unnecessarily, and a /24 tops out at 254 hosts.

Question 2 · Network Access

Anselm configures a link between two access switches at Ferngrove Publishing so it carries VLANs 30, 31 and 32. He runs: ``` SW-A(config)# interface gigabitethernet0/2 SW-A(config-if)# switchport mode trunk SW-A(config-if)# switchport trunk allowed vlan 30,31 ``` Later he needs VLAN 32 added without disturbing the existing VLANs. Which command achieves that?

  1. A.switchport trunk native vlan 32
  2. B.switchport trunk allowed vlan 32
  3. C.switchport access vlan 32
  4. D.switchport trunk allowed vlan add 32
Show answer & explanation

Answer: D

The add keyword appends VLAN 32 to the existing allowed list, preserving VLANs 30 and 31. Issuing switchport trunk allowed vlan 32 without add replaces the entire list and would black-hole traffic for the other two VLANs.

Question 3 · IP Connectivity

Router BRANCH-7 at Kestrel Marine Supply has the following routes to 10.60.14.0/24 available. Which entry does the router install in the routing table?

  1. A.An OSPF intra-area route with cost 22
  2. B.A RIP route with a hop count of 3
  3. C.A static route with administrative distance 1 via 203.0.113.9
  4. D.An EIGRP internal route with a feasible distance of 3072
Show answer & explanation

Answer: C

When several protocols offer the same prefix, the router compares administrative distance first, and a static route's default distance of 1 is lower than EIGRP's 90, OSPF's 110 and RIP's 120. Metrics such as OSPF cost or EIGRP feasible distance are only compared among routes from the same protocol.

Question 4 · IP Services

Devices at Ambleside Media log timestamps that drift several minutes apart, making correlation of security events unreliable. The engineer configures: ``` R1(config)# ntp server 198.51.100.44 R1(config)# clock timezone AST -4 ``` Which verification command confirms the router has synchronised with the source?

  1. A.show ntp status
  2. B.show ip ntp associations detail brief
  3. C.show logging timestamps
  4. D.show clock detail only
Show answer & explanation

Answer: A

The show ntp status command reports whether the clock is synchronised, the stratum, and the reference source, which directly answers the question. Show clock detail reveals only the current time and its source designation without confirming NTP peer synchronisation state.

Question 5 · Security Fundamentals

The security lead at Foxglove Credit Union wants remote administration of routers to be encrypted and to reject legacy cleartext sessions entirely. Which set of steps accomplishes this?

  1. A.Enable AAA with local authentication and leave the default transport input all
  2. B.Generate RSA keys, configure a domain name and local user, then set transport input ssh on the vty lines
  3. C.Configure an enable secret and set transport input telnet ssh on the vty lines
  4. D.Apply an access class to the vty lines permitting only the management subnet
Show answer & explanation

Answer: B

SSH requires a hostname, domain name and RSA key pair, and restricting transport input to ssh alone prevents any cleartext Telnet session from being accepted. Permitting telnet alongside ssh, or leaving transport input all, still exposes an unencrypted administration path.

Question 6 · Automation and Programmability

The automation team at Sable Ridge Networks calls a controller API and receives a body beginning with `{"response": [{"hostname": "edge-04", "reachabilityStatus": "Reachable"}]}`. Which data format is in use, and what characterizes it?

  1. A.JSON, which represents data as key-value pairs with objects in braces and arrays in brackets
  2. B.YAML, which represents nesting through indentation without punctuation delimiters
  3. C.CSV, which represents records as comma-separated fields with a header row
  4. D.XML, which represents data using opening and closing element tags
Show answer & explanation

Answer: A

The braces, quoted keys and bracketed list are the defining syntax of JSON, the format most REST APIs return. XML would wrap each value in paired tags such as <hostname>edge-04</hostname>, which is absent here.

Question 7 · Network Fundamentals

At Halden Freight Logistics, a fibre run between two buildings is 900 metres. The design team must pick a switch uplink transceiver that can span the distance over single-mode fibre at 1 Gbps. Which transceiver type fits the requirement?

  1. A.1000BASE-LX/LH SFP
  2. B.1000BASE-T SFP
  3. C.1000BASE-SX SFP
  4. D.10GBASE-CU direct-attach copper cable
Show answer & explanation

Answer: A

1000BASE-LX/LH uses 1310 nm optics over single-mode fibre and reaches roughly 10 km, comfortably covering 900 metres. 1000BASE-SX is a multimode short-reach optic limited to about 550 metres, so it cannot span the run on single-mode fibre.

Question 8 · Network Access

Two switches at Ashgate Veterinary Hospital are cabled together, but the trunk carries no traffic for VLAN 45. The engineer collects: ``` SW-CORE# show interfaces trunk Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Port Vlans allowed and active in management domain Gi0/1 1,10,20 ``` What is the most likely reason VLAN 45 traffic is not crossing the link?

  1. A.The native VLAN mismatch between the two switches is blocking tagged frames
  2. B.VLAN 45 is not defined in the local VLAN database or is not in the allowed list
  3. C.Dynamic Trunking Protocol has placed the port in dynamic auto mode
  4. D.The trunk is running ISL, which cannot carry extended-range VLANs
Show answer & explanation

Answer: B

The allowed-and-active list shows only VLANs 1, 10 and 20, meaning VLAN 45 is either absent from the VLAN database or excluded by the allowed list, so the switch never forwards it on the trunk. A native VLAN mismatch would generate CDP error messages and affect untagged traffic, not silently omit VLAN 45 from the active list.

292+ more questions, free

Full-length, timed or practice mode, weighted to the official blueprint — with per-domain scoring so you know exactly where you stand.

Start the full practice exam →

All questions are original — never reproduced from the real exam — and pass automated duplicate, citation and item-writing checks before publication. See how our exams are made.

Kwizza is an independent study tool and is not affiliated with, endorsed by, or sponsored by Cisco. Cisco names, logos and certification marks are the property of their respective owners and are used here only to identify the exam described. Practice questions are original, written against the publicly published exam objectives — no real exam content is reproduced.