Hands-on troubleshooting labs account for the highest weight on both the Cisco NetAcad PT Skills Assessments (PTSA) and the CCNA 200-301 v1.1 Performance-Based Labs (Simlets). Use this interactive troubleshooting guide and CLI cheat sheet to diagnose VLANs, OSPF, ACLs, NAT, and IPv6 in under 3 minutes.
📥 Download All-in-One CCNA 200-301 Troubleshooting Mega-Lab (.PKA)
Pre-built broken enterprise network topology with 10 hidden tickets + full grading script.
Verified Exam Questions & Interactive Explanations
Question 1
Ticket #1: PC1 (VLAN 10: 192.168.10.10/24) cannot ping PC2 (VLAN 20: 192.168.20.10/24) in a Router-on-a-Stick topology. 'show ip interface brief' on R1 shows G0/0.10 and G0/0.20 are both 'up/up'. What is the most common misconfiguration on Switch SW1?
✔ Correct Answer: A. The switch port connected to R1 (G0/1) is configured as an access port instead of an 802.1Q trunk port.
Technical Explanation: In a Router-on-a-Stick (ROAS) setup, router subinterfaces remain
up/up as long as the physical router interface is up, even if the connected switch port is accidentally left in switchport mode access. Always run show interfaces trunk on the switch to verify the link to the router is trunking all required VLANs.
Question 2
Ticket #2: An Extended ACL 110 is applied inbound on R1 G0/0 to block PC1 from Telnetting to Server1, while allowing all other traffic. After applying the ACL, ALL traffic from the LAN is dropped. Why?
✔ Correct Answer: B. The administrator forgot to add 'permit ip any any' at the end of ACL 110 to override the implicit 'deny ip any any'.
Technical Explanation: Every Cisco ACL ends with an invisible implicit
deny ip any any. If you only configure a single deny tcp host 192.168.1.10 host 10.1.1.5 eq 23 statement without following it with permit ip any any, 100% of remaining traffic will match the implicit deny and be dropped.
Question 3
Ticket #3: A wireless client associates to an Enterprise WLAN SSID 'CORP-HQ' managed by a Cisco WLC, but fails 802.1X authentication immediately. Where should the engineer verify the Shared Secret and UDP ports 1812/1813?
✔ Correct Answer: A. Between the Wireless LAN Controller (WLC) and the RADIUS / Cisco ISE Authentication Server.
Technical Explanation: In WPA2/WPA3-Enterprise (802.1X/EAP), the WLC acts as the Authenticator and forwards credentials to an external RADIUS server (UDP 1812/1813). A mismatched RADIUS shared secret or unreachable RADIUS IP on the WLC causes all 802.1X client authentications to fail.
Top 10 Essential CCNA Exam Troubleshooting Commands ('Show' Cheat Sheet)
Cisco IOS CLI - Verification & Configuration
! Layer 1 & Layer 2 Switching / VLAN / Trunk Verification: Switch# show ip interface brief Switch# show interfaces status Switch# show vlan brief Switch# show interfaces trunk Switch# show etherchannel summary Switch# show spanning-tree vlan 10 ! Layer 3 Routing / OSPF / NAT / ACL Verification: Router# show ip route Router# show ip protocols Router# show ip ospf neighbor Router# show ip ospf interface brief Router# show access-lists Router# show ip nat translations Router# show ip nat statistics