200-301

CCNA 200-301 Exam Details

Domain Weight Breakdown

Cisco Certification Path

The CCNA 200-301 is Cisco's associate-level certification covering a broad range of networking fundamentals. It is the recommended starting point for the Cisco certification track. After earning CCNA, candidates can pursue professional-level certifications such as CCNP Enterprise, CCNP Security, CCNP Data Center, CCNP Service Provider, CCNP Collaboration, or specialist DevNet certifications. The CCNA consolidates the former CCNA Routing & Switching, CCNA Wireless, CCNA Security, and other tracks into a single unified exam.

The exam tests practical knowledge of configuring, operating, and troubleshooting small to medium enterprise networks. Questions cover both theoretical concepts and hands-on CLI configuration scenarios. There is no prerequisite certification, but Cisco recommends at least one year of networking experience.

OSI Reference Model (7 Layers)

TCP/IP Model (4 Layers)

Key TCP/UDP Port Numbers

IPv4 Subnetting Quick Reference

Formula: Usable hosts = 2ⁿ - 2, where n = number of host bits. Subtract 2 for network and broadcast addresses.

IPv4 Address Classes

Note: 127.0.0.0/8 is reserved for loopback (127.0.0.1).

Private IPv4 Address Ranges (RFC 1918)

IPv6 Address Types

IPv6 addresses are 128 bits written as eight groups of four hex digits separated by colons. Leading zeros can be omitted and one consecutive group of all-zeros can be replaced with ::.

Cable Types and Use Cases

Modern devices with Auto-MDIX automatically detect and adjust for cable type, making crossover cables largely unnecessary.

Fiber Optic: Single-Mode vs Multimode

VLAN Concepts and Configuration

VLANs (Virtual LANs) logically segment a single physical switch into multiple broadcast domains. Each VLAN acts as an independent LAN. Traffic between VLANs requires a Layer 3 device (router or multilayer switch).

VLAN 1 is the default VLAN. VLANs 1002-1005 are reserved for legacy Token Ring/FDDI. Valid user VLANs: 1-1005 (normal range) and 1006-4094 (extended range, requires VTP transparent mode).

802.1Q Trunking

Trunk links carry traffic for multiple VLANs between switches by tagging frames with 802.1Q headers (4-byte tag inserted into Ethernet frame). The native VLAN is sent untagged.

Best practice: Change the native VLAN from VLAN 1 to an unused VLAN to prevent VLAN hopping attacks. Ensure native VLAN matches on both ends of the trunk.

DTP (Dynamic Trunking Protocol) Modes

Best practice: Disable DTP with switchport nonegotiate on trunk ports and explicitly set ports to access or trunk mode.

Inter-VLAN Routing Methods

Router-on-a-Stick (subinterfaces):

Multilayer Switch (SVI - Switch Virtual Interface):

Spanning Tree Protocol (STP / 802.1D)

Port Roles: Root Port (best path to root bridge), Designated Port (forwards on segment), Alternate/Blocked Port (backup, does not forward).

Root Bridge Election: Lowest Bridge ID wins. Bridge ID = Priority (default 32768, increments of 4096) + System ID Extension (VLAN number) + MAC Address. To set root: spanning-tree vlan 10 root primary (sets priority to 24576) or spanning-tree vlan 10 priority 4096.

RSTP (Rapid Spanning Tree Protocol / 802.1w)

RSTP converges significantly faster than classic STP (seconds vs 30-50 seconds). It reduces port states to three: Discarding, Learning, and Forwarding. RSTP port roles include Root, Designated, Alternate (backup to root port), and Backup (backup to designated port). RSTP uses proposal/agreement mechanism for rapid transition to forwarding state on point-to-point links. Cisco's per-VLAN variant is Rapid PVST+ (default on modern Cisco switches).

EtherChannel (Link Aggregation)

All member ports must have matching speed, duplex, VLAN, and trunk settings. Up to 8 active links per EtherChannel. LACP supports up to 16 ports (8 active + 8 standby). Passive-to-Passive and Auto-to-Auto will NOT form a channel.

Wireless Standards (802.11)

Non-overlapping 2.4 GHz channels: 1, 6, and 11. These three channels do not interfere with each other and should be used for AP placement in dense environments.

Administrative Distance (AD) Table

Administrative distance is the trustworthiness of a routing source. Lower AD = more preferred. When multiple routing protocols offer a route to the same destination, the route with the lowest AD is installed in the routing table.

Static Routing

Floating Static Route: A static route configured with a higher AD than the primary dynamic route. It only appears in the routing table when the primary route fails, providing a backup path.

OSPF (Open Shortest Path First)

OSPF is a link-state routing protocol that uses Dijkstra's SPF algorithm to calculate the shortest path. It uses area-based hierarchy with Area 0 as the mandatory backbone area. All other areas must connect to Area 0 (directly or via virtual links).

OSPF Cost: Cost = Reference Bandwidth / Interface Bandwidth. Default reference bandwidth = 100 Mbps. For modern networks, adjust with: router ospf 1 then auto-cost reference-bandwidth 10000 (for 10 Gbps).

OSPF Neighbor Requirements

For two OSPF routers to form a neighbor adjacency, the following must match on both sides:

OSPF Network Types

DR/BDR Election: Highest OSPF priority wins (default 1, range 0-255, priority 0 = cannot be DR). If priority ties, highest Router ID wins. DR election is non-preemptive.

OSPF Key Commands

First-Hop Redundancy Protocols (FHRP)

HSRP is the most commonly tested FHRP on the CCNA. Higher priority = active router. Enable preemption with standby preempt to allow a higher-priority router to take over when it comes back online.

NAT (Network Address Translation)

NAT Terminology

DHCP (Dynamic Host Configuration Protocol)

DORA Process: Discover (broadcast from client) → Offer (unicast from server) → Request (broadcast from client) → Acknowledge (unicast from server).

DHCP relay (ip helper-address) forwards broadcast DHCP messages as unicast to a remote DHCP server. Required when the DHCP server is on a different subnet than the clients.

DNS (Domain Name System)

Recursive query: Client asks its DNS server to fully resolve the name. Iterative query: DNS server responds with referral to another server; client follows the chain.

NTP (Network Time Protocol)

NTP synchronizes clocks across network devices. Uses UDP port 123. Stratum levels indicate distance from reference clock: Stratum 0 = atomic clock (reference), Stratum 1 = directly connected to Stratum 0, Stratum 2 = syncs from Stratum 1, etc. Maximum is Stratum 15; Stratum 16 is unsynchronized.

SNMP (Simple Network Management Protocol)

Components: SNMP Manager (NMS), SNMP Agent (on device), MIB (Management Information Base). Manager uses GET/SET; Agent sends TRAPs (unsolicited alerts) or responds to INFORM requests.

Syslog Severity Levels

Mnemonic: "Every Awesome Cisco Engineer Will Need Ice-cream Daily". Logging to a syslog server: logging host 10.0.0.50 and logging trap informational (logs levels 0-6).

QoS (Quality of Service) Fundamentals

Classification: Identify traffic types using ACLs, NBAR, or markings. Marking: Tag packets with DSCP (Differentiated Services Code Point) values in the IP header (6 bits, values 0-63). Queuing: Prioritize marked traffic in output queues.

Trust boundary: The point in the network where QoS markings are trusted. Typically set at the access layer switch. Markings from untrusted sources are re-marked or stripped.

SSH vs Telnet

Common Security Threats

Access Control Lists (ACLs)

Wildcard Mask: Inverse of subnet mask. To calculate: 255.255.255.255 - subnet mask. Example: /24 subnet mask 255.255.255.0 gives wildcard 0.0.0.255. The keyword host = 0.0.0.0 wildcard, any = 255.255.255.255 wildcard. Implicit deny any at end of every ACL.

Port Security

To recover from err-disabled: shutdown then no shutdown, or configure auto-recovery: errdisable recovery cause psecure-violation.

DHCP Snooping & Dynamic ARP Inspection (DAI)

DHCP Snooping: Prevents rogue DHCP servers. Builds a binding table of MAC-to-IP mappings. Trusted ports (uplinks to real DHCP server) allow DHCP server messages; untrusted ports (access ports) only allow client messages.

DAI (Dynamic ARP Inspection): Uses DHCP snooping binding table to validate ARP packets. Prevents ARP spoofing/poisoning attacks. Applied on untrusted ports; trusted ports (uplinks) bypass inspection.

802.1X Port-Based Authentication

Three components: Supplicant (client device requesting access), Authenticator (switch controlling port access), Authentication Server (RADIUS server validating credentials). The switch port stays unauthorized until the supplicant provides valid credentials verified by the RADIUS server.

AAA: RADIUS vs TACACS+

Wireless Security Standards

WEP and WPA (TKIP) are deprecated and should not be used. Always prefer WPA2-AES or WPA3 for new deployments.

VPN Types

SDN (Software-Defined Networking)

SDN separates the control plane from the data plane, centralizing network intelligence in a controller. The controller communicates southbound to devices (OpenFlow, NETCONF) and northbound to applications (REST APIs).

REST APIs and HTTP Methods

Data Serialization Formats

Configuration Management Tools

Push model: Controller pushes configs to devices on demand. Pull model: Agents on devices periodically pull configs from central server. Ansible is the most popular for network automation due to being agentless and using simple YAML syntax.

Cisco DNA Center & SD-WAN / SD-Access

Cisco DNA Center: Centralized network controller and management dashboard for intent-based networking (IBN). Provides automation, assurance (AI/ML analytics), policy enforcement, and device provisioning across campus, branch, and WAN. Uses northbound REST APIs for integration and southbound protocols (NETCONF/YANG, CLI) to manage devices.

SD-Access: Cisco's software-defined access solution for campus LANs. Uses VXLAN fabric for overlay transport, LISP for control plane (host tracking and mapping), and Cisco TrustSec (CTS/SGT) for micro-segmentation. DNA Center serves as the fabric controller.

SD-WAN (Cisco Viptela): Software-defined WAN solution that separates data plane from control plane across WAN links. Key components: vManage (management), vSmart (controller), vBond (orchestrator), vEdge/cEdge (edge routers). Provides centralized policy, transport independence (MPLS + Internet + LTE), and application-aware routing.