How the set is laid out
Frames run in a mixed order, so a routing item can follow a wireless one. The chips above the list narrow the set to one study area: open the OSPF and first-hop redundancy frames on their own, for instance, when that is the topic you are working through.
Some frames ask for two or three answers and say so in the stem; they only check once you have picked that many. Cisco’s exam adds drag-and-drop items and labs, which a page of multiple choice cannot reproduce. The CCNA exam format page covers what Cisco says about those.
The practice capture
Work straight down the list or pick a chip. Finish set opens a report that splits your result by study area and links each one’s review page.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 045 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 045L1Components & cabling
Which interface type on a router primarily handles incoming and outgoing traffic for internet connectivity?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A management interface carries admin traffic only, kept apart from user data.
Note on B
A VLAN interface (SVI) routes between internal VLANs on a switch, not toward the internet.
Note on C
The LAN interface faces the internal hosts, not the provider.
Note on D
Correct: the WAN interface faces the service provider and carries traffic to and from the internet.
Best answer: D · why
An edge router has LAN interfaces toward internal networks and a WAN interface toward the ISP or other sites; internet traffic leaves and enters there, and with NAT it is usually the ip nat outside interface. Management interfaces and SVIs serve other roles.
- Frame 002 of 045IPv4IPv4 & subnettingChoose 3
Which three of the following IP addresses are reserved for multicast routing? (Choose three.)
Choose 3 options, then Check answer. Open the note under any option to see why.
Note on A
Correct: 225.1.2.3 falls inside 224.0.0.0/4, the IPv4 multicast range (the old Class D).
Note on B
Correct: 239.255.255.255 is the top of the multicast range, in the administratively scoped 239.0.0.0/8 block.
Note on C
192.168.1.1 is a private unicast address from RFC 1918.
Note on D
10.1.1.1 is a private unicast address in 10.0.0.0/8.
Note on E
Correct: 224.0.0.1 is the link-local all-hosts multicast group.
Best answers: A, B and E · why
IPv4 multicast uses 224.0.0.0/4, from 224.0.0.0 to 239.255.255.255 (the old Class D). 224.0.0.0/24 holds link-local groups such as 224.0.0.1 (all hosts) and 224.0.0.5 (OSPF routers), and 239.0.0.0/8 is administratively scoped. 10.0.0.0/8 and 192.168.0.0/16 are private unicast ranges.
- Frame 003 of 045IPv6IPv6 addressingChoose 2
Which two of the following are valid IPv6 addresses? (Choose two.)
Choose 2 options, then Check answer. Open the note under any option to see why.
Note on A
Hyphen-separated pairs of hex digits form a 48-bit MAC address, not an IPv6 address.
Note on B
Correct: fe80::1 is a compressed link-local IPv6 address, with :: replacing the run of zero hextets.
Note on C
Dotted decimal with four octets is an IPv4 address.
Note on D
Correct: eight hextets of four hex digits, separated by colons, form a full uncompressed IPv6 address.
Best answers: B and D · why
An IPv6 address is 128 bits written as eight 16-bit hextets in hex, separated by colons. Leading zeros in a hextet can be dropped and one run of zero hextets can become ::, so fe80::1 is valid. 2001:db8::/32 is the documentation prefix. Dotted decimal is IPv4, and hyphenated hex pairs are a MAC address.
- Frame 004 of 045L2Switching & VLANs
What is the role of MAC address aging in a Layer 2 switch, and how can a misconfigured aging timer impact network performance?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Aging deletes entries and never duplicates them, and a too-short timer makes stability worse.
Note on B
MAC tables are not encrypted; aging has no security function.
Note on C
Aging does not prioritize traffic, and a long timer leaves stale entries rather than adding delay.
Note on D
Correct: entries not refreshed within the timer (300 s by default) are removed; set too short, the switch keeps forgetting hosts and floods unknown unicast.
Best answer: D · why
A switch learns source MACs into its table and removes an entry when no frame from that address arrives within the aging time, 300 seconds by default (mac address-table aging-time). Too short, and active hosts are forgotten, so frames to them are flooded; too long, and moved or departed hosts leave stale entries.
- Frame 005 of 045STPSTP & EtherChannel
When setting up an EtherChannel on trunk ports, what must be consistent on all member ports to ensure proper channel operation?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Layer 2 trunk members carry no IP addresses; only a Layer 3 port channel interface could have one.
Note on B
Access VLANs matter for access-mode bundles; on trunks it is the trunk settings that must agree.
Note on C
LLDP is a per-link discovery protocol and does not have to match for the bundle to form.
Note on D
Correct: members must agree on trunk mode, native VLAN and allowed VLANs, or IOS suspends the ones that differ.
Best answer: D · why
EtherChannel members must match in speed, duplex, switchport mode, access VLAN or, for trunks, native VLAN and allowed VLAN list. A member that differs is suspended from the bundle. The safest way is to configure the port-channel interface, whose settings are copied to the members. Verify with show etherchannel summary.
- Frame 006 of 045WLANWireless LANs
What is the main security improvement in WPA3 compared to WPA2?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
WPA3 does not change radio data rates or association speed; its changes are to authentication and key handling.
Note on B
Correct: WPA3-Personal replaces the WPA2 PSK exchange with SAE, so a captured handshake can’t be brute-forced offline against a password list.
Note on C
WPA3 narrows the allowed suites rather than adding more; it drops TKIP and keeps AES-based encryption, with a 192-bit mode for Enterprise.
Note on D
Processing load is not the goal; SAE actually takes more computation than the WPA2 PSK exchange.
Best answer: B · why
WPA3-Personal swaps the WPA2 pre-shared key exchange for Simultaneous Authentication of Equals (SAE). With SAE, an attacker who captures the handshake cannot test passwords against it offline, so even a weak passphrase holds up far better. WPA3 also requires Protected Management Frames, and WPA3-Enterprise adds an optional 192-bit security mode. Speed and CPU use are not what changed.
- Frame 007 of 045L3Routing & static routes
In which situation would a router use its gateway of last resort?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Losing a primary route brings in a backup such as a floating static route or an alternate path; the default is used only if no more specific match is left.
Note on B
Correct: the gateway of last resort is the 0.0.0.0/0 route, which matches only when no more specific prefix in the table matches the destination.
Note on C
With every interface down the router has no exit at all, including toward the next hop of a default route, so nothing is forwarded.
Note on D
A lost adjacency removes the routes learned from that neighbor; it does not by itself make the router use the default route.
Best answer: B · why
The gateway of last resort is the default route (0.0.0.0/0 in IPv4, ::/0 in IPv6). Longest-prefix matching always prefers a more specific route, so the default is used only for destinations that match nothing else in the table. Without a default route, such packets are dropped and the sender gets an ICMP destination unreachable. A failed primary route is handled first by a backup path or a floating static route.
- Frame 008 of 045OSPFOSPF & FHRP
In a broadcast multi-access network running OSPF, how do the roles of the Designated Router (DR) and Backup Designated Router (BDR) influence the forwarding of Link State Advertisements (LSAs)?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: DROthers send updates to the DR and BDR on 224.0.0.6, and the DR refloods them to every OSPF router on 224.0.0.5, cutting the number of transmissions.
Note on B
Independent flooding by every router is what a full mesh of adjacencies would need; the DR exists to avoid exactly that on a multiaccess segment.
Note on C
The BDR is not passive: it forms full adjacencies, receives the same updates as the DR, and takes over if the DR fails.
Note on D
Cost decides paths in the SPF calculation; it does not decide how link-state updates are flooded on the segment.
Best answer: A · why
On a broadcast multiaccess segment such as Ethernet, OSPF elects a DR and a BDR. The other routers (DROthers) form full adjacencies only with these two and send their updates to 224.0.0.6. The DR then refloods each update to every OSPF router on 224.0.0.5. This replaces a full mesh of adjacencies and repeated flooding with a hub-like exchange. The BDR receives the same updates, so it can take over at once if the DR fails.
- Frame 009 of 045SVCNAT, DHCP & DNS
Which command configures a DNS server on a Cisco router to resolve domain names?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The keywords are reversed; IOS has no global command that starts with name-server, so the parser rejects this line.
Note on B
Correct: ip name-server sets the DNS server the router queries when you use host names in ping, traceroute or telnet.
Note on C
ip dns server makes the router itself answer DNS queries and takes no address argument, so this line is not valid.
Note on D
dns-server is a DHCP pool subcommand that hands a DNS address to clients; it does not configure the router’s own lookups.
Best answer: B · why
ip name-server followed by an address tells the router which DNS server to query for its own name lookups, for example when you type ping www.example.com. Name lookup must also be enabled (ip domain-lookup, on by default). Don’t confuse it with dns-server inside an ip dhcp pool, which hands clients a DNS address, or with ip dns server, which turns the router into a DNS server.
- Frame 010 of 045MGMTManagement & QoS
Which command is used to verify the NTP synchronization status of a Cisco router?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: show ntp status reports whether the clock is synchronized, its stratum and the reference it is locked to.
Note on B
There is no show time synchronization command in IOS; time status comes from show ntp status or show clock detail.
Note on C
show clock prints the time (with detail, also its source), but ntp is not a valid keyword after show clock.
Note on D
IOS has no show ntp summary; the second NTP check is show ntp associations, which lists the configured servers and peers.
Best answer: A · why
show ntp status tells you whether the router’s clock is synchronized, at what stratum and to which reference. Pair it with show ntp associations, which lists each configured server and marks the one selected for synchronization with an asterisk. show clock detail also shows the time source. A router that only just received an ntp server command can take several minutes to report itself synchronized.
This set and Cisco’s exam, side by side
| Point | This practice set | Cisco’s 200-301 exam |
|---|---|---|
| Time | untimed | 120 minutes, per Cisco’s CCNA exam page |
| Number of items | shown in the tally above the list | Cisco does not publish a fixed number |
| Item types | multiple choice, single and multiple answer | multiple choice (single and multiple answer), drag-and-drop and labs, per Cisco’s exam tutorial page |
| Feedback | a line under each choice, for the key and every distractor, as soon as you answer | none during the exam |
| Result | a raw score and a table by study area | pass or fail; Cisco does not publish passing scores |
Our frames are written by our editors for study. None of them come from a Cisco exam.
After a miss: the review route
Read the note on your pick
It names the idea you swapped in. That is usually a neighboring concept, and the note says which one.
Open the study-area page
The report’s review link drops you on that study area’s page, where the topic is mapped before its frames start.
Drill the vocabulary
Port numbers, timer defaults and command names stick faster on the CCNA flashcards than in rereading.
Sit the timed set
Once a rerun of this set shows no weak study area, move to the timed CCNA mock exam, which keeps every verdict until the end.
Before you start
Are these Cisco’s exam questions?
No. Our editors wrote the frames for study, and each one was solved blind and checked against its key before it was published. Cisco treats its exam content as confidential under the agreement every candidate accepts, which is why no frame here claims to come from an exam.
Is the mix weighted like the exam?
By Cisco domain, the set lands close to the v1.1 weights of 20, 20, 25, 10, 15 and 10 percent; inside each domain, frames are spread across study areas by our estimate. The weights describe the exam’s emphasis, and Cisco does not say how they translate into items on a given sitting.
Where can I find more practice?
Each study-area page holds its own frames, which do not repeat this set. Paid options, from practice-exam software to Cisco’s own learning path, are compared on the CCNA study materials page.