Free Cisco CCNA (200-301) practice test

The Cisco CCNA (200-301) is the foundational networking certification: it covers network fundamentals, network access, IP connectivity, IP services, security fundamentals, and automation and programmability. This site gives you 328 original practice questions and 12 hands-on simulations for it, free and without an account.

CCNA leans hard on the command line and applied skills: subnetting under time, reading show output, and configuring VLANs, OSPF, ACLs, and NAT. The simulation lab here reproduces those formats, including a device terminal that accepts real IOS commands and clickable network diagrams. Every topic links to the matching free Jeremy's IT Lab video.

What CCNA 200-301 covers

200-301 domainExam weightQuestions here
Network Fundamentals20%about 66
Network Access20%about 66
IP Connectivity25%about 82
IP Services10%about 33
Security Fundamentals15%about 49
Automation and Programmability10%about 33

Real exam facts: 120 minutes, roughly 90 to 120 items including sims and simlets. A scaled score near 825 of 1,000 is widely cited to pass; Cisco does not publish an official cut score.

Practice questions from this bank

Sample question 1 · 200-301 · Network Fundamentals

Which device makes forwarding decisions based on Layer 3 destination IP addresses and connects separate broadcast domains?

  1. AWireless access point
  2. BRouter
  3. CLayer 2 switch
  4. DEthernet hub
Show answer and explanation

B. Router

A router forwards packets between networks using destination IP addresses and terminates broadcast domains, while a Layer 2 switch forwards frames within one broadcast domain using MAC addresses.

Topic: Jeremy's IT Lab — Day 1: Network Devices

Sample question 2 · 200-301 · Network Access

An administrator enters vlan 20 from global configuration and then name SALES. What is the immediate result on the switch?

  1. AVLAN 20 is created but the name is ignored until the switch reloads
  2. BThe switch rejects the name because it exceeds the length limit
  3. CVLAN 20 exists only after copy running-config startup-config runs
  4. DVLAN 20 is created in the local database and receives the name SALES
Show answer and explanation

D. VLAN 20 is created in the local database and receives the name SALES

The vlan command creates the VLAN in the local database and enters VLAN configuration mode, where name applies a label right away. No reload or save is required for the VLAN to exist and be usable.

Topic: Jeremy's IT Lab — Day 16: VLANs (Part 1)

Sample question 3 · 200-301 · IP Connectivity

A router has learned the same destination network through a static route and through OSPF. Which route does the router install in its routing table?

  1. AThe route that was configured or learned most recently
  2. BThe OSPF route because its administrative distance is lower
  3. CThe static route because its administrative distance is 1
  4. DThe route with the lower hop count to the destination
Show answer and explanation

C. The static route because its administrative distance is 1

Administrative distance decides between sources; a static route defaults to 1 and OSPF is 110, so the lower value 1 makes the static route preferred. Metrics only break ties within a single routing protocol.

Topic: Jeremy's IT Lab — Day 24: Dynamic Routing

Sample question 4 · 200-301 · IP Services

What does the inside global address represent in Cisco NAT terminology?

  1. AThe public address of a destination host out on the Internet
  2. BThe private address an outside host is given on the internal network
  3. CThe private address assigned to an inside host on the local LAN
  4. DThe public address that represents an inside host to the outside network
Show answer and explanation

D. The public address that represents an inside host to the outside network

Inside global is the routable public address that stands in for an internal host when its traffic reaches the outside. The private address on the LAN is the inside local, not the inside global.

Topic: Jeremy's IT Lab — Day 44: NAT (Part 1, static)

Sample question 5 · 200-301 · Security Fundamentals

A newly discovered flaw in a router's web management interface has no patch available yet. In security terminology, what does this unpatched flaw itself represent?

  1. AA countermeasure
  2. BA vulnerability
  3. CA working exploit
  4. DAn active threat
Show answer and explanation

B. A vulnerability

The unpatched flaw is a vulnerability, a weakness that could be leveraged. A threat is the potential danger or actor, while an exploit is the actual technique used against the weakness.

Topic: Jeremy's IT Lab — Day 48: Security Fundamentals

Sample question 6 · 200-301 · Automation and Programmability

A network team wants to reduce human error when deploying identical VLAN settings to 40 access switches. Which approach best achieves consistent, repeatable configuration?

  1. APush the configuration from a central automation tool using a standard template
  2. BConfigure each switch manually through its own console port
  3. CAsk each site technician to type the commands from a printed runbook
  4. DCopy and paste the commands into each switch over separate SSH sessions
Show answer and explanation

A. Push the configuration from a central automation tool using a standard template

Template-driven automation applies the same validated configuration everywhere, removing the typos and drift that manual, per-device entry introduces.

Topic: Jeremy's IT Lab — Day 59: Intro to Network Automation

Sample question 7 · 200-301 · Network Fundamentals

A small office subscribes to an email platform from a service provider, and staff reach it over the internet. Which deployment model does this describe?

  1. AA colocation facility
  2. BAn on-premises private cloud
  3. CA cloud-based service
  4. DA hybrid deployment
Show answer and explanation

C. A cloud-based service

An application consumed as a subscription from a provider over the internet is the cloud model: the provider owns and maintains the infrastructure while the office simply uses the service. A colocation facility would house server hardware the office itself owns and manages, and a hybrid deployment would combine the provider's service with infrastructure the office still runs, neither of which fits a pure subscription offering.

Topic: Jeremy's IT Lab — Day 52: LAN Architectures

Sample question 8 · 200-301 · Network Access

How does traffic assigned to the native VLAN traverse an 802.1Q trunk link?

  1. AIt is forwarded carrying a double 802.1Q tag
  2. BIt is encapsulated with ISL instead of 802.1Q
  3. CIt is forwarded untagged across the trunk
  4. DIt is dropped unless a voice VLAN is present
Show answer and explanation

C. It is forwarded untagged across the trunk

802.1Q leaves native VLAN frames untagged on the trunk, which is why both ends must agree on the native VLAN. All other VLANs cross the trunk with a tag added.

Topic: Jeremy's IT Lab — Day 17: VLANs (Part 2, trunking)

Common questions

How many questions are on the CCNA exam?

The CCNA 200-301 is a 120-minute exam with roughly 90 to 120 items, mixing multiple choice, multiple response, and hands-on simulations (sims and simlets). Cisco does not publish the exact count or cut score; a scaled score around 825 of 1,000 is widely cited to pass.

Do I need a prerequisite for CCNA?

No. CCNA has no formal prerequisites, though Cisco suggests about a year of hands-on networking experience. It is the standard associate-level networking certification.

What does CCNA 200-301 cover?

Six domains: Network Fundamentals (20%), Network Access (20%), IP Connectivity (25%), IP Services (10%), Security Fundamentals (15%), and Automation and Programmability (10%). Our drills track your accuracy in each domain separately.

Is this actually free?

Yes. Every question, every simulation, and the exam simulator are free with no account. Every topic links to the matching Day lesson in Jeremy's IT Lab's free CCNA 200-301 course.

More free practice tests

Back to all cert900 exams