How can I use this Cisco CCNA Practice Test practice test page?

Open the starter set, generate the test, and then replace the sample with your own questions whenever you want more targeted revision.

Is this Cisco CCNA Practice Test mock test useful for entrance exam preparation?

Yes. It is designed for Cisco CCNA (200-301) aspirants for chapter-wise revision, speed practice and AI-generated mock papers from previous-year style questions.

More Practice / Cisco CCNA (200-301)

Cisco CCNA Practice Test

We have organized this diagnostic test to line up with Cisco's six core 200-301 areas: Network Fundamentals and Access combined form 40%, IP Connectivity occupies 25%, Security Fundamentals comprises 15%, while IP Services and Automation split the final 20% down the middle. Standard subnet calculations and route-selection scenarios get extra attention because they remain the place where candidates are most likely to run out of time.

Cisco CCNA (200-301)NetworkingAI practice test

Browse all competitive exams

About this Cisco CCNA (200-301) Networking practice test

The modern CCNA code (200-301) represents a quiet revolution in networking, expecting you to master traditional optical fiber infrastructure and deep IP subnetting alongside modern APIs, Ansible scripts, and security overlays. It's a massive testing surface that can overwhelm anyone attempting to memorize subnet charts. Our approach treats networking as a collection of active, connected choices rather than isolated trivia. By looking at these questions, you'll see why a router scales its routing tables in a specific way and how a VLAN boundary affects broadcast traffic in a complex topology.

Cisco CCNA Practice Test sample questions

These starter questions help you launch a networking mock test quickly. Swap them with your own worksheet, notebook, or textbook questions any time.

1. Which OSI layer is responsible for logical addressing and determining the best path to deliver packets across networks?
- A) Physical layer
- B) Data Link layer
- C) Network layer
- D) Transport layer
2. Which IEEE standard originally defined Spanning Tree Protocol (STP)?
- A) 802.1Q
- B) 802.1D
- C) 802.3
- D) 802.11
3. What is the primary purpose of a VLAN on a switch?
- A) To increase cable length limits
- B) To logically divide a switch into multiple separate broadcast domains
- C) To encrypt traffic between switches
- D) To assign IP addresses automatically
4. What type of switch port carries traffic for multiple VLANs, using 802.1Q tags to identify each frame's VLAN?
- A) Access port
- B) Trunk port
- C) Voice port
- D) Loopback port
5. What is the main purpose of Spanning Tree Protocol (STP) in a switched network?
- A) To assign VLANs automatically
- B) To prevent Layer 2 loops by blocking redundant paths
- C) To encrypt switch management traffic
- D) To translate IP addresses
6. What does EtherChannel do?
- A) Encrypts traffic between two routers
- B) Bundles multiple physical links into a single logical link for redundancy and increased bandwidth
- C) Assigns VLANs dynamically
- D) Filters traffic based on MAC address
7. What is the default administrative distance of a directly connected route on a Cisco router?
- A) 0
- B) 1
- C) 90
- D) 110
8. What is the default administrative distance of a static route on a Cisco router?
- A) 0
- B) 1
- C) 100
- D) 120
9. What is the default administrative distance of OSPF on a Cisco router?
- A) 90
- B) 100
- C) 110
- D) 170
10. Which of the following is a private IPv4 address range as defined by RFC 1918?
- A) 12.0.0.0/8
- B) 172.16.0.0/12
- C) 200.100.50.0/24
- D) 8.8.8.0/24
11. How many usable host addresses are available in a /27 subnet?
- A) 14
- B) 30
- C) 62
- D) 126
12. Which IPv6 address type delivers a packet to the nearest interface among a group of interfaces sharing the same address?
- A) Unicast
- B) Multicast
- C) Anycast
- D) Broadcast
13. What is the purpose of the Address Resolution Protocol (ARP)?
- A) To assign IP addresses to hosts automatically
- B) To map a known IPv4 address to its corresponding MAC address on the local network
- C) To translate domain names to IP addresses
- D) To synchronize router clocks
14. What is the first usable host address in the 10.1.1.0/24 network?
- A) 10.1.1.0
- B) 10.1.1.1
- C) 10.1.1.254
- D) 10.1.1.255
15. A small office has one public IP address but many internal devices that need internet access. Which technology allows all of them to share that single public address simultaneously?
- A) Static NAT
- B) NAT overload (PAT)
- C) DHCP relay
- D) VLAN trunking
16. What is the primary purpose of DHCP in a network?
- A) To resolve domain names to IP addresses
- B) To automatically assign IP addressing information to hosts
- C) To synchronize device clocks
- D) To filter network traffic
17. What is the purpose of NTP (Network Time Protocol) on network devices?
- A) To translate private addresses to public addresses
- B) To synchronize device clocks across the network
- C) To assign VLANs to switch ports
- D) To detect intrusions
18. What is the primary purpose of QoS (Quality of Service) on a network?
- A) To encrypt sensitive traffic
- B) To prioritize certain types of traffic so critical applications perform reliably under congestion
- C) To assign static IP addresses
- D) To detect rogue DHCP servers
19. A network administrator needs to prevent a device from obtaining a DHCP address from a rogue DHCP server. Which Cisco feature should be enabled on the switch?
- A) Port security
- B) DHCP snooping
- C) Dynamic ARP Inspection
- D) 802.1X authentication
20. Which Cisco switch feature restricts which MAC addresses are allowed to send traffic on a specific switch port?
- A) DHCP snooping
- B) Port security
- C) Dynamic ARP Inspection
- D) VLAN trunking
21. Which Cisco feature validates ARP packets against a trusted binding table to prevent ARP spoofing attacks?
- A) Port security
- B) DHCP snooping
- C) Dynamic ARP Inspection (DAI)
- D) Access control lists
22. A standard IP access control list (ACL) can filter traffic based on which criteria?
- A) Source IP address only
- B) Source and destination IP address and port
- C) Destination MAC address only
- D) VLAN ID only
23. An extended IP access control list (ACL) can filter traffic based on which of the following?
- A) Source IP address only
- B) Source and destination IP address, protocol, and port number
- C) VLAN ID only
- D) Switch port number only
24. How does WPA3 improve wireless security compared to WPA2?
- A) It removes the need for a password entirely
- B) It replaces the WPA2 pre-shared key handshake with Simultaneous Authentication of Equals (SAE), which resists offline dictionary attacks
- C) It only works with wired connections
- D) It disables encryption for faster performance
25. What is the primary purpose of a site-to-site VPN?
- A) To assign IP addresses to remote users
- B) To encrypt and tunnel traffic between two networks over an untrusted network such as the internet
- C) To prevent Layer 2 loops
- D) To filter traffic based on MAC address
26. Which HTTP method is typically used in a REST API call to retrieve data without modifying it?
- A) POST
- B) GET
- C) DELETE
- D) PUT
27. Which data format, using human-readable key-value pairs, is most commonly used to exchange data with network APIs?
- A) XML only
- B) JSON
- C) YAML only
- D) CSV
28. What is the main goal of Software-Defined Networking (SDN)?
- A) To replace all physical switches with virtual ones
- B) To separate the control plane from the data plane, enabling centralized network management
- C) To encrypt all network traffic by default
- D) To eliminate the need for routing protocols
29. What is Cisco DNA Center primarily used for?
- A) As a wireless access point
- B) As a centralized platform for network management, automation, and assurance
- C) As a firewall appliance
- D) As a DHCP server
30. In network automation, what is the purpose of a YANG data model?
- A) To encrypt configuration data
- B) To define a structured, standardized model of a network device's configuration and operational state, used with protocols like NETCONF/RESTCONF
- C) To replace the CLI entirely
- D) To assign VLANs automatically

Syllabus & Core Topics

network switching fundamentalsIP addressing and subnettingnetwork security basicsnetwork automation

In an enterprise environment, a small VLAN change can break an OSPF adjacency several hops away. Studying these technologies as fluid systems—not separate textbook chapters—is the fastest way to build real network-engineering instinct.

✦

Why this practice page is useful

Computing host numbers and network boundaries on a /27 or /29 mask takes rapid calculation — working through these scenarios trains you to determine binary boundaries without counting on your fingers.
Administrative distances (0, 1, 90, 110, 120, 170) are easy points on the real test but easy to mix up — these scenario explanations lock the numbers down for good.
REST APIs, YANG data formats, and JSON are completely different territory from standard switching commands — these explanations break down SDN concepts into simple, digestible pieces.

Answer key & quick explanations

Short answers for the sample questions above. Use this to self-check before generating a fresh AI-built mock test.

1. Which OSI layer is responsible for logical addressing and determining the best path to deliver packets across networks?
C) Network layer
The Network layer (Layer 3) handles logical addressing (IP addresses) and determines the best path for delivering packets between networks. The Physical layer deals with raw bits and signaling, the Data Link layer handles MAC addressing and framing within a local segment, and the Transport layer manages end-to-end delivery and flow control, not path selection.
2. Which IEEE standard originally defined Spanning Tree Protocol (STP)?
B) 802.1D
IEEE 802.1D is the original standard that defined Spanning Tree Protocol. 802.1Q defines VLAN tagging, 802.3 covers Ethernet, and 802.11 covers wireless LANs — none of them define STP.
3. What is the primary purpose of a VLAN on a switch?
B) To logically divide a switch into multiple separate broadcast domains
A VLAN logically splits a single physical switch into multiple separate broadcast domains, so devices in different VLANs don't see each other's broadcast traffic even though they share the same hardware. VLANs don't affect cable length limits, don't provide encryption, and don't assign IP addresses.
4. What type of switch port carries traffic for multiple VLANs, using 802.1Q tags to identify each frame's VLAN?
B) Trunk port
A trunk port carries traffic for multiple VLANs over a single physical link, using 802.1Q tags so the receiving switch knows which VLAN each frame belongs to. An access port carries only one VLAN's untagged traffic, a voice port is a specific access-port variant for IP phones, and a loopback is a virtual interface, not a physical trunk.
5. What is the main purpose of Spanning Tree Protocol (STP) in a switched network?
B) To prevent Layer 2 loops by blocking redundant paths
STP detects redundant physical paths in a switched topology and blocks the extra links to prevent Layer 2 loops, which would otherwise cause broadcast storms. It has nothing to do with assigning VLANs, encrypting management traffic, or IP address translation.
6. What does EtherChannel do?
B) Bundles multiple physical links into a single logical link for redundancy and increased bandwidth
EtherChannel groups two or more physical links between the same two devices into one logical link, increasing available bandwidth and providing redundancy if one physical link fails. It doesn't encrypt traffic, assign VLANs, or filter by MAC address.
7. What is the default administrative distance of a directly connected route on a Cisco router?
A) 0
Directly connected routes have the lowest administrative distance of any route source — 0 — because the router trusts information about its own interfaces more than anything learned from a protocol. Static routes default to 1, and OSPF defaults to 110, both higher (less trusted) than a directly connected route.
8. What is the default administrative distance of a static route on a Cisco router?
B) 1
A static route has a default administrative distance of 1, making it more trusted than any dynamically learned route unless a different distance is manually configured. Directly connected routes are 0, and OSPF defaults to 110 — much higher than a static route's default.
9. What is the default administrative distance of OSPF on a Cisco router?
C) 110
OSPF has a default administrative distance of 110 on Cisco routers. EIGRP internal routes default to 90, and 170 is EIGRP's default for external routes — neither of those is OSPF's default.
10. Which of the following is a private IPv4 address range as defined by RFC 1918?
B) 172.16.0.0/12
172.16.0.0/12 is one of the three private address ranges defined in RFC 1918 (the others being 10.0.0.0/8 and 192.168.0.0/16). 12.0.0.0/8 and 8.8.8.0/24 are publicly routable ranges, and 200.100.50.0/24 falls in public address space as well.
11. How many usable host addresses are available in a /27 subnet?
B) 30
A /27 subnet mask leaves 5 host bits (32-27=5), giving 2^5 = 32 total addresses, minus 2 for the network and broadcast addresses, leaving 30 usable host addresses. A /28 would give 14 usable hosts and a /26 would give 62, so those numbers belong to different prefix lengths.
12. Which IPv6 address type delivers a packet to the nearest interface among a group of interfaces sharing the same address?
C) Anycast
An anycast address is assigned to interfaces on multiple devices, and traffic sent to it is delivered to whichever of those interfaces is topologically nearest, which is unique to anycast. Unicast delivers to one specific interface, multicast delivers to every member of a group (not just the nearest), and IPv6 has no broadcast address type at all.
13. What is the purpose of the Address Resolution Protocol (ARP)?
B) To map a known IPv4 address to its corresponding MAC address on the local network
ARP resolves a known IPv4 address to the MAC address needed to actually deliver a frame on the local Ethernet segment. Resolving domain names to IP addresses is DNS's job, and clock synchronization is handled by NTP, not ARP.
14. What is the first usable host address in the 10.1.1.0/24 network?
B) 10.1.1.1
In a /24 network, the network address is 10.1.1.0 and the broadcast address is 10.1.1.255, so the first usable host address is the very next one, 10.1.1.1. 10.1.1.0 and 10.1.1.255 aren't assignable to hosts, and 10.1.1.254 would only be the last usable address, not the first.
15. A small office has one public IP address but many internal devices that need internet access. Which technology allows all of them to share that single public address simultaneously?
B) NAT overload (PAT)
NAT overload, also called Port Address Translation (PAT), lets many internal private addresses share one public IP by tracking connections using unique source port numbers. Static NAT maps one private address to one public address on a 1:1 basis, DHCP relay forwards DHCP requests across subnets, and VLAN trunking has nothing to do with address translation.
16. What is the primary purpose of DHCP in a network?
B) To automatically assign IP addressing information to hosts
DHCP automatically hands out IP addresses, subnet masks, default gateways, and DNS server addresses to hosts as they join the network, removing the need to configure each device manually. Resolving domain names is DNS's job, clock sync is NTP's job, and filtering traffic is what an ACL or firewall does.
17. What is the purpose of NTP (Network Time Protocol) on network devices?
B) To synchronize device clocks across the network
NTP synchronizes the clocks of network devices against a common time source, which matters for accurate logging, certificate validation, and troubleshooting across a network. NAT translates addresses, VLAN assignment is unrelated to time, and intrusion detection is a separate security function.
18. What is the primary purpose of QoS (Quality of Service) on a network?
B) To prioritize certain types of traffic so critical applications perform reliably under congestion
QoS lets a network prioritize latency-sensitive or business-critical traffic — like voice or video — over less critical traffic when there's congestion, protecting its performance. QoS doesn't encrypt traffic, assign addresses, or detect rogue servers; those are separate functions.
19. A network administrator needs to prevent a device from obtaining a DHCP address from a rogue DHCP server. Which Cisco feature should be enabled on the switch?
B) DHCP snooping
DHCP snooping treats switch ports as trusted or untrusted and blocks DHCP server responses (like OFFER and ACK messages) coming from untrusted ports, stopping a rogue DHCP server from handing out addresses. Port security controls which MAC addresses can use a port rather than filtering DHCP messages specifically, Dynamic ARP Inspection targets ARP spoofing, and 802.1X handles port-based authentication.
20. Which Cisco switch feature restricts which MAC addresses are allowed to send traffic on a specific switch port?
B) Port security
Port security lets an administrator define which MAC addresses (or how many) are allowed to send traffic on a switch port, and take action — like shutting the port down — if a violation occurs. DHCP snooping targets rogue DHCP servers, DAI targets ARP spoofing, and VLAN trunking has nothing to do with restricting MAC addresses.
21. Which Cisco feature validates ARP packets against a trusted binding table to prevent ARP spoofing attacks?
C) Dynamic ARP Inspection (DAI)
Dynamic ARP Inspection intercepts ARP packets on untrusted ports and checks them against a trusted binding table (typically built from DHCP snooping) to catch and drop spoofed ARP replies. Port security restricts MAC addresses per port, DHCP snooping targets rogue DHCP responses, and ACLs filter based on IP/port criteria rather than validating ARP bindings.
22. A standard IP access control list (ACL) can filter traffic based on which criteria?
A) Source IP address only
A standard ACL can only match traffic based on the source IP address, which is why it's typically applied as close to the destination as possible to avoid over-filtering. An extended ACL is needed to also match destination address, protocol, or port, and neither type filters by MAC address or VLAN ID directly.
23. An extended IP access control list (ACL) can filter traffic based on which of the following?
B) Source and destination IP address, protocol, and port number
An extended ACL can match on source and destination IP address, protocol (like TCP or UDP), and port number, giving much more granular control than a standard ACL. A standard ACL can only match source IP address, and neither type filters by VLAN ID or switch port number.
24. How does WPA3 improve wireless security compared to WPA2?
B) It replaces the WPA2 pre-shared key handshake with Simultaneous Authentication of Equals (SAE), which resists offline dictionary attacks
WPA3 replaces WPA2's four-way handshake with Simultaneous Authentication of Equals (SAE), a key exchange that's much more resistant to offline dictionary and brute-force attacks against a captured handshake. WPA3 still requires a password for personal mode, it's a wireless standard rather than a wired one, and it strengthens encryption rather than disabling it.
25. What is the primary purpose of a site-to-site VPN?
B) To encrypt and tunnel traffic between two networks over an untrusted network such as the internet
A site-to-site VPN builds an encrypted tunnel between two networks — typically over the public internet — so traffic between them stays confidential and protected from interception, without needing a dedicated private circuit. It doesn't assign IP addresses to remote users (that's more a remote-access VPN function), prevent Layer 2 loops, or filter by MAC address.
26. Which HTTP method is typically used in a REST API call to retrieve data without modifying it?
B) GET
GET is the HTTP method used to retrieve a resource's current state without changing anything on the server, which is why it's the standard method for read-only REST API calls. POST creates data, PUT updates or replaces data, and DELETE removes data — all of which modify state rather than just reading it.
27. Which data format, using human-readable key-value pairs, is most commonly used to exchange data with network APIs?
B) JSON
JSON (JavaScript Object Notation) represents data as human-readable key-value pairs and is the most common format exchanged with network device REST APIs. XML is more verbose and less commonly the default for modern network APIs, YAML is more commonly used for configuration files like Ansible playbooks, and CSV isn't structured enough for nested API data.
28. What is the main goal of Software-Defined Networking (SDN)?
B) To separate the control plane from the data plane, enabling centralized network management
SDN's core idea is separating the control plane (which makes forwarding decisions) from the data plane (which forwards traffic), and centralizing that control logic in a controller for easier, programmatic network management. SDN doesn't require replacing all physical switches, doesn't encrypt traffic by default, and doesn't eliminate the need for routing logic — it centralizes it instead.
29. What is Cisco DNA Center primarily used for?
B) As a centralized platform for network management, automation, and assurance
Cisco DNA Center is a centralized software platform for managing, automating, and monitoring (assurance) an enterprise network from one place. It isn't a wireless access point, firewall, or DHCP server — those are individual network functions DNA Center helps manage.
30. In network automation, what is the purpose of a YANG data model?
B) To define a structured, standardized model of a network device's configuration and operational state, used with protocols like NETCONF/RESTCONF
YANG defines a structured, standardized data model describing a network device's configuration and operational state, which tools using NETCONF or RESTCONF read and write against. It doesn't encrypt data, and while it enables automation, it works alongside the CLI rather than replacing it, and it isn't itself a VLAN assignment mechanism.

Curriculum Mapping & Learning Guide

Use this breakdown to identify which skills each question tests and guide post-test review.

Network Fundamentals & Connectivity

Decoding encapsulation layers, designing spanning-tree parameters, routing data across OSPF paths, and resolving IP boundaries.

IP Services

Configuring address translations (NAT/PAT), automating lease parameters via DHCP, and using Quality of Service (QoS) priorities.

Security Fundamentals

Enforcing port MAC thresholds, blocking malicious DHCP leases with snooping rules, and designing access checklists.

Automation & Programmability

Deconstructing JSON/YAML dictionaries, interacting with RESTCONF interfaces, and understanding Software-Defined networking patterns.

Cisco CCNA (200-301) Networking units covered

Chapter 1: Infrastructure Foundations: Access ports, trunking, EtherChannel link bundles, and spanning-tree parameters.
Chapter 2: IPv4/IPv6 Address Management: Computing subnets, resolving ARP addresses, and selecting OSPF routes.
Chapter 3: IP Services: Address translation with PAT, DHCP relay configuration, and analyzing SNMP metrics.
Chapter 4: Security Fundamentals: Extended ACL filters, port security, and DHCP snooping.
Chapter 5: Automation & Programmability: REST API requests, working with JSON data, and network configuration tools.

How to use this cisco ccna practice test page

1. Click the Start Cisco CCNA Practice Test button to launch the setup.

2. Use the slider to choose your number of questions (from 5 to 30, default is 10).

3. Take your test, submit your answers, and let our AI analyze your performance.

4. Select Practice Weak Areas or Generate More Like This to have the AI create custom, targeted questions just for you.

Explore more for Cisco CCNA (200-301)

Move between subjects in the same exam to build a balanced Cisco CCNA (200-301) revision routine.