Step2Study

Cisco CCNA (200-301) practice questions

254 free questions with answers and explanations.

Practice test
  1. 101.A developer must authenticate to a Cisco DNA Center REST API before making configuration calls. The API documentation states that after submitting valid credentials, the server returns a token that must be included in the header of all subsequent requests. Which HTTP header is typically used to pass this token for authentication?Automation and Programmability
  2. 102.A technician captures traffic while a client attempts to connect to a web server on port 443. The capture shows: Client sends [SYN] to server; Server responds with [RST, ACK] to client. What does this exchange indicate?Network Fundamentals
  3. 103.A technician is designing a small office network. Two departments are on separate IP subnets, and the technician needs a device that can forward packets between these subnets based on the destination IP address. Which device should be used?Network Fundamentals
  4. 104.A team uses Terraform to manage cloud-hosted virtual routers. After running 'terraform apply' successfully, a teammate manually deletes one of the routers directly from the cloud provider's console. The next time the team runs 'terraform plan', Terraform reports that it needs to recreate the deleted router. How does Terraform detect that the router is missing?Automation and Programmability
  5. 105.A cloud engineer writes a configuration file that declares the desired end-state of network infrastructure, such as the number of VPCs and subnets required, without specifying the step-by-step commands to create them. Which automation approach does this describe?Automation and Programmability
  6. 106.An engineer must subnet the 192.168.20.0/24 network using VLSM to support a LAN segment requiring 100 hosts. What is the correct subnet mask to use for this segment to minimize wasted addresses?Network Fundamentals
  7. 107.A network engineer wants to allow return traffic for TCP sessions that were initiated by inside hosts to pass back through an extended ACL applied inbound on the router's outside interface, while preventing any new TCP connections from being initiated from the outside network. Which keyword should be added to the end of the permit statement in the ACL?Security Fundamentals
  8. 108.An engineer runs 'enable algorithm-type scrypt secret Cisco123' on a router and then reviews the running-config, seeing 'enable secret 9 $9$abcDEF...'. Compared to the older Type 5 enable secret hash, what security advantage does this Type 9 hash provide?Security Fundamentals
  9. 109.A wireless engineer is deploying access points in a long, narrow warehouse aisle and needs to focus RF energy in a specific direction to extend coverage down the aisle rather than radiating equally in all directions. Which antenna type should the engineer select?Network Fundamentals
  10. 110.A small business wants to deploy wireless access points that operate completely independently, each handling its own management, configuration, and RF settings without relying on a centralized controller. Which AP deployment mode fits this requirement?Network Fundamentals
  11. 111.A network engineer must assign IP addressing for a serial WAN link connecting two routers point-to-point. To conserve address space, which subnet mask should be used for this link?Network Fundamentals
  12. 112.A network engineer must decide between using Ansible and Terraform for a new automation project. The project's primary goal is to provision new cloud-based virtual network infrastructure (VPCs, subnets, and virtual routers) and continuously track the desired end-state of that infrastructure across its full lifecycle. Which characteristic makes Terraform particularly well-suited for this specific goal compared to Ansible?Automation and Programmability
  13. 113.An administrator must permit only traffic from the 172.16.16.0/21 network in an ACL. Which wildcard mask correctly matches this entire subnet?Security Fundamentals
  14. 114.Which IPv6 address is automatically configured on every IPv6-enabled interface and is used only for communication within the local link, never routed beyond it?Network Fundamentals
  15. 115.A company is connecting two buildings that are 3 kilometers apart and requires high bandwidth with immunity to electromagnetic interference. Which cabling type is most appropriate?Network Fundamentals
  16. 116.A router has two active interfaces: Loopback0 with IP 10.0.0.1 and GigabitEthernet0/0 with IP 192.168.1.1. No router-id is manually configured under the OSPF process. Which IP address will OSPF select as the Router ID?IP Connectivity
  17. 117.A client reports intermittent web browsing failures. A packet capture on the client shows the client sending a SYN segment to a web server on port 443, but no SYN-ACK response is ever received, and the connection eventually times out. Which conclusion is most supported by this evidence?Network Fundamentals
  18. 118.A wireless engineer is deploying three access points in overlapping coverage areas using the 2.4 GHz band and wants to eliminate co-channel interference. Which set of channels should be assigned to the three APs?Network Fundamentals
  19. 119.An administrator needs to configure a default route on an IPv6-enabled router so that traffic without a more specific match is forwarded to next-hop 2001:db8:1::1 reachable via interface GigabitEthernet0/1. Which command accomplishes this?IP Connectivity
  20. 120.An engineer is reviewing a CAPWAP deployment between lightweight access points and a wireless LAN controller. Which statement accurately describes the CAPWAP tunnel behavior by default?Network Fundamentals
  21. 121.An engineer allocates the subnet 172.16.5.128/27 to a small office LAN. How many usable host addresses are available on this subnet?Network Fundamentals
  22. 122.A network operations team deploys an AI-driven analytics platform integrated with their wireless controllers. The platform continuously analyzes historical telemetry to establish a baseline of normal client roaming times, then automatically flags deviations before users notice performance issues. Which capability does this scenario best illustrate?Automation and Programmability
  23. 123.A network application developer needs to build a dashboard that queries a Cisco DNA Center controller for real-time device health data. Which type of API does the developer's application use to communicate with the controller?Automation and Programmability
  24. 124.Which statement accurately differentiates TCP from UDP?Network Fundamentals
  25. 125.A DNS administrator needs to permit zone transfers between a primary and secondary DNS server through a firewall. Regular DNS queries already work. Which protocol and port combination must be added to the firewall rule?Network Fundamentals
  26. 126.A network engineer needs to configure a Cisco IOS access control list (ACL) statement that matches any host within the 172.16.16.0/22 network. Which wildcard mask should be used in the ACL entry?Network Fundamentals
  27. 127.A router has learned a route to 172.16.5.0/24 from three different sources: a directly configured static route, RIP, and OSPF, all pointing toward the same next hop. With default administrative distances and no other configuration, which route will be installed in the routing table?IP Connectivity
  28. 128.A technician is connecting two switches directly using a copper Ethernet cable. Modern Gigabit switches typically support auto-MDIX. What does this feature allow?Network Fundamentals
  29. 129.A network administrator needs to determine the current operational status and configured IP address of a specific interface on a Cisco router. Which Cisco IOS command would provide this information concisely?Network Fundamentals
  30. 130.A network administrator is configuring a Cisco router to perform Network Address Translation (NAT). They need to ensure that internal hosts can access external resources and that all internal private IP addresses are translated to a single public IP address. Which type of NAT should be configured?IP Services
  31. 131.A network engineer needs to configure a trunk link between two switches, SW1 and SW2, that are running 802.1Q encapsulation. The engineer wants to ensure that VLAN 99, which carries management traffic, is never tagged when traversing this trunk link. Which command should be used on the trunk port to achieve this requirement?Network Access
  32. 132.A network technician needs to connect two Cisco switches directly to each other using a console cable to configure them. Which type of cable is required for this connection?Network Fundamentals
  33. 133.A network administrator needs to design a network where a single broadcast domain spans multiple physical switches. However, devices within this broadcast domain must be logically separated into different groups that cannot communicate directly with each other without going through a router. Which networking concept allows for this logical segmentation on Layer 2 switches?Network Fundamentals
  34. 134.A network engineer is configuring a new Cisco router. After connecting to the console, the engineer attempts to configure a static route but finds that certain commands are not recognized. Which command should the engineer use to enter the appropriate configuration mode?Network Fundamentals
  35. 135.An IPv6 client is configured with the address 2001:DB8:ACAD:1::10/64. Which of the following is a valid link-local address for this host?Network Fundamentals
  36. 136.A network engineer is designing a new campus network. They need to ensure that all core switches have a direct, dedicated physical link to every other core switch for maximum redundancy and bandwidth. Which network topology best describes this design requirement?Network Fundamentals
  37. 137.A network administrator is designing a new network for a small office that needs to support both wired and wireless clients. The administrator wants to use a single device that combines the functions of a router, a switch, and a wireless access point. Which type of device should they choose?Network Fundamentals
  38. 138.A network administrator is troubleshooting a connectivity issue for a host connected to switch SW1, which is part of a Rapid PVST+ topology. The administrator suspects a loop might be causing the issue. The 'show spanning-tree vlan 10' command output on SW1 shows the following for interface Gi0/1: `Port Gi0/1 (GigabitEthernet0/1) of VLAN0010 is designated forwarding` The administrator also observes that SW1's Bridge ID for VLAN 10 is 32778. SW2, connected to SW1 via Gi0/1, has a Bridge ID of 32778 for VLAN 10 as well. Both switches have the same default priority for VLAN 10 (32768 + VLAN ID). What is the most likely reason for Gi0/1 on SW1 being the designated port for VLAN 10, assuming no manual port priority or cost configuration?Network Access
  39. 139.A network administrator is setting up a new wireless network with a Cisco Wireless LAN Controller (WLC) and several Access Points (APs). The administrator wants to configure an SSID that allows clients to authenticate using a RADIUS server (WPA2-Enterprise) and then maps these clients to VLAN 20 for data traffic. Which WLC GUI section would the administrator primarily use to configure the SSID, its security settings, and its VLAN mapping?Network Access
  40. 140.A network administrator needs to restore a saved configuration file named 'startup-config.bak' from a TFTP server at 10.0.0.1 to the running configuration of a Cisco switch. Which command sequence should the administrator use to perform this operation?IP Services
  41. 141.A network administrator needs to implement a network where a single broadcast domain encompasses multiple physical switches. However, each department connected to these switches must be logically separated from other departments, even if they share the same physical switch. Which technology should be used to achieve this segmentation?Network Fundamentals
  42. 142.A network engineer is troubleshooting a connectivity issue between a workstation and a server. Both are connected to a Cisco Catalyst switch. The engineer suspects a VLAN mismatch. Which CDP-related log message would confirm a native VLAN mismatch on a trunk port?Network Access
  43. 143.A network engineer is troubleshooting a connectivity issue on a Cisco router. They suspect that the router's DNS resolution is not working correctly. Which command can be used to verify the DNS server configured on the router?IP Services
  44. 144.A network engineer needs to implement a network topology where every device has a direct, dedicated point-to-point link to every other device in the network. Which topology best fits this requirement?Network Fundamentals
  45. 145.A network technician is configuring an EtherChannel using LACP between two Cisco Catalyst 2960 switches. The technician has bundled four physical interfaces (Gi0/1 to Gi0/4) into Port-channel1. After configuration, the `show etherchannel summary` command output shows the following for Port-channel1: `Po1(SD)`. What does the 'D' flag indicate in this output?Network Access
  46. 146.A technician is configuring a new Cisco Access Point (AP) to be managed by a Wireless LAN Controller (WLC). The AP has been physically connected to the network and powered on. The technician observes that the AP is not joining the WLC. Upon checking the AP's console, the technician sees messages indicating that the AP is 'Discovering WLCs'. Which of the following methods is NOT a valid way for a Cisco lightweight AP to discover a WLC?Network Access
  47. 147.A network engineer is setting up a new DHCP server on a Cisco router. They need to ensure that the router itself does not dynamically receive an IP address from its own DHCP pool, and also that specific static IP addresses used by other critical network devices (e.g., servers) are not assigned to clients. Which DHCP configuration element should be used for these purposes?IP Services
  48. 148.A network administrator is implementing Quality of Service (QoS) on a Cisco router to prioritize voice traffic over data traffic. Which QoS mechanism is primarily used to classify and mark traffic based on its characteristics?IP Services
  49. 149.A network administrator is performing maintenance on a Cisco switch. They need to configure a specific port to always operate at 100 Mbps full duplex, regardless of the connected device's auto-negotiation capabilities. Which set of commands would achieve this on a GigabitEthernet0/1 interface?Network Fundamentals
  50. 150.A network administrator needs to provide power to a new wireless access point (AP) located in a ceiling, where running a separate electrical outlet is impractical. The AP supports IEEE 802.3at. Which technology would be most suitable to power this AP over the existing Ethernet cabling?Network Fundamentals