Free CCNA 200-301 Practice Questions with Explanations

Answer: C — 172.16.45.191.

A /26 mask is 255.255.255.192, so the subnets in the last octet go up in blocks of 64: .0, .64, .128, .192. The address .130 falls in the 172.16.45.128 subnet. The broadcast is the last address before the next subnet: .192 − 1 = .191. Usable hosts are .129–.190.

.127 is the broadcast of the previous subnet, .159 would be correct for a /27, and .255 for a /24.

Answer: C — Link-local.

Addresses in FE80::/10 are link-local. Every IPv6-enabled interface creates one automatically, routers never forward them off the link, and routing protocols such as OSPFv3 use them as the next-hop address. The FFFE in the middle of the interface ID shows it was built with modified EUI-64 from the MAC address.

Global unicast addresses currently come from 2000::/3, unique local from FC00::/7 (in practice FD00::/8), and multicast from FF00::/8.

Answer: B.

UDP is connectionless: no handshake, no sequence numbers, no acknowledgements, no windowing. If reliability is needed, the application provides it. That low overhead is why voice, video, DNS queries, DHCP and TFTP use UDP.

The handshake and windowing belong to TCP. The UDP header is only 8 bytes (source port, destination port, length, checksum); 20 bytes is the minimum TCP header.

Answer: B — access link.

A port in dynamic auto only answers DTP requests; it never starts negotiation. With auto on both sides nobody asks, so the link stays an access link. A trunk forms when at least one side is dynamic desirable or trunk.

In production, set trunks statically with switchport mode trunk and turn DTP off with switchport nonegotiate.

Answer: C — SW3.

The lowest bridge ID wins, and the priority is compared before the MAC address. SW3 has 28673 (28672 + VLAN 1 as the system ID extension), lower than 32769 on the other two, so it is root even though its MAC address is the highest.

The MAC address only breaks a tie between equal priorities. If SW3 were removed, SW2 would win over SW1 because 000A… is lower than 0011….

Answer: C — active – passive.

LACP has two modes: active sends LACP packets, passive only replies. A channel forms when at least one side is active: active–active or active–passive. Passive–passive never starts negotiation.

On forces a channel with no protocol, so it only works with on at the other end. Auto is a PAgP mode and cannot talk to LACP.

Answer: B — the EIGRP route 10.1.1.0/24.

The router picks the longest prefix that actually contains the destination. 10.1.1.0/25 covers only 10.1.1.0–10.1.1.127, so 10.1.1.200 does not match it at all. Of the routes that do match (/24, /16, /0), the /24 is the longest.

Administrative distance does not decide here: it only compares routes to the same prefix learned from different sources.

Answer: C — administrative distance 115.

This is a floating static route. OSPF has an administrative distance of 110, so the static route needs a higher one to stay out of the routing table while OSPF is working. 115 does that, and when the OSPF route is lost the static route is installed.

Without a distance (A) the static route has AD 1 and replaces OSPF immediately; 100 is also lower than 110. AD 255 means “never trust”, so that route is never installed at all.

Answer: C — hello/dead interval mismatch.

Hello packets carry the hello and dead intervals, and neighbors must agree on them. They must also share the area ID, the subnet and mask, the authentication settings and the stub area flag. An MTU mismatch lets them see each other but leaves them stuck in EXSTART/EXCHANGE.

The process ID is local to each router and may differ. Router IDs must be different. Priority only influences the DR/BDR election.

Answer: C — PAT (NAT overload) on the interface address.

ACL 1 selects which inside source addresses are translated, interface GigabitEthernet0/1 uses that interface’s address as the public address, and overload lets many hosts share it by tracking different source ports. This is the typical setup for an office internet connection.

Dynamic NAT would refer to a pool; static NAT maps one fixed inside address with ip nat inside source static. The interfaces still need ip nat inside and ip nat outside.

Answer: B — ip helper-address.

DHCP Discover is a broadcast, and routers do not forward broadcasts. ip helper-address turns the gateway into a DHCP relay agent: it receives the broadcast, sends it as a unicast to the server and adds its own interface address (giaddr), so the server knows which pool to use.

ip dhcp pool and excluded-address are for a router that is itself the DHCP server. ip address dhcp makes the interface a DHCP client.

Answer: B — ntp server 10.0.0.1.

ntp server makes the router an NTP client of that server. Check it with show ntp status (synchronised, stratum) and show ntp associations.

ntp master does the opposite: the router announces its own clock as an authoritative source. ntp peer sets up symmetric mode, where the two devices can sync each other. clock set sets the time by hand and takes a time and date, not an address.

Answer: C — restrict.

Restrict drops the offending frames, logs the event and counts it, while legitimate traffic keeps flowing.

Protect also drops the frames but silently, with no log and no counter. Shutdown is the default: the port goes into err-disabled state and stays down until it is reset. “err-disable” is the resulting state, not a violation mode you configure.

Answer: B — close to the destination.

A standard ACL (numbers 1–99 and 1300–1999) matches only the source address. Applied near the source, it would block that host from every destination, not just the one you meant to protect.

Extended ACLs match source, destination, protocol and ports, so they go close to the source and stop unwanted traffic before it crosses the network. Standard ACLs on VTY lines are a valid use, but not the only one.

Answer: B — SAE (Simultaneous Authentication of Equals).

SAE replaces the WPA2-PSK 4-way handshake as the way the passphrase is checked. It resists offline dictionary attacks on a captured handshake and provides forward secrecy. WPA3 also requires Protected Management Frames.

TKIP is the old WPA encryption method, WEP is the original and broken Wi-Fi security, and LEAP is an old Cisco EAP method for enterprise authentication.

Answer: B — Southbound API.

Southbound interfaces connect the controller down to switches and routers. Examples are OpenFlow, NETCONF, RESTCONF and SSH/CLI.

The northbound API, usually REST, faces up towards applications and scripts that use the controller. Cisco Catalyst Center (formerly DNA Center) is a typical example: scripts call its northbound REST API, and it configures devices southbound. The overlay is the virtual network built on top of the physical underlay, not an API.

Answer: A.

JSON is made of key/value pairs inside { } and lists inside [ ]. Keys and string values must use double quotes, and pairs are separated by commas.

B uses single quotes, C has a trailing comma after the last pair, and D has an unquoted key. All three are fine in JavaScript or Python but invalid JSON, and an API will reject them.

Answer: B — 201 Created.

201 means the request succeeded and a new resource was created; the response usually includes its location or data. 200 is the generic “success”, typical for GET. 204 means success with an empty response body, often for DELETE. 401 means the request had no valid authentication.

Remember the CRUD mapping: Create = POST, Read = GET, Update = PUT/PATCH, Delete = DELETE.