All certifications
Cisco200-301 v1.1
Cisco Certified Network Associate (CCNA)
Exam overview, official domain weights and free sample questions. Subscribers get 230 practice questions, 136 flashcards, 4 labs, a study guide and video lessons for this exam.
Exam at a glance
- Exam code
- 200-301 v1.1
- Questions
- not published
- Time
- 120 minutes
- Question types
- performance-based, multiple choice, drag-and-drop
- Passing score
- not published (pass/fail, results usually within 48 hours)
- Exam fee
- US $300, or Cisco Learning Credits
- Delivery
- not published on the pages checked (Cisco exams are delivered by Pearson VUE)
- Prerequisites
- None published
- Renewal
- The exam counts toward Cisco recertification. For the validity period, check the Cisco recertification page
- Version notes
- Last day to test on v1.1: February 2, 2027. CCNA v2.0 starts February 3, 2027
From the official exam page (checked 2026-11-09). Always confirm details with the vendor: official exam page, official objectives.
Domains and weights
Network Fundamentals20%
- 1.1 Explain the role and function of network components
- 1.2 Describe characteristics of network topology architectures
- 1.3 Compare physical interface and cabling types
- 1.4 Identify interface and cable issues (collisions, errors, mismatch duplex, and/or speed)
- 1.5 Compare TCP to UDP
- 1.6 Configure and verify IPv4 addressing and subnetting
- 1.7 Describe private IPv4 addressing
- 1.8 Configure and verify IPv6 addressing and prefix
- 1.9 Describe IPv6 address types
- 1.10 Verify IP parameters for Client OS (Windows, Mac OS, Linux)
- 1.11 Describe wireless principles
- 1.12 Explain virtualization fundamentals (server virtualization, containers, and VRFs)
- 1.13 Describe switching concepts
Network Access20%
- 2.1 Configure and verify VLANs (normal range) spanning multiple switches
- 2.2 Configure and verify interswitch connectivity
- 2.3 Configure and verify Layer 2 discovery protocols (Cisco Discovery Protocol and LLDP)
- 2.4 Configure and verify (Layer 2/Layer 3) EtherChannel (LACP)
- 2.5 Interpret basic operations of Rapid PVST+ Spanning Tree Protocol
- 2.6 Describe Cisco Wireless Architectures and AP modes
- 2.7 Describe physical infrastructure connections of WLAN components (AP, WLC, access/trunk ports, and LAG)
- 2.8 Describe network device management access (Telnet, SSH, HTTP, HTTPS, console, TACACS+/RADIUS, and cloud managed)
- 2.9 Interpret the wireless LAN GUI configuration for client connectivity, such as WLAN creation, security settings, QoS profiles, and advanced settings
IP Connectivity25%
- 3.1 Interpret the components of routing table
- 3.2 Determine how a router makes a forwarding decision by default
- 3.3 Configure and verify IPv4 and IPv6 static routing
- 3.4 Configure and verify single area OSPFv2
- 3.5 Describe the purpose, functions, and concepts of first hop redundancy protocols
IP Services10%
- 4.1 Configure and verify inside source NAT using static and pools
- 4.2 Configure and verify NTP operating in a client and server mode
- 4.3 Explain the role of DHCP and DNS within the network
- 4.4 Explain the function of SNMP in network operations
- 4.5 Describe the use of syslog features, including facilities and severity levels
- 4.6 Configure and verify DHCP client and relay
- 4.7 Explain the forwarding per-hop behavior (PHB) for QoS such as classification, marking, queuing, congestion, policing, and shaping
- 4.8 Configure network devices for remote access using SSH
- 4.9 Describe the capabilities and functions of TFTP/FTP in the network
Security Fundamentals15%
- 5.1 Define key security concepts (threats, vulnerabilities, exploits, and mitigation techniques)
- 5.2 Describe security program elements (user awareness, training, and physical access control)
- 5.3 Configure and verify device access control using local passwords
- 5.4 Describe security password policy elements, such as management, complexity, and password alternatives (multifactor authentication, certificates, and biometrics)
- 5.5 Describe IPsec remote access and site-to-site VPNs
- 5.6 Configure and verify access control lists
- 5.7 Configure and verify Layer 2 security features (DHCP snooping, dynamic ARP inspection, and port security)
- 5.8 Compare authentication, authorization, and accounting concepts
- 5.9 Describe wireless security protocols (WPA, WPA2, and WPA3)
- 5.10 Configure and verify WLAN within the GUI using WPA2 PSK
Automation and Programmability10%
- 6.1 Explain how automation impacts network management
- 6.2 Compare traditional networks with controller-based networking
- 6.3 Describe controller-based, software defined architecture (overlay, underlay, and fabric)
- 6.4 Explain AI (generative and predictive) and machine learning in network operations
- 6.5 Describe characteristics of REST-based APIs (authentication types, CRUD, HTTP verbs, and data encoding)
- 6.6 Recognize the capabilities of configuration management mechanisms such as Ansible and Terraform
- 6.7 Recognize components of JSON-encoded data
Free sample questions
Original questions in the style of the exam. Pick an answer to see the explanation.
Sample question 1 · Network Fundamentals
A clinic wants its perimeter device to block a specific file-sharing application even when that application hops to TCP 443, and to inspect traffic for known exploit signatures. Which device best meets the requirement?
Incorrect — “A Layer 2 access switch”: A Layer 2 switch forwards frames by MAC address and has no application or exploit inspection. Correct — “A next-generation firewall”: NGFWs identify applications by behavior and signatures rather than port numbers alone, and integrate intrusion prevention. Incorrect — “A router with a standard ACL”: A standard ACL matches only source IP addresses, so it cannot recognize an application that moves to port 443. Incorrect — “A wireless LAN controller”: A WLC manages access points and client policy for WLANs; it is not a perimeter inspection device.
Sample question 2 · Network Access
A desk port must support a PC in VLAN 10 and a Cisco IP phone in VLAN 20 through the phone's built-in switch. Which interface configuration is correct?
Incorrect — “switchport mode access / switchport access vlan 10 / switchport access vlan 20”: The second command overwrites the first; an access port has only one access VLAN. Incorrect — “switchport mode trunk / switchport trunk native vlan 20”: A full trunk to a desk is unnecessary, and making voice the native VLAN would leave voice untagged. Incorrect — “switchport mode access / switchport voice vlan 10 / switchport access vlan 20”: This reverses the roles and puts the PC in the voice VLAN. Correct — “switchport mode access / switchport access vlan 10 / switchport voice vlan 20”: An access port can carry one data VLAN untagged plus a voice VLAN that the phone tags (learned through CDP/LLDP).
Sample question 3 · IP Connectivity
A routing table contains `O 10.1.2.0/24 [110/65] via 10.0.0.2, 00:01:12, Serial0/0/0`. What do 110 and 65 represent?
Correct — “110 is the administrative distance and 65 is the OSPF cost metric”: In the [AD/metric] brackets, 110 is OSPF's default administrative distance and 65 is the cumulative path cost. Incorrect — “110 is the hop count and 65 is the bandwidth”: OSPF uses cost, not hop count, and bandwidth is not displayed here. Incorrect — “110 is the OSPF process ID and 65 is the area”: The process ID and area are not shown in the routing table entry. Incorrect — “110 is the metric and 65 is the administrative distance”: The order is reversed; AD comes first.
Unlock every question, lab and guide
Full access to all 20 certifications for $4.99/month. Cancel anytime.