Cisco CCNA 200-301 v1.1 & NetAcad v7.02 / v8 Exam Portal

Verified Final Exam Answers, Interactive Practice Mode, IOS CLI Cheat Sheets & Packet Tracer (.PKA) Labs.

Home » Verified Interactive Exam Module

Cisco CCNA 200-301 v1.1 Full Mock Exam (81 Verified Questions + Explanations 2026)

Updated: October 17, 2026 • Tip: Click any option (A, B, C, D) to check your answer instantly!

Take our full-length 81-Question Cisco CCNA 200-301 v1.1 Certification Practice Exam covering all 6 official blueprint domains including Generative/Predictive AI, Ansible, Terraform, OSPF, RSTP, WLC, and Security.

📥 Download Cisco CCNA 200-301 v1.1 Full Mock Exam (81 Verified Questions + Explanations 2026) Packet Tracer (.PKA) & Verified PDF Guide

Includes complete Cisco NetAcad v7.02 / v8 topology file (.pka) and IOS CLI configuration script.

Verified Cisco NetAcad Exam Questions (91 Core Questions + Explanations)

Question 1 Which interface allows remote management of a Layer 2 switch?
  • A. The AUX interface
  • B. The console port interface
  • C. The switch virtual interface (SVI)
  • D. The first Ethernet port interface
✔ Correct Answer: C. The switch virtual interface (SVI)
Technical Explanation: A Layer 2 switch uses a Switch Virtual Interface (SVI), such as interface VLAN 1 or a dedicated management VLAN interface, assigned with an IPv4/IPv6 address to allow remote management over Telnet/SSH.
Question 2 What function does pressing the Tab key have when entering a command in IOS?
  • A. It aborts the current command and returns to configuration mode.
  • B. It exits configuration mode and returns to user EXEC mode.
  • C. It moves the cursor to the beginning of the next line.
  • D. It completes the remainder of a partially typed word in a command.
✔ Correct Answer: D. It completes the remainder of a partially typed word in a command.
Technical Explanation: Pressing the Tab key in the Cisco IOS CLI auto-completes a partially typed command keyword if enough characters have been typed to make it unique.
Question 3 While trying to solve a network issue, a technician made multiple changes to the current router configuration file. The changes did not solve the problem and were not saved. What action can the technician take to discard the changes and work with the file in NVRAM?
  • A. Issue the 'reload' command without saving the running configuration.
  • B. Delete the vlan.dat file and reboot the device.
  • C. Close and reopen the terminal emulation software.
  • D. Issue the 'copy startup-config running-config' command.
✔ Correct Answer: A. Issue the 'reload' command without saving the running configuration.
Technical Explanation: Issuing 'copy startup-config running-config' merges the two configs rather than overwriting. To completely discard unsaved changes in RAM and load the clean configuration from NVRAM, issue the 'reload' command and decline saving changes.
Question 4 Which two traffic types use the Real-Time Transport Protocol (RTP)? (Choose two.)
  • A. Video
  • B. Web
  • C. File transfer
  • D. Voice
  • E. Peer-to-peer
✔ Correct Answer: A. Video & D. Voice
Technical Explanation: RTP operates over UDP to carry latency-sensitive streaming media such as Voice over IP (VoIP) and video teleconferencing.
Question 5 Which layer of the TCP/IP model provides a route to forward messages through an internetwork?
  • A. Application
  • B. Network Access
  • C. Internet
  • D. Transport
✔ Correct Answer: C. Internet
Technical Explanation: The TCP/IP Internet layer corresponds to the OSI Network layer (Layer 3) and handles logical IP addressing and packet routing across networks.
Question 6 What is a characteristic of fault-tolerant networks?
  • A. They protect data from unauthorized access.
  • B. They have redundant links that rapidly reroute traffic if a primary path fails.
  • C. They can expand quickly to support new users without degrading performance.
  • D. They prioritize voice traffic over web traffic.
✔ Correct Answer: B. They have redundant links that rapidly reroute traffic if a primary path fails.
Technical Explanation: Fault tolerance relies on redundant hardware and alternate paths in a packet-switched network so that a single point of failure does not interrupt communications.
Question 7 Which command encrypts all plaintext passwords in the running-config file on a Cisco router or switch?
  • A. enable secret
  • B. service password-encryption
  • C. security passwords min-length 10
  • D. crypto key generate rsa
✔ Correct Answer: B. service password-encryption
Technical Explanation: The 'service password-encryption' global configuration command applies weak Type 7 obfuscation to all unencrypted passwords (console, VTY, aux) in the configuration output.
Question 8 What is the Protocol Data Unit (PDU) associated with the Data Link layer (Layer 2) of the OSI model?
  • A. Segment
  • B. Packet
  • C. Frame
  • D. Bits
✔ Correct Answer: C. Frame
Technical Explanation: OSI PDUs from Layer 4 down to Layer 1 are: Segment/Datagram (Layer 4 - Transport), Packet (Layer 3 - Network), Frame (Layer 2 - Data Link), and Bits (Layer 1 - Physical).
Question 9 Which type of network topology lets an administrator see the actual physical location of intermediary devices and cable installations?
  • A. Logical topology
  • B. Physical topology
  • C. Subnet topology
  • D. VLAN topology
✔ Correct Answer: B. Physical topology
Technical Explanation: A physical topology diagram illustrates the physical placement of racks, cabling, rooms, and ports, whereas a logical topology shows IP schemes, VLANs, and routing boundaries.
Question 10 Why would a Layer 2 switch need an IP address configured on an SVI?
  • A. To enable the switch to route packets between different VLANs.
  • B. To enable the switch to be managed remotely via SSH or Telnet.
  • C. To allow connected PCs to use the switch as their default gateway.
  • D. To enable the switch to build its MAC address table.
✔ Correct Answer: B. To enable the switch to be managed remotely via SSH or Telnet.
Technical Explanation: A Layer 2 switch switches frames based solely on MAC addresses, so its IP address is strictly for remote management access (SSH, Telnet, SNMP, HTTP).
Question 11 What command is used to verify the condition of the switch interfaces, including the status of the interfaces and a configured IP address?
  • A. ipconfig
  • B. ping
  • C. traceroute
  • D. show ip interface brief
✔ Correct Answer: D. show ip interface brief
Technical Explanation: 'show ip interface brief' provides a concise summary of all router/switch interfaces, their assigned IPv4 addresses, Layer 1 Status, and Layer 2 Protocol state.
Question 12 Which access method would be most appropriate if you are in the equipment room with a new switch that needs to be configured for the first time?
  • A. Console
  • B. Telnet
  • C. SSH
  • D. AUX
✔ Correct Answer: A. Console
Technical Explanation: Out-of-band serial or USB console access is required for initial configuration of a brand-new switch that has no IP address or active network interfaces.
Question 13 What happens when part of an Internet transmission is not delivered to the destination in a TCP-based communication?
  • A. The entire message is dropped and the connection is reset.
  • B. The source is notified via ICMP and stops sending.
  • C. Only the missing TCP segments are retransmitted by the source.
  • D. The destination reconstructs the missing bytes using FCS.
✔ Correct Answer: C. Only the missing TCP segments are retransmitted by the source.
Technical Explanation: TCP uses sequence numbers and acknowledgments (ACKs) to track segment delivery and reliably retransmit only lost segments.
Question 14 Which organization is responsible for overseeing the allocation of IPv4 and IPv6 addresses and managing DNS root zones globally?
  • A. IEEE
  • B. IANA / ICANN
  • C. EIA/TIA
  • D. ITU-T
✔ Correct Answer: B. IANA / ICANN
Technical Explanation: IANA (operated by ICANN) coordinates global IP address allocation to Regional Internet Registries (RIRs), protocol parameters, and DNS root zone management.
Question 15 A user is implementing security on a small office network. Which two actions would provide the minimum security requirements for this network? (Choose two.)
  • A. Installing a wireless network
  • B. Implementing a firewall and antivirus software
  • C. Adding a dedicated intrusion prevention device
  • D. Switching to fiber-optic cabling
  • E. Disabling DHCP
✔ Correct Answer: B. Implementing a firewall and antivirus software
Technical Explanation: For a SOHO/small office environment, host-based antivirus/antimalware software combined with a stateful network firewall provides essential baseline security.
Question 16 What is the purpose of the FCS field in an Ethernet frame?
  • A. To obtain the MAC address of the sending node
  • B. To verify the logical address of the sending node
  • C. To compute the CRC header for the data field
  • D. To determine if errors occurred in the transmission and reception of the frame
✔ Correct Answer: D. To determine if errors occurred in the transmission and reception of the frame
Technical Explanation: The Frame Check Sequence (FCS) trailer uses a 32-bit Cyclic Redundancy Check (CRC) calculation so the receiving NIC can detect corrupted frames and drop them.
Question 17 Which switching method drops frames that fail the FCS check?
  • A. Store-and-forward switching
  • B. Cut-through switching
  • C. Fast-forward switching
  • D. Borderless switching
✔ Correct Answer: A. Store-and-forward switching
Technical Explanation: Store-and-forward switching buffers the entire Ethernet frame, calculates the CRC against the FCS trailer, and discards any corrupted frames or runts/giants before forwarding.
Question 18 What is the auto-MDIX feature on a Cisco Catalyst switch?
  • A. Automatic configuration of an interface for 10/100/1000 Mb/s operation
  • B. Automatic configuration of an interface for a straight-through or a crossover Ethernet cable connection
  • C. Automatic configuration of full-duplex operation over a single optical cable
  • D. The ability to turn a switch interface on or off if a loop is detected
✔ Correct Answer: B. Automatic configuration of an interface for a straight-through or a crossover Ethernet cable connection
Technical Explanation: Auto-MDIX detects the required cable pinout (transmit/receive pairs) and automatically adjusts the port internally, eliminating the need to worry about crossover vs. straight-through cables.
Question 19 What will a host on an Ethernet network do if it receives a frame with a unicast destination MAC address that does not match its own MAC address?
  • A. It will discard the frame.
  • B. It will forward the frame to the next host.
  • C. It will remove the frame from the media.
  • D. It will strip off the data-link frame to check the destination IP address.
✔ Correct Answer: A. It will discard the frame.
Technical Explanation: When a NIC receives an Ethernet frame whose destination MAC does not match the NIC's burned-in MAC, broadcast (FF-FF-FF-FF-FF-FF), or subscribed multicast MAC, it drops the frame at Layer 2 without interrupting the CPU.
Question 20 Which two statements describe the features or functions of the Logical Link Control (LLC) sublayer in Ethernet standards? (Choose two.)
  • A. Logical Link Control is implemented in software.
  • B. Logical Link Control is specified in the IEEE 802.3 standard.
  • C. The LLC sublayer adds a header and a trailer to the data.
  • D. The Data Link layer uses LLC to communicate with the upper layers of the protocol suite.
  • E. LLC is responsible for the placement and retrieval of frames on and off the media.
✔ Correct Answer: A. Logical Link Control is implemented in software. & D. The Data Link layer uses LLC to communicate with the upper layers of the protocol suite.
Technical Explanation: The IEEE 802.2 LLC sublayer is implemented in software/drivers and identifies which Network Layer protocol (IPv4, IPv6, ARP) is encapsulated inside the frame.
Question 21 What is the minimum Ethernet frame size that will not be discarded by the receiver as a runt frame?
  • A. 46 bytes
  • B. 64 bytes
  • C. 128 bytes
  • D. 1518 bytes
✔ Correct Answer: B. 64 bytes
Technical Explanation: The valid IEEE 802.3 Ethernet frame size ranges from 64 bytes (minimum) to 1518 bytes (maximum, excluding VLAN tagging). Any frame smaller than 64 bytes is discarded as a collision fragment (runt).
Question 22 How does a Layer 2 switch build its MAC address table?
  • A. By inspecting the destination MAC address of incoming frames.
  • B. By inspecting the source MAC address of incoming frames and recording the ingress port.
  • C. By sending ARP broadcasts out all active switch ports.
  • D. By downloading the table from the default gateway router.
✔ Correct Answer: B. By inspecting the source MAC address of incoming frames and recording the ingress port.
Technical Explanation: Switches learn MAC addresses dynamically by reading the Source MAC address of every incoming frame and mapping it to the ingress port in the CAM table.
Question 23 What is the special destination MAC address used by an IPv4 broadcast Ethernet frame?
  • A. 00-00-00-00-00-00
  • B. FF-FF-FF-FF-FF-FF
  • C. 01-00-5E-00-00-01
  • D. 33-33-00-00-00-01
✔ Correct Answer: B. FF-FF-FF-FF-FF-FF
Technical Explanation: An Ethernet broadcast frame uses a destination MAC address of all 1s in binary (FF-FF-FF-FF-FF-FF in hexadecimal), which causes switches to flood it out all ports in the VLAN.
Question 24 What is the primary benefit of twisting the wire pairs inside a UTP Ethernet cable?
  • A. It makes the copper wires stronger against physical pulling.
  • B. It reduces crosstalk and electromagnetic interference (EMI/RFI) through magnetic field cancellation.
  • C. It allows more wires to fit inside an RJ-45 connector.
  • D. It increases the voltage level of the electrical signal.
✔ Correct Answer: B. It reduces crosstalk and electromagnetic interference (EMI/RFI) through magnetic field cancellation.
Technical Explanation: Twisting opposing circuit wires together causes their electromagnetic fields to cancel each other out, protecting the signal from external EMI and internal pair-to-pair crosstalk.
Question 25 Why is Single-Mode Fiber (SMF) preferred over Multimode Fiber (MMF) for long-distance campus backbones and WAN links?
  • A. SMF uses cheaper LED light sources.
  • B. SMF has a much larger core diameter (62.5 microns).
  • C. SMF uses a laser light source and a single light path (9-micron core), eliminating modal dispersion over distances up to tens of kilometers.
  • D. SMF does not require glass cladding.
✔ Correct Answer: C. SMF uses a laser light source and a single light path (9-micron core), eliminating modal dispersion over distances up to tens of kilometers.
Technical Explanation: Single-mode fiber has a tiny 9-micron core that allows only a single ray of laser light to travel straight down the fiber, preventing dispersion and supporting long-haul links.
Question 26 What is the default aging timer for dynamic entries in a Cisco Catalyst switch MAC address table?
  • A. 30 seconds
  • B. 180 seconds
  • C. 300 seconds (5 minutes)
  • D. 3600 seconds (1 hour)
✔ Correct Answer: C. 300 seconds (5 minutes)
Technical Explanation: By default, Cisco switches keep dynamically learned MAC address entries in the CAM table for 300 seconds (5 minutes) after the last frame is received from that source MAC.
Question 27 Which cut-through switching method offers the lowest latency by forwarding a frame immediately after reading the 6-byte destination MAC address?
  • A. Fragment-free switching
  • B. Fast-forward switching
  • C. Store-and-forward switching
  • D. CRC-checked switching
✔ Correct Answer: B. Fast-forward switching
Technical Explanation: Fast-forward switching begins forwarding the frame as soon as the destination MAC address is read, offering the lowest possible latency (whereas fragment-free waits for the first 64 bytes).
Question 28 Which Layer 2 media access control method is used by 802.11 Wireless LANs (Wi-Fi) to avoid collisions on shared half-duplex radio frequencies?
  • A. CSMA/CD
  • B. CSMA/CA
  • C. Token Passing
  • D. Full-Duplex Point-to-Point
✔ Correct Answer: B. CSMA/CA
Technical Explanation: Wireless networks operate in half-duplex and cannot detect collisions while transmitting, so they use Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) and RTS/CTS.
Question 29 What happens when one side of an Ethernet link is configured for Full-Duplex and the other side is set to Half-Duplex?
  • A. The link automatically negotiates 10 Gbps speed.
  • B. A duplex mismatch occurs, causing late collisions, FCS errors, and severely degraded throughput.
  • C. Both ports immediately enter the err-disabled state.
  • D. The link converts to a Layer 3 routed port.
✔ Correct Answer: B. A duplex mismatch occurs, causing late collisions, FCS errors, and severely degraded throughput.
Technical Explanation: A duplex mismatch causes the full-duplex end to transmit at any time while the half-duplex end sees simultaneous transmissions as collisions, resulting in late collisions and packet loss.
Question 30 Which destination MAC address prefix is reserved for IPv4 multicast frames?
  • A. 01-00-5E
  • B. 33-33-00
  • C. FF-FF-FF
  • D. FE-80-00
✔ Correct Answer: A. 01-00-5E
Technical Explanation: IPv4 multicast packets map their lower 23 bits into the Ethernet MAC address prefix 01-00-5E-xx-xx-xx (whereas IPv6 multicast uses 33-33-xx-xx-xx-xx).
Question 31 When a router forwards an IPv4 packet from one interface to another on the path toward a remote destination, which two header fields change at every hop? (Choose two.)
  • A. Source IPv4 Address
  • B. Destination IPv4 Address
  • C. Source and Destination Layer 2 MAC Addresses
  • D. IPv4 Time-to-Live (TTL) and Header Checksum
  • E. TCP Destination Port
✔ Correct Answer: C. Source and Destination Layer 2 MAC Addresses & D. IPv4 Time-to-Live (TTL) and Header Checksum
Technical Explanation: Source and Destination IP addresses remain constant end-to-end (unless NAT is performed). At each router hop, the Layer 2 frame is stripped and rewritten with new source/destination MAC addresses, and the IPv4 TTL is decremented by 1 (requiring a new IPv4 Header Checksum).
Question 32 What is the primary enhancement in the IPv6 packet header compared to the IPv4 header?
  • A. IPv6 adds a variable-length Options field to every packet.
  • B. IPv6 uses a simplified, fixed 40-byte header with fewer fields and no header checksum, improving router forwarding efficiency.
  • C. IPv6 reduces the address size from 128 bits to 32 bits.
  • D. IPv6 requires routers to fragment oversized packets en route.
✔ Correct Answer: B. IPv6 uses a simplified, fixed 40-byte header with fewer fields and no header checksum, improving router forwarding efficiency.
Technical Explanation: IPv6 removes unnecessary fields (including the Header Checksum and router fragmentation fields) to create a fixed 40-byte header that hardware routers process much faster.
Question 33 What is the purpose of the Address Resolution Protocol (ARP) in an IPv4 network?
  • A. To resolve a known domain name (FQDN) into an IPv4 address.
  • B. To resolve a known IPv4 address on the local subnet into its corresponding Layer 2 MAC address.
  • C. To dynamically assign IPv4 addresses to new hosts.
  • D. To discover the MAC address of a remote web server across the Internet.
✔ Correct Answer: B. To resolve a known IPv4 address on the local subnet into its corresponding Layer 2 MAC address.
Technical Explanation: ARP broadcasts an ARP Request on the local LAN ('Who has IP X?') to discover the 48-bit Ethernet MAC address required to encapsulate the Layer 2 frame.
Question 34 If PC1 (192.168.1.10/24) wants to send a packet to a web server at 203.0.113.50, what destination MAC address will PC1 place in the Ethernet frame header?
  • A. The MAC address of the web server 203.0.113.50
  • B. The broadcast MAC address FF-FF-FF-FF-FF-FF
  • C. The MAC address of PC1's Default Gateway router interface (e.g., 192.168.1.1)
  • D. The MAC address of the local DNS server
✔ Correct Answer: C. The MAC address of PC1's Default Gateway router interface (e.g., 192.168.1.1)
Technical Explanation: When the destination IP is on a remote network, the host encapsulates the packet inside a Layer 2 frame addressed to the MAC address of its local Default Gateway router.
Question 35 In the output of 'show ip route' on a Cisco router, what do the codes 'C' and 'L' indicate?
  • A. 'C' indicates a directly connected network subnet; 'L' indicates the specific /32 local IPv4 address assigned to the router interface.
  • B. 'C' indicates a Cisco proprietary route; 'L' indicates a legacy RIP route.
  • C. 'C' indicates a converged OSPF route; 'L' indicates a loopback-only route.
  • D. 'C' indicates a static default route; 'L' indicates a link-local route.
✔ Correct Answer: A. 'C' indicates a directly connected network subnet; 'L' indicates the specific /32 local IPv4 address assigned to the router interface.
Technical Explanation: Since Cisco IOS 15+, activating an interface with an IP address adds two entries to the routing table: 'C' (Connected network prefix) and 'L' (Local host route with a /32 mask for the interface's own IP).
Question 36 Which protocol replaces IPv4 ARP in an IPv6 network by using ICMPv6 Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages?
  • A. DHCPv6
  • B. Neighbor Discovery Protocol (NDP)
  • C. OSPFv3
  • D. NAT64
✔ Correct Answer: B. Neighbor Discovery Protocol (NDP)
Technical Explanation: IPv6 eliminates broadcast ARP and uses ICMPv6 Neighbor Discovery Protocol (NDP) with solicited-node multicast addresses to resolve IPv6 addresses to MAC addresses.
Question 37 What is a security risk associated with ARP broadcasts on a local Ethernet LAN?
  • A. Threat actors can send gratuitous/forged ARP replies to poison the ARP cache of hosts (ARP Spoofing / Man-in-the-Middle attack).
  • B. ARP requests automatically traverse WAN routers across the Internet.
  • C. ARP encrypts traffic using weak DES keys.
  • D. ARP disables port security on Catalyst switches.
✔ Correct Answer: A. Threat actors can send gratuitous/forged ARP replies to poison the ARP cache of hosts (ARP Spoofing / Man-in-the-Middle attack).
Technical Explanation: Because ARP is stateless and unauthenticated, an attacker on the LAN can send spoofed ARP replies claiming to have the Default Gateway's IP address, intercepting all traffic.
Question 38 Which command must be entered on a Cisco router before it will forward IPv6 packets between interfaces?
  • A. ip routing
  • B. ipv6 unicast-routing
  • C. ipv6 enable
  • D. no ipv6 shutdown
✔ Correct Answer: B. ipv6 unicast-routing
Technical Explanation: By default, Cisco IOS routers forward IPv4 packets automatically, but IPv6 routing is disabled until the 'ipv6 unicast-routing' global configuration command is entered.
Question 39 What happens to an IPv4 packet when its Time-to-Live (TTL) field reaches zero at a router?
  • A. The router resets the TTL to 255 and forwards the packet.
  • B. The router drops the packet and sends an ICMP Time Exceeded message back to the source IP address.
  • C. The router buffers the packet until the destination responds.
  • D. The router floods the packet out all interfaces.
✔ Correct Answer: B. The router drops the packet and sends an ICMP Time Exceeded message back to the source IP address.
Technical Explanation: To prevent infinite routing loops, every router decrements TTL by 1. If TTL reaches 0, the router discards the packet and returns an ICMPv4 Type 11 (Time Exceeded) message to the sender.
Question 40 Which field in the IPv6 header is equivalent to the IPv4 Time-to-Live (TTL) field?
  • A. Next Header
  • B. Hop Limit
  • C. Flow Label
  • D. Traffic Class
✔ Correct Answer: B. Hop Limit
Technical Explanation: IPv6 renames the 8-bit TTL field to 'Hop Limit', which accurately reflects its function of counting router hops rather than seconds.
Question 41 When configuring a router GigabitEthernet interface, which command activates the physical port from its default 'administratively down' state?
  • A. enable
  • B. active
  • C. no shutdown
  • D. port up
✔ Correct Answer: C. no shutdown
Technical Explanation: Unlike switch ports (which are active by default), Cisco router interfaces are shut down by default and require the 'no shutdown' interface configuration command.
Question 42 Which command on a Windows PC displays the local routing table?
  • A. ipconfig /all
  • B. netstat -r (or route print)
  • C. arp -a
  • D. tracert
✔ Correct Answer: B. netstat -r (or route print)
Technical Explanation: Running 'netstat -r' or 'route print' in Windows Command Prompt displays the host's IPv4 and IPv6 routing tables, including the active default gateway (0.0.0.0/0).
Question 43 How many usable host IPv4 addresses are available on the 192.168.10.128/26 subnet?
  • A. 30
  • B. 62
  • C. 64
  • D. 126
✔ Correct Answer: B. 62
Technical Explanation: A /26 mask leaves 6 host bits (32 - 26 = 6). Total usable hosts = 2^6 - 2 = 64 - 2 = 62 hosts (range 192.168.10.129 to 192.168.10.190, broadcast 192.168.10.191).
Question 44 What is the subnet address and broadcast address for a host with the IPv4 address 172.16.45.200/27?
  • A. Network: 172.16.45.192, Broadcast: 172.16.45.223
  • B. Network: 172.16.45.128, Broadcast: 172.16.45.255
  • C. Network: 172.16.45.192, Broadcast: 172.16.45.207
  • D. Network: 172.16.45.0, Broadcast: 172.16.45.255
✔ Correct Answer: A. Network: 172.16.45.192, Broadcast: 172.16.45.223
Technical Explanation: A /27 prefix increments in blocks of 32 in the fourth octet (0, 32, 64, 96, 128, 160, 192, 224). Therefore, 200 falls inside the 172.16.45.192/27 subnet, whose broadcast is 172.16.45.223.
Question 45 Which three IPv4 address ranges are reserved by RFC 1918 for private internal networks and cannot be routed on the public Internet? (Choose three.)
  • A. 10.0.0.0/8
  • B. 172.16.0.0/12 (172.16.0.0 – 172.31.255.255)
  • C. 192.168.0.0/16
  • D. 169.254.0.0/16
  • E. 127.0.0.0/8
  • F. 224.0.0.0/4
✔ Correct Answer: A. 10.0.0.0/8, B. 172.16.0.0/12, C. 192.168.0.0/16
Technical Explanation: RFC 1918 defines three private IPv4 blocks: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. (169.254.0.0/16 is APIPA link-local, and 127.0.0.0/8 is loopback).
Question 46 What is the fully compressed representation of the IPv6 address 2001:0db8:0000:0000:0ab0:0000:0000:0100?
  • A. 2001:db8::ab0::100
  • B. 2001:db8::ab0:0:0:100
  • C. 2001:db8:0:0:ab:0:0:1
  • D. 2001:0db8::ab0:0:0:0100
✔ Correct Answer: B. 2001:db8::ab0:0:0:100
Technical Explanation: Rule 1: Omit leading zeros in each hextet (0db8 -> db8, 0ab0 -> ab0, 0100 -> 100, but never omit trailing zeros!). Rule 2: Use the double colon (::) only ONCE in an address to replace a contiguous string of all-zero hextets.
Question 47 Which IPv6 address type is used for one-to-nearest communication, where multiple devices share the same address and routers forward packets to the closest interface?
  • A. Unicast
  • B. Multicast
  • C. Anycast
  • D. Broadcast
✔ Correct Answer: C. Anycast
Technical Explanation: IPv6 Anycast assigns the same unicast IPv6 address to multiple servers (such as DNS root servers), and routing protocols route client requests to the topologically nearest server.
Question 48 When an IPv6 host uses SLAAC (Stateless Address Autoconfiguration) to configure its own Global Unicast Address without a DHCPv6 server, which ICMPv6 message does it receive from the local router?
  • A. Router Solicitation (RS)
  • B. Router Advertisement (RA)
  • C. Neighbor Solicitation (NS)
  • D. Echo Reply
✔ Correct Answer: B. Router Advertisement (RA)
Technical Explanation: In SLAAC, the host sends an ICMPv6 Router Solicitation (RS) to FF02::2 (All-Routers multicast), and the router responds with a Router Advertisement (RA) containing the /64 network prefix and default gateway.
Question 49 Which subnet mask is best suited for a point-to-point WAN link between two routers to conserve IPv4 addresses while supporting broadcast?
  • A. 255.255.255.0 (/24)
  • B. 255.255.255.240 (/28)
  • C. 255.255.255.252 (/30)
  • D. 255.255.255.128 (/25)
✔ Correct Answer: C. 255.255.255.252 (/30)
Technical Explanation: A /30 mask (255.255.255.252) provides 2^2 - 2 = 2 usable host IP addresses, which is ideal for a point-to-point link between two router interfaces without wasting IPs.
Question 50 A Windows PC fails to contact a DHCPv4 server and automatically assigns itself the address 169.254.21.55/16. What type of address is this?
  • A. RFC 1918 Private Address
  • B. APIPA (Automatic Private IP Addressing) Link-Local Address
  • C. Loopback Address
  • D. Public Routable Address
✔ Correct Answer: B. APIPA (Automatic Private IP Addressing) Link-Local Address
Technical Explanation: When a DHCPv4 client cannot reach a DHCP server, Windows uses APIPA to self-assign a link-local address from the 169.254.0.0/16 block.
Question 51 Which ICMP message type is used by both the 'ping' and 'traceroute' utilities to test network reachability?
  • A. Destination Unreachable and Time Exceeded
  • B. Echo Request (Type 8) and Echo Reply (Type 0)
  • C. Router Solicitation and Router Advertisement
  • D. Source Quench
✔ Correct Answer: B. Echo Request (Type 8) and Echo Reply (Type 0)
Technical Explanation: Ping (and Windows tracert) sends ICMP Echo Request messages and listens for ICMP Echo Reply (or ICMP Time Exceeded from intermediate hops).
Question 52 What is the prefix length and hexadecimal prefix for IPv6 Unique Local Addresses (ULAs), which are the IPv6 equivalent of IPv4 private addresses?
  • A. 2000::/3
  • B. FE80::/10
  • C. FC00::/7 (commonly FD00::/8)
  • D. FF00::/8
✔ Correct Answer: C. FC00::/7 (commonly FD00::/8)
Technical Explanation: IPv6 Unique Local Addresses (FC00::/7, typically starting with FD) are used for internal site addressing and are not routable on the global IPv6 Internet.
Question 53 In VLSM (Variable Length Subnet Masking), why must you always allocate subnets starting from the largest host requirement down to the smallest?
  • A. To prevent overlapping address blocks and ensure proper boundary alignment.
  • B. Because Cisco routers only accept /24 masks first.
  • C. To force all WAN links into the first subnet.
  • D. Because DHCP servers cannot lease addresses from small subnets.
✔ Correct Answer: A. To prevent overlapping address blocks and ensure proper boundary alignment.
Technical Explanation: Sorting subnet requirements from largest to smallest ensures each block aligns cleanly on its bit boundary without overlapping previously assigned smaller subnets.
Question 54 Which two characteristics describe UDP (User Datagram Protocol) compared to TCP? (Choose two.)
  • A. Connectionless transport with low overhead (8-byte header)
  • B. Guaranteed delivery using three-way handshakes and windowing
  • C. Best-effort delivery with no retransmission of lost datagrams
  • D. Flow control via sliding windows
  • E. Sequencing and acknowledgment of every packet
✔ Correct Answer: A. Connectionless transport with low overhead (8-byte header) & C. Best-effort delivery with no retransmission of lost datagrams
Technical Explanation: UDP is a lightweight, connectionless Layer 4 protocol with an 8-byte header that does not establish sessions or retransmit dropped packets, making it ideal for DNS, DHCP, VoIP, and TFTP.
Question 55 What are the three steps of the TCP Three-Way Handshake used to establish a reliable session?
  • A. SYN -> ACK -> FIN
  • B. SYN -> SYN-ACK -> ACK
  • C. REQUEST -> OFFER -> ACK
  • D. HELLO -> INIT -> FULL
✔ Correct Answer: B. SYN -> SYN-ACK -> ACK
Technical Explanation: The client sends a SYN segment, the server replies with a SYN-ACK segment, and the client completes the handshake with an ACK segment.
Question 56 Which well-known port numbers are used by HTTP, HTTPS, SSH, Telnet, and DNS respectively?
  • A. HTTP: 80, HTTPS: 443, SSH: 22, Telnet: 23, DNS: 53
  • B. HTTP: 21, HTTPS: 8080, SSH: 23, Telnet: 22, DNS: 67
  • C. HTTP: 80, HTTPS: 443, SSH: 25, Telnet: 110, DNS: 161
  • D. HTTP: 443, HTTPS: 80, SSH: 20, Telnet: 21, DNS: 53
✔ Correct Answer: A. HTTP: 80, HTTPS: 443, SSH: 22, Telnet: 23, DNS: 53
Technical Explanation: Memorizing well-known TCP/UDP ports is mandatory for CCNA: FTP (20/21), SSH (22), Telnet (23), SMTP (25), DNS (53 TCP/UDP), DHCP (67/68 UDP), TFTP (69 UDP), HTTP (80), POP3 (110), SNMP (161/162), HTTPS (443).
Question 57 What is the correct four-step order of messages exchanged when a client obtains an IPv4 address from a DHCPv4 server?
  • A. DHCPDISCOVER -> DHCPOFFER -> DHCPREQUEST -> DHCPACK (DORA)
  • B. DHCPREQUEST -> DHCPOFFER -> DHCPACK -> DHCPFIN
  • C. DHCPOFFER -> DHCPDISCOVER -> DHCPREQUEST -> DHCPACK
  • D. ARP Request -> DHCPOFFER -> DHCPACK -> Gratuitous ARP
✔ Correct Answer: A. DHCPDISCOVER -> DHCPOFFER -> DHCPREQUEST -> DHCPACK (DORA)
Technical Explanation: DHCPv4 follows the DORA process: Discover (broadcast by client), Offer (from server), Request (broadcast by client selecting the offer), and Acknowledgment (ACK from server).
Question 58 Which three commands are required on a Cisco router before you can generate RSA keys for SSH access? (Choose three.)
  • A. Configure a non-default hostname (e.g., hostname R1)
  • B. Configure a DNS domain name (e.g., ip domain-name cisco.com)
  • C. Generate the keys using 'crypto key generate rsa'
  • D. Enable Telnet on VTY lines
  • E. Configure OSPF routing
✔ Correct Answer: A. Configure a non-default hostname, B. Configure a DNS domain name, C. Generate the keys using 'crypto key generate rsa'
Technical Explanation: Cisco IOS combines the router's hostname and IP domain-name (e.g., R1.cisco.com) to label the RSA key pair generated by 'crypto key generate rsa'.
Question 59 Which Cisco IOS command blocks brute-force login attempts by shutting down login access for 120 seconds if 3 failed attempts occur within 60 seconds?
  • A. login block-for 120 attempts 3 within 60
  • B. security passwords min-length 10
  • C. exec-timeout 2 0
  • D. transport input ssh
✔ Correct Answer: A. login block-for 120 attempts 3 within 60
Technical Explanation: The 'login block-for [seconds] attempts [tries] within [seconds]' global configuration command mitigates dictionary/brute-force attacks against VTY and console lines.
Question 60 What is the purpose of the 'exec-timeout 5 30' command configured under 'line vty 0 4'?
  • A. It disconnects an idle SSH/Telnet session after 5 minutes and 30 seconds of inactivity.
  • B. It limits the total duration of any SSH connection to 5 hours and 30 minutes.
  • C. It requires a password between 5 and 30 characters long.
  • D. It delays login prompts by 5.3 seconds.
✔ Correct Answer: A. It disconnects an idle SSH/Telnet session after 5 minutes and 30 seconds of inactivity.
Technical Explanation: 'exec-timeout [minutes] [seconds]' automatically logs out inactive administrative sessions to prevent unattended terminals from being hijacked.
Question 61 Which command displays the neighboring Cisco devices directly connected to a router, including their Device ID, local interface, and hardware platform?
  • A. show ip route
  • B. show cdp neighbors
  • C. show arp
  • D. show interfaces
✔ Correct Answer: B. show cdp neighbors
Technical Explanation: Cisco Discovery Protocol (CDP) is a Layer 2 Cisco proprietary protocol enabled by default that discovers directly connected Cisco switches, routers, and IP phones.
Question 62 When troubleshooting network connectivity from a PC, an engineer can ping 127.0.0.1 and the PC's own IP (192.168.1.50), but cannot ping the Default Gateway (192.168.1.1). Where does the problem most likely reside?
  • A. The remote web server is offline.
  • B. The DNS server is misconfigured.
  • C. There is a Layer 1/Layer 2 issue on the local LAN (unplugged cable, wrong switch VLAN, or shut down router interface).
  • D. The PC's TCP/IP stack is corrupted.
✔ Correct Answer: C. There is a Layer 1/Layer 2 issue on the local LAN (unplugged cable, wrong switch VLAN, or shut down router interface).
Technical Explanation: Pinging 127.0.0.1 proves the PC's TCP/IP stack works. Failing to reach the local default gateway indicates a physical cabling fault, wrong VLAN assignment on the switch port, or a shut-down gateway interface.
Question 63 Two Cisco switches are connected together, and both ports are configured in 'switchport mode dynamic auto'. Why does a trunk link fail to form?
  • A. Both ends are passive in dynamic auto mode, so neither initiates DTP trunk negotiation.
  • B. 802.1Q encapsulation is disabled.
  • C. PortFast blocks DTP frames.
  • D. VLAN 1 is shut down.
✔ Correct Answer: A. Both ends are passive in dynamic auto mode, so neither initiates DTP trunk negotiation.
Technical Explanation: Dynamic Auto waits passively for the other side to request a trunk. If both sides are Dynamic Auto, the link stays an access port. At least one side must be 'trunk' or 'dynamic desirable'.
Question 64 An administrator wants to add VLAN 50 to an existing 802.1Q trunk that already carries VLANs 10, 20, and 30. The administrator enters 'switchport trunk allowed vlan 50'. What happens?
  • A. VLAN 50 is appended to the list alongside 10, 20, and 30.
  • B. VLANs 10, 20, and 30 are removed from the trunk, and ONLY VLAN 50 is permitted, causing an outage.
  • C. The command is rejected by the switch.
  • D. The port enters err-disabled mode.
✔ Correct Answer: B. VLANs 10, 20, and 30 are removed from the trunk, and ONLY VLAN 50 is permitted, causing an outage.
Technical Explanation: Without the 'add' keyword ('switchport trunk allowed vlan add 50'), the command overwrites the entire allowed VLAN list with only VLAN 50.
Question 65 In a Router-on-a-Stick (ROAS) Inter-VLAN routing configuration, where is the 'encapsulation dot1Q [vlan-id]' command applied?
  • A. On the switch access ports.
  • B. On the router's logical subinterfaces (e.g., interface GigabitEthernet0/0/1.10) before assigning the IPv4 address.
  • C. In global configuration mode on the router.
  • D. Under the OSPF routing process.
✔ Correct Answer: B. On the router's logical subinterfaces (e.g., interface GigabitEthernet0/0/1.10) before assigning the IPv4 address.
Technical Explanation: In Router-on-a-Stick, each VLAN requires a router subinterface configured with 'encapsulation dot1Q [vlan-id]' prior to configuring its 'ip address'.
Question 66 When configuring Inter-VLAN routing on a Layer 3 Multilayer Switch using SVIs, which global command must be enabled so the switch routes packets between VLANs?
  • A. ip default-gateway
  • B. ip routing
  • C. switchport mode trunk
  • D. no switchport
✔ Correct Answer: B. ip routing
Technical Explanation: Even if multiple SVIs (interface Vlan10, interface Vlan20) are up/up with IP addresses, a Multilayer Switch will not route packets between them until 'ip routing' is entered in global configuration mode.
Question 67 How does Spanning Tree Protocol (STP) elect the Root Bridge in a Layer 2 switched topology?
  • A. The switch with the highest MAC address wins.
  • B. The switch with the lowest Bridge ID (consisting of Bridge Priority + Extended System ID + MAC Address) becomes the Root Bridge.
  • C. The switch with the fastest Gigabit uplink ports wins.
  • D. The switch with the highest uptime wins.
✔ Correct Answer: B. The switch with the lowest Bridge ID (consisting of Bridge Priority + Extended System ID + MAC Address) becomes the Root Bridge.
Technical Explanation: In STP, the lowest Bridge ID (BID) wins the Root Bridge election. By default, all switches have priority 32768 (+ VLAN ID), so the switch with the lowest MAC address wins unless an admin lowers the priority (e.g., 'spanning-tree vlan 10 priority 4096' or 'root primary').
Question 68 What are the three port states used by Rapid Spanning Tree Protocol (RSTP - IEEE 802.1w) compared to 802.1D?
  • A. Blocking, Listening, Learning
  • B. Discarding, Learning, Forwarding
  • C. Disabled, Standby, Active
  • D. Init, Exchange, Full
✔ Correct Answer: B. Discarding, Learning, Forwarding
Technical Explanation: RSTP (802.1w) combines the legacy 802.1D Disabled, Blocking, and Listening states into a single 'Discarding' state, leaving only Discarding, Learning, and Forwarding.
Question 69 Which command should be enabled on all access ports connected to end-user PCs so they transition immediately to the STP forwarding state, and what security feature should pair with it to shut down the port if a switch is plugged in?
  • A. PortFast and BPDU Guard
  • B. Root Guard and Loop Guard
  • C. UplinkFast and BackboneFast
  • D. DTP and VTP
✔ Correct Answer: A. PortFast and BPDU Guard
Technical Explanation: PortFast ('spanning-tree portfast') bypasses the 30-second listening/learning delay on host ports, while BPDU Guard ('spanning-tree bpduguard enable') immediately places the port into 'err-disabled' state if a rogue switch sends a BPDU.
Question 70 Which LACP (IEEE 802.3ad) mode combination will successfully form an EtherChannel between Switch A and Switch B?
  • A. Passive on Switch A and Passive on Switch B
  • B. Active on Switch A and Passive on Switch B (or Active/Active)
  • C. Desirable on Switch A and Auto on Switch B
  • D. On on Switch A and Active on Switch B
✔ Correct Answer: B. Active on Switch A and Passive on Switch B (or Active/Active)
Technical Explanation: LACP uses 'active' and 'passive' keywords (whereas Cisco PAgP uses 'desirable' and 'auto'). At least one side must be 'active' to initiate LACP negotiation.
Question 71 All physical interfaces bundled into an EtherChannel must match on which four parameters?
  • A. Speed, Duplex, Native/Allowed VLANs (if trunk), and Access VLAN (if access port)
  • B. Interface description, port number, MAC address, and cable length
  • C. IP address, hostname, VTP password, and SSH version
  • D. Port Security sticky MACs, QoS markings, and CDP timers
✔ Correct Answer: A. Speed, Duplex, Native/Allowed VLANs (if trunk), and Access VLAN (if access port)
Technical Explanation: If any member port in an EtherChannel has a different speed, duplex, switchport mode, or allowed VLAN list, the EtherChannel will fail to bundle or become suspended.
Question 72 When a DHCPv4 server is located on a different subnet/VLAN from the clients, which command must be configured on the router's LAN interface facing the clients to forward DHCP broadcasts as unicasts?
  • A. ip dhcp pool
  • B. ip helper-address [dhcp-server-ip]
  • C. ip dhcp snooping trust
  • D. service dhcp
✔ Correct Answer: B. ip helper-address [dhcp-server-ip]
Technical Explanation: Routers drop Layer 2 broadcasts (255.255.255.255) by default. Configuring 'ip helper-address' on the ingress router interface relays UDP broadcast services (including DHCP ports 67/68) as unicast packets to the central DHCP server.
Question 73 What is the difference between SLAAC, Stateless DHCPv6, and Stateful DHCPv6 when a router sends an ICMPv6 Router Advertisement (RA)?
  • A. SLAAC: M=0, O=0; Stateless DHCPv6: M=0, O=1 (IP from RA, DNS from DHCPv6); Stateful DHCPv6: M=1 (All config from DHCPv6 server).
  • B. SLAAC requires M=1; Stateful DHCPv6 requires M=0.
  • C. All three use the exact same M and O flag values.
  • D. Stateful DHCPv6 disables IPv6 link-local addresses.
✔ Correct Answer: A. SLAAC: M=0, O=0; Stateless DHCPv6: M=0, O=1 (IP from RA, DNS from DHCPv6); Stateful DHCPv6: M=1 (All config from DHCPv6 server).
Technical Explanation: The Managed (M) and Other (O) flags in the router's ICMPv6 RA message instruct the client whether to use SLAAC alone (M=0, O=0), SLAAC + Stateless DHCPv6 for DNS (M=0, O=1), or Stateful DHCPv6 for its IPv6 address (M=1).
Question 74 In HSRP (Hot Standby Router Protocol), what is the default priority value, and what virtual MAC address format does HSRP Version 1 use?
  • A. Priority 100; Virtual MAC 0000.0C07.ACxx (where xx is the HSRP group ID in hex)
  • B. Priority 255; Virtual MAC 0000.5E00.01xx
  • C. Priority 1; Virtual MAC FFFF.FFFF.FFFF
  • D. Priority 150; Virtual MAC 0000.0C9F.Fxxx
✔ Correct Answer: A. Priority 100; Virtual MAC 0000.0C07.ACxx (where xx is the HSRP group ID in hex)
Technical Explanation: HSRP defaults to priority 100. HSRPv1 uses the virtual MAC 0000.0C07.ACxx, while HSRPv2 uses 0000.0C9F.Fxxx (and VRRP uses 0000.5E00.01xx).
Question 75 Compare the three Cisco Switch Port Security violation modes: Protect, Restrict, and Shutdown. Which statement is true?
  • A. Protect drops frames silently; Restrict drops frames and logs a syslog/SNMP trap while incrementing the violation counter; Shutdown places the port into err-disabled state.
  • B. Protect shuts down the port immediately; Shutdown only logs a warning.
  • C. Restrict forwards unauthorized traffic but sends an email alert.
  • D. All three modes place the interface into err-disabled state.
✔ Correct Answer: A. Protect drops frames silently; Restrict drops frames and logs a syslog/SNMP trap while incrementing the violation counter; Shutdown places the port into err-disabled state.
Technical Explanation: Shutdown is the default violation mode and puts the interface into 'err-disabled' (requiring 'shutdown' then 'no shutdown' to recover). Restrict logs violations and increments counters without shutting the port, while Protect drops frames silently.
Question 76 How do DHCP Snooping and Dynamic ARP Inspection (DAI) work together to secure a Layer 2 switch?
  • A. DHCP Snooping builds a trusted Binding Database (MAC-to-IP-to-VLAN-to-Port) from legitimate DHCP ACK messages, and DAI uses that database to drop spoofed ARP packets on untrusted ports.
  • B. DAI encrypts all ARP packets using IPsec.
  • C. DHCP Snooping blocks all DHCP traffic on trunk ports.
  • D. Both features require disabling Spanning Tree Protocol.
✔ Correct Answer: A. DHCP Snooping builds a trusted Binding Database (MAC-to-IP-to-VLAN-to-Port) from legitimate DHCP ACK messages, and DAI uses that database to drop spoofed ARP packets on untrusted ports.
Technical Explanation: Dynamic ARP Inspection (DAI) depends directly on the DHCP Snooping Binding Database to validate incoming ARP replies on untrusted access ports and prevent ARP poisoning.
Question 77 When configuring a Floating Static Route as a backup path to an OSPF-learned route (Administrative Distance 110), what Administrative Distance (AD) value must be assigned to the static route?
  • A. 1 (Default static route AD)
  • B. Any value greater than 110 (e.g., 115 or 150)
  • C. 0
  • D. 90
✔ Correct Answer: B. Any value greater than 110 (e.g., 115 or 150)
Technical Explanation: A floating static route must have an Administrative Distance higher (less trustworthy) than the primary routing protocol (OSPF AD = 110) so it stays hidden until the OSPF route disappears.
Question 78 In Single-Area OSPFv2, what is the exact order of precedence a Cisco router uses to select its 32-bit Router ID (RID)?
  • A. 1. Manual 'router-id' command -> 2. Highest active Loopback IPv4 address -> 3. Highest active physical interface IPv4 address
  • B. 1. Lowest MAC address -> 2. Highest physical IP -> 3. Loopback IP
  • C. 1. Highest physical IP -> 2. Manual router-id -> 3. Loopback IP
  • D. 1. OSPF priority 255 -> 2. Lowest IP address
✔ Correct Answer: A. 1. Manual 'router-id' command -> 2. Highest active Loopback IPv4 address -> 3. Highest active physical interface IPv4 address
Technical Explanation: OSPF selects its Router ID using: (1) explicitly configured 'router-id x.x.x.x', (2) highest IPv4 address on any up Loopback interface, or (3) highest IPv4 address on any active physical interface.
Question 79 On a broadcast multiaccess Ethernet segment, how do OSPF routers elect the Designated Router (DR) and Backup Designated Router (BDR), and how can you prevent a router from ever becoming DR/BDR?
  • A. Highest interface OSPF priority wins (tie-breaker: highest Router ID); setting 'ip ospf priority 0' prevents a router from participating in the DR/BDR election.
  • B. Lowest Router ID wins; setting priority 255 disables DR election.
  • C. Fastest interface bandwidth wins.
  • D. The router with the lowest MAC address becomes DR.
✔ Correct Answer: A. Highest interface OSPF priority wins (tie-breaker: highest Router ID); setting 'ip ospf priority 0' prevents a router from participating in the DR/BDR election.
Technical Explanation: OSPF interface priority defaults to 1 (range 0–255). The highest priority becomes DR (tie-breaker: highest RID). Setting 'ip ospf priority 0' forces the router to remain a DROTHER.
Question 80 What is the default OSPF Reference Bandwidth on Cisco routers, and why must you use 'auto-cost reference-bandwidth' in modern networks?
  • A. Default is 100 Mbps (10^8 bps), which assigns the same OSPF cost of 1 to FastEthernet (100M), GigabitEthernet (1G), and 10G links unless the reference bandwidth is increased (e.g., auto-cost reference-bandwidth 10000).
  • B. Default is 100 Gbps, which blocks 1G links.
  • C. OSPF uses hop count instead of bandwidth.
  • D. Reference bandwidth only applies to serial links.
✔ Correct Answer: A. Default is 100 Mbps (10^8 bps), which assigns the same OSPF cost of 1 to FastEthernet (100M), GigabitEthernet (1G), and 10G links unless the reference bandwidth is increased (e.g., auto-cost reference-bandwidth 10000).
Technical Explanation: Because OSPF Cost = Reference Bandwidth / Interface Bandwidth (and integer values cannot be less than 1), any link 100 Mbps or faster gets a cost of 1 by default. Increasing the reference bandwidth on all OSPF routers allows OSPF to distinguish between 100M, 1G, and 10G links.
Question 81 Which cuatro parameters in OSPF Hello packets MUST match between two neighboring routers for them to form an OSPF adjacency?
  • A. Area ID, Hello/Dead Timers, Subnet Mask (on multiaccess links), and Authentication
  • B. Router ID, Interface Priority, OSPF Process ID, and Hostname
  • C. OSPF Cost, Reference Bandwidth, Loopback IP, and IOS Version
  • D. MAC Address, VLAN ID, HSRP Group, and NTP Server
✔ Correct Answer: A. Area ID, Hello/Dead Timers, Subnet Mask (on multiaccess links), and Authentication
Technical Explanation: Process ID is locally significant and Router IDs must be unique (different). However, Area ID, Hello/Dead intervals, Network Type/Subnet Mask, Authentication, and Stub flags must match.
Question 82 What is the wildcard mask that matches only the 192.168.16.0 through 192.168.31.255 summary block (/20)?
  • A. 0.0.15.255
  • B. 0.0.0.255
  • C. 255.255.240.0
  • D. 0.0.31.255
✔ Correct Answer: A. 0.0.15.255
Technical Explanation: A /20 subnet mask is 255.255.240.0. Subtracting 255.255.240.0 from 255.255.255.255 yields the wildcard mask 0.0.15.255.
Question 83 Where should Standard IPv4 ACLs (1–99) and Extended IPv4 ACLs (100–199) be placed according to Cisco best practices, and why?
  • A. Standard ACLs closest to the destination (since they filter only by source IP); Extended ACLs closest to the source (since they filter by source, destination, and protocol/port).
  • B. Standard ACLs closest to the source; Extended ACLs closest to the destination.
  • C. Both must be placed exclusively on WAN serial interfaces.
  • D. Both must be applied outbound on Loopback0.
✔ Correct Answer: A. Standard ACLs closest to the destination (since they filter only by source IP); Extended ACLs closest to the source (since they filter by source, destination, and protocol/port).
Technical Explanation: Standard ACLs only examine the Source IP, so placing them near the source would block traffic to all destinations. Extended ACLs match exact source/destination/port pairs and are placed near the source to drop unwanted traffic immediately.
Question 84 An administrator creates an ACL to restrict SSH access to a router's VTY lines using the standard named ACL 'ADMIN-MGT'. Which command applies this ACL to the VTY lines?
  • A. ip access-group ADMIN-MGT in
  • B. access-class ADMIN-MGT in
  • C. transport input ADMIN-MGT
  • D. login access-list ADMIN-MGT
✔ Correct Answer: B. access-class ADMIN-MGT in
Technical Explanation: On physical/SVI interfaces, ACLs are applied using 'ip access-group [acl] in|out'. On VTY lines ('line vty 0 4'), ACLs are applied using 'access-class [acl] in'.
Question 85 In NAT terminology, a host at 192.168.1.10 sends a packet through a NAT router (public IP 203.0.113.5) to an external web server at 198.51.100.20. What are the Inside Local, Inside Global, and Outside Global addresses?
  • A. Inside Local: 192.168.1.10; Inside Global: 203.0.113.5; Outside Global: 198.51.100.20
  • B. Inside Local: 203.0.113.5; Inside Global: 192.168.1.10; Outside Global: 198.51.100.20
  • C. Inside Local: 198.51.100.20; Inside Global: 203.0.113.5; Outside Global: 192.168.1.10
  • D. All three are 203.0.113.5
✔ Correct Answer: A. Inside Local: 192.168.1.10; Inside Global: 203.0.113.5; Outside Global: 198.51.100.20
Technical Explanation: Inside Local is the private IP of the internal host (192.168.1.10). Inside Global is the public IP representing the internal host to the outside world (203.0.113.5). Outside Global is the public IP of the external server (198.51.100.20).
Question 86 Which command configures PAT (NAT Overload) so that all hosts matched by ACL 1 share the public IP address assigned to interface GigabitEthernet0/0/1?
  • A. ip nat inside source list 1 interface GigabitEthernet0/0/1 overload
  • B. ip nat inside source static 192.168.1.10 203.0.113.5
  • C. ip nat outside source list 1 pool PUBLIC
  • D. ip pat overload GigabitEthernet0/0/1
✔ Correct Answer: A. ip nat inside source list 1 interface GigabitEthernet0/0/1 overload
Technical Explanation: The 'overload' keyword enables Port Address Translation (PAT), allowing thousands of internal hosts in ACL 1 to share the single public IP of exit interface Gi0/0/1 via unique TCP/UDP port numbers.
Question 87 What are the four core security functions provided by the IPsec framework (Confidentiality, Integrity, Authentication, and Secure Key Exchange)?
  • A. Confidentiality: AES/3DES; Integrity: HMAC-SHA1/SHA256; Authentication: PSK or RSA Certificates; Key Exchange: Diffie-Hellman (DH)
  • B. Confidentiality: MD5; Integrity: DES; Authentication: Telnet; Key Exchange: FTP
  • C. Confidentiality: SHA-256; Integrity: RSA; Authentication: DH; Key Exchange: AES
  • D. IPsec does not encrypt traffic, it only routes GRE packets.
✔ Correct Answer: A. Confidentiality: AES/3DES; Integrity: HMAC-SHA1/SHA256; Authentication: PSK or RSA Certificates; Key Exchange: Diffie-Hellman (DH)
Technical Explanation: IPsec uses encryption algorithms (AES) for confidentiality, hashing (SHA) for packet integrity, Pre-Shared Keys (PSK) or RSA certificates for peer authentication, and Diffie-Hellman (DH groups) for establishing shared secret keys over an untrusted network.
Question 88 In Syslog message logging on Cisco IOS devices, there are 8 severity levels (0 to 7). Which severity levels correspond to Level 0, Level 3, Level 4, and Level 7?
  • A. 0: Emergencies, 3: Errors, 4: Warnings, 7: Debugging
  • B. 0: Debugging, 3: Notifications, 4: Errors, 7: Emergencies
  • C. 0: Informational, 3: Critical, 4: Alerts, 7: Warnings
  • D. All Syslog messages use Level 5 only.
✔ Correct Answer: A. 0: Emergencies, 3: Errors, 4: Warnings, 7: Debugging
Technical Explanation: Mnemonic 'Every Awesome Cisco Engineer Will Need Icecream Daily': 0-Emergencies, 1-Alerts, 2-Critical, 3-Errors, 4-Warnings, 5-Notifications, 6-Informational, 7-Debugging (lower numbers are more severe).
Question 89 In Network Automation and Programmability, what is the difference between Control Plane and Data Plane in an SDN (Software-Defined Networking) architecture?
  • A. The Control Plane is centralized in an SDN Controller (making routing/policy decisions), while the Data Plane remains on the switches/routers to forward packets at line rate.
  • B. The Data Plane is removed from switches so all user traffic passes through the SDN Controller's CPU.
  • C. Both Control Plane and Data Plane require manual CLI Telnet configuration on every box.
  • D. SDN eliminates APIs and uses only SNMPv1.
✔ Correct Answer: A. The Control Plane is centralized in an SDN Controller (making routing/policy decisions), while the Data Plane remains on the switches/routers to forward packets at line rate.
Technical Explanation: SDN decouples the intelligence (Control Plane) into a centralized controller (using Southbound APIs like NETCONF/OpenFlow and Northbound REST APIs), while physical switches handle high-speed packet forwarding (Data Plane).
Question 90 Compare Ansible, Puppet, Chef, and Terraform (CCNA 200-301 v1.1): Which tools are Agentless (Push model over SSH/NETCONF) versus Agent-based (Pull model)?
  • A. Agentless: Ansible and Terraform; Agent-based: Puppet and Chef
  • B. Agentless: Puppet and Chef; Agent-based: Ansible
  • C. All four require installing a Python agent on Cisco IOS switches.
  • D. None of them support JSON or YAML.
✔ Correct Answer: A. Agentless: Ansible and Terraform; Agent-based: Puppet and Chef
Technical Explanation: Ansible (YAML playbooks) and Terraform (HCL declarative files) are agentless and push configurations over SSH/NETCONF/RESTCONF without installing software on the network device. Puppet and Chef traditionally use device agents to pull configurations from a central master.
Question 91 According to the CCNA 200-301 v1.1 blueprint, how is Generative AI used differently from Predictive AI in modern network operations (AIOps)?
  • A. Predictive AI analyzes historical telemetry to forecast congestion and hardware faults before outages happen; Generative AI provides natural-language assistant interfaces to summarize incidents and generate CLI/JSON configs.
  • B. Generative AI replaces physical fiber optic cables; Predictive AI replaces Ethernet switches.
  • C. Predictive AI only works on IPv4; Generative AI only works on IPv6.
  • D. Both are routing protocols that replace BGP.
✔ Correct Answer: A. Predictive AI analyzes historical telemetry to forecast congestion and hardware faults before outages happen; Generative AI provides natural-language assistant interfaces to summarize incidents and generate CLI/JSON configs.
Technical Explanation: Domain 6 of CCNA 200-301 v1.1 tests the distinction between Predictive AI/Machine Learning (trend forecasting and anomaly detection in Cisco Catalyst Center) and Generative AI (LLM-powered troubleshooting assistants).

CCNA 200-301 v1.1 Master Verification CLI Cheat Sheet

Cisco IOS CLI - Verification & Lab Script 
show ip route | begin Gateway
show ip ospf neighbor
show interfaces trunk
show etherchannel summary
show spanning-tree summary
show access-lists
show ip nat translations

🔥 Related Cisco CCNA Practice Portals & Simlet Banks

Continue your certification preparation across our verified partner study portals:

📘 CCNA Final Exam Archive↗ 📗 Pass-CCNA Practice Tests↗ 📙 Scaling & Routing Labs↗ 🏆 Pass4Sure CCNA Simlets↗
🎯 Live Practice Score: 0 / 0