There are more than 450 free CCNA practice questions on this site, and every one of them carries a written explanation, not just a letter answer. This page puts them all in one place: 20 sample questions you can work through right now, a mixed quiz that pulls from all six domains, and full practice tests for the four biggest domains of the CCNA 200-301 exam, with the last two on the way.
Nothing here is a brain dump. Every question was written against the official v1.1 exam topics and validated against Cisco documentation or real IOS output from our GNS3 labs, the same labs behind the hands-on guides in the CCNA study roadmap. The banks were last reviewed in July 2026 and track the live CCNA 200-301 (v1.1) blueprint.
Try 20 CCNA sample questions first
These 20 questions mirror the weight of the real thing: more IP Connectivity than anything else, equal blocks of Network Fundamentals and Network Access, and smaller sets for IP Services, Security, and Automation. Work each one before expanding the answer. If the explanation teaches you something, that topic needs study time, and the exam topics list maps every objective to a full guide.
Network Fundamentals (Domain 1, 20 percent)
Q1. A subnet must support 50 hosts. What is the smallest mask that works?
A. /26
B. /27
C. /25
D. /28
Show answer
A. 2^5 minus 2 gives 30 usable hosts, too few; 2^6 minus 2 gives 62, which covers 50, so /26 is the smallest mask that fits.
Q2. A router strips the incoming Ethernet header and trailer, reads the IP header to make a forwarding decision, and builds a new frame for the next hop. At which two OSI layers does it operate?
A. Layer 1 and Layer 2
B. Layer 2 and Layer 3
C. Layer 3 and Layer 4
D. Layer 4 and Layer 7
Show answer
B. It rewrites the Layer 2 frame and routes on the Layer 3 IP header. The IP packet is end-to-end; the frame is rebuilt at every hop.
Q3. A host needs to resolve a hostname with a standard DNS query. Which transport protocol and destination port does it use?
A. TCP, port 53
B. UDP, port 53
C. TCP, port 443
D. UDP, port 69
Show answer
B. Standard DNS queries use UDP port 53. DNS uses TCP 53 for zone transfers and for responses too large for UDP.
Q4. Which IPv6 address type is generated automatically on every IPv6-enabled interface with no configuration?
A. Global unicast
B. Unique local
C. Link-local
D. Anycast
Show answer
C. A link-local address (FE80::/10) is created automatically the moment IPv6 is active on an interface. Global unicast and unique local addresses require configuration or SLAAC.
Network Access (Domain 2, 20 percent)
Q5. What is the normal VLAN range on a Cisco switch?
A. 0 to 4095
B. 1 to 1005
C. 1 to 4094
D. 1006 to 4094
Show answer
B. The normal range is 1 to 1005. VLAN 1 is the default VLAN and 1002 to 1005 are reserved for legacy Token Ring and FDDI; none of them can be deleted. 1006 to 4094 is the extended range, used for things like service-provider VLANs.
Q6. Which switch becomes the root bridge?
A. The one with the most ports
B. The one with the lowest bridge ID
C. The one with the highest IP address
D. The first one powered on
Show answer
B. The switch with the lowest bridge ID (priority first, then MAC address) wins the election and becomes root. Every other switch finds its single best path to that root.
Q7. Which two mode combinations form an EtherChannel with LACP? (choose two)
A. active and active
B. active and passive
C. passive and passive
D. on and active
Show answer
A and B. LACP needs at least one active side: active/active and active/passive both form a channel. Passive/passive never negotiates, and mixing on (static) with active does not form a channel.
Q8. In a split-MAC architecture, which functions does the WLC handle?
A. Real-time functions like beacons and frame encryption
B. Management functions like association, authentication, RF management, and roaming
C. Nothing, the AP does everything
D. Only powering the AP
Show answer
B. Split-MAC divides the 802.11 MAC work: the lightweight AP keeps the real-time jobs (beacons, ACKs, encryption), and the WLC takes the management jobs (association, authentication, RF management, roaming, and policy).
IP Connectivity (Domain 3, 25 percent)
Q9. What does administrative distance rank?
A. The speed of a link
B. The trustworthiness of a route’s SOURCE when two sources offer the same prefix
C. The number of hops to a network
D. The size of the routing table
Show answer
B. Administrative distance ranks how trustworthy a route source is. When two protocols (or a protocol and a static) offer the same prefix, the router installs the one with the lowest AD.
Q10. What is a floating static route?
A. A static route that load-balances
B. A backup static route with a manually raised administrative distance, so it installs only when the primary fails
C. A route that changes its next hop automatically
D. A default route
Show answer
B. A floating static route is a static route configured with a higher AD (for example 200) than the primary path. While the primary is up it stays out of the routing table; it installs only when the primary route is withdrawn.
Q11. On a broadcast (multi-access) network, what does OSPF elect to reduce adjacencies?
A. A root bridge
B. A designated router (DR) and a backup designated router (BDR)
C. An active and standby gateway
D. A root port
Show answer
B. On a broadcast segment OSPF elects a DR and a BDR. Every other router (a DROTHER) forms a full adjacency only with the DR and BDR, which avoids a full mesh of adjacencies. Point-to-point links elect no DR/BDR.
Q12. Which command advertises the network 10.0.12.0/30 into OSPF area 0 using the network-statement method?
A. network 10.0.12.0 255.255.255.252 area 0
B. network 10.0.12.0 0.0.0.3 area 0
C. network 10.0.12.0 /30 area 0
D. ip ospf network 10.0.12.0 area 0
Show answer
B. The network command takes a wildcard mask, not a subnet mask. A /30 is 255.255.255.252, whose wildcard (inverse) is 0.0.0.3. So network 10.0.12.0 0.0.0.3 area 0 matches the two host addresses on that link.
Q13. How do hosts reach the virtual gateway in an HSRP group?
A. They are configured with both routers’ real IP addresses
B. They use the shared virtual IP as their default gateway and never learn the routers’ real addresses
C. They broadcast to find an active router for every packet
D. They alternate between the two routers packet by packet
Show answer
B. Hosts point at the virtual IP, for example 192.168.10.254, and ARP for it. The active router answers with the virtual MAC. The hosts never use or even learn the routers’ real interface addresses.
IP Services (Domain 4, 10 percent)
Q14. Which NAT type lets a host on the outside start a connection to an inside server at a fixed, predictable address?
A. Dynamic NAT
B. PAT overload
C. Static NAT
D. No NAT type allows this
Show answer
C. Static NAT is a permanent one-to-one mapping that works in both directions, so the outside can reach the inside server at its fixed public address. Dynamic NAT and PAT are built for outbound-initiated traffic.
Q15. What transport protocol and port does NTP use?
A. TCP 123
B. UDP 123
C. TCP 161
D. UDP 69
Show answer
B. NTP exchanges time messages over UDP port 123. UDP 69 is TFTP and UDP/TCP 161 is SNMP, both common distractors on the same exam objective.
Security Fundamentals (Domain 5, 15 percent)
Q16. A standard ACL can match on which part of a packet?
A. Source and destination IP
B. Source IP address only
C. Protocol and port
D. MAC address
Show answer
B. A standard ACL matches the source IP address only. To filter on destination, protocol, or port you need an extended ACL.
Q17. What is the default port security violation mode?
A. protect
B. restrict
C. shutdown
D. disable
Show answer
C. Shutdown is the default. On a violation the port is err-disabled and stops forwarding until an administrator recovers it, so an attacker gains nothing and you get a log entry.
Q18. On an untrusted port, which DHCP messages does snooping drop?
A. Client messages like DISCOVER and REQUEST
B. Server messages like OFFER, ACK, and NAK
C. All DHCP messages
D. Only DHCP renewals
Show answer
B. Untrusted ports may carry client-to-server messages but never server-to-client replies. A server reply on an untrusted port is how a rogue DHCP server is detected, so it is dropped.
Automation and Programmability (Domain 6, 10 percent)
Q19. In controller-based networking, which plane does the controller centralize?
A. The data plane
B. The control plane
C. The physical layer
D. The application layer
Show answer
B. The controller centralizes the control plane: it computes forwarding decisions and pushes them to the devices through a southbound interface. The devices keep the data plane and continue to forward packets themselves.
Q20. Which configuration management tool is agentless and connects to devices over SSH to run tasks defined in YAML playbooks?
A. Puppet
B. Chef
C. Ansible
D. Terraform
Show answer
C. Ansible needs no agent on the managed device: it connects over SSH and executes tasks written as YAML playbooks. Terraform is declarative infrastructure provisioning rather than task-based configuration, and Puppet and Chef both rely on an installed agent.
Take a mixed 15-question practice quiz
The sample questions above are fixed, so a second read-through tests your memory of this page rather than your networking. The quiz below is different: 15 fresh questions drawn from all six domains, scored as you go, with an explanation after every answer. It uses the same format mix as the real CCNA 200-301 exam, including multiple choice, choose-two, and matching items, which the question types guide breaks down in detail.
Retake it as often as you like. When you clear it comfortably, move to the full domain tests below, which draw from much deeper banks.
The full CCNA practice tests, by domain
Each domain test draws 30 questions at random from a dedicated bank, and re-samples on every retake, so no two runs are identical. The banks are weighted the way the domain itself is weighted, with the heaviest sub-topics carrying the most questions.
| Domain | Weight | Bank size | Practice test |
|---|---|---|---|
| 1. Network Fundamentals | 20% | 42 questions | Domain 1 practice test |
| 2. Network Access | 20% | 59 questions | Domain 2 practice test |
| 3. IP Connectivity | 25% | 91 questions | Domain 3 practice test |
| 4. IP Services | 10% | In progress | Coming soon, per-topic quizzes below cover it today |
| 5. Security Fundamentals | 15% | 84 questions | Domain 5 practice test |
| 6. Automation and Programmability | 10% | In progress | Coming soon |
The Domain 4 and Domain 6 tests are being built now, along with a full-length timed exam that mixes all six domains in real proportions. Until then, the Domain 4 per-topic quizzes below cover NAT, DHCP, NTP, SNMP, syslog, and QoS individually.
Every per-topic CCNA quiz, by domain
Every hands-on guide in the CCNA series ends with a short quiz on exactly that topic, which is the fastest way to drill one weak area without sitting a 30-question test. Here is the full index.
Network Fundamentals: the OSI and TCP/IP models, TCP versus UDP, routers, switches, and firewalls, network architectures, copper versus fiber cabling, Power over Ethernet, the MAC address table, wireless fundamentals, virtualization, IPv4 addressing, subnetting by requirements, VLSM, the subnetting cheat sheet, IPv6 addressing, verifying IP settings, and interface troubleshooting.
Network Access: IOS CLI navigation, base device configuration, VLANs, 802.1Q trunking, CDP and LLDP, Spanning Tree Protocol, EtherChannel, wireless architectures and AP modes, router-on-a-stick, and Layer 3 switch SVIs.
IP Connectivity: reading the routing table, packet forwarding, IPv4 static routes, IPv6 static routes, OSPF concepts, single-area OSPF configuration, HSRP and first hop redundancy, and IP connectivity troubleshooting.
IP Services: NAT and PAT, DHCP server and relay, NTP, SNMP and syslog, and QoS concepts.
Security Fundamentals: security concepts, device access control and passwords, AAA with RADIUS and TACACS+, access control lists, port security, DHCP snooping, dynamic ARP inspection, and VPN types.
Automation and Programmability quizzes ship with the Domain 6 guides, which are in progress. The two sample questions above show the style; the objectives themselves are listed in the exam topics breakdown.
Why CCNA dumps backfire
Searching for practice questions eventually surfaces exam dumps: leaked copies of live exam questions sold or shared as “real questions”. Skip them, for three practical reasons.
First, using brain dumps violates the Cisco certification agreement, and Cisco does revoke certifications and ban candidates over it. A revoked CCNA is worse than a failed attempt, because the ban follows your candidate ID. Second, dumps are full of wrong answers. Nobody validates them, the answer keys contradict each other, and you end up confidently memorizing errors. Third, and most practically: the CCNA 200-301 exam pulls from a large rotating pool with performance-based lab items, so memorized questions do not reliably appear, and a dump cannot type IOS commands for you.
Memorizing answers also defeats the reason to hold the certification at all. The value of a CCNA on your CV is that you can subnet under pressure, read a routing table, and explain why a trunk is down, in an interview and on the job. Practice questions built on explanations train exactly that; dumps train recall of question IDs. If cost is the concern, everything on this page is free, and the exam cost breakdown covers what the real attempt runs.
What your score is telling you
Cisco does not publish an official passing score, but consistent performance around 85 percent on the domain tests is the level where real attempts stop feeling risky. Below 70 percent on any domain, stop testing and go study: follow that domain’s guides from the index above, do the labs, and come back. Between 70 and 85, drill the specific per-topic quizzes that expose gaps, since a domain score hides which sub-topic is dragging it down.
Scores also decay. A domain you cleared three weeks ago is worth retesting the week before your attempt, because the re-sampled questions will tell you honestly whether it stuck. When every domain holds steady, pick a date using the booking and format guide and work through the study roadmap checklist one last time. If you want the whole run scheduled day by day, the 90-day study plan lays it out.
