22 Network Fundamentals Practice Questions & Answers

1. 1. Hosts in two departments share one flat Layer 2 network, and ARP and DHCP broadcasts from each department reach every host in the other. An engineer puts a router between the departments and gives each department its own subnet. What happens to those broadcasts?

   • A.They still pass, but each port isolates collisions
   • B.They stop at the router, which separates broadcast domains✓ Answer
   • C.They pass through, since routers forward all broadcasts
   • D.They stop only if the router ports are set to full duplex

   A router does not forward Layer 2 broadcasts (destination FFFF.FFFF.FFFF) from one interface to another, so each routed interface marks the edge of a broadcast domain. Duplex settings have nothing to do with broadcast forwarding. Isolating collisions per port is what a switch does, and it does not stop broadcasts.

   Ref QB-F32ZK9Source: Cisco CCNA 200-301 Exam Topics — 1.1.a RoutersReport a problem with this question

2. 2. A distribution switch carries VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). Hosts can reach other hosts in their own VLAN but not in the other VLAN, and the network has no router. Which capability lets this switch forward traffic between the two VLANs on its own?

   • A.Routing via a switched virtual interface (SVI) per VLAN✓ Answer
   • B.Adding both VLANs' MAC addresses to one shared table
   • C.Bridging both VLANs into one collision domain per port
   • D.Flooding frames from VLAN 10 out of the VLAN 20 ports

   Traffic between VLANs is traffic between different subnets, so it must be routed at Layer 3. A Layer 3 (multilayer) switch does this with one SVI per VLAN, and each SVI acts as the default gateway for that VLAN's hosts. A Layer 2 switching function never forwards a frame from one VLAN into another, and sharing a MAC table or bridging does not create a routing path between subnets.

   Ref QB-WJGGU7Source: Cisco CCNA 200-301 Exam Topics — 1.1.b Layer 2 and Layer 3 switchesReport a problem with this question

3. 3. Company policy allows general HTTPS browsing but must block one specific file-sharing application that also runs over TCP 443. The current stateful firewall can match only addresses, protocols and ports. What does a next-generation firewall add that meets this requirement?

   • A.Filtering on source and destination port numbers only
   • B.Identifying and controlling applications, not just ports✓ Answer
   • C.Translating private addresses to one public address
   • D.Tracking TCP session state for return traffic on TCP 443

   An NGFW adds application visibility and control (AVC). It inspects traffic to identify the actual application whatever port it uses, so it can allow ordinary web browsing on TCP 443 while blocking one application on the same port. NGFWs also add URL filtering, an integrated IPS and malware protection. Stateful session tracking is what the existing firewall already does. Port filtering cannot tell two applications on TCP 443 apart, and NAT does not identify applications at all.

   Ref QB-E3PNE8Source: Cisco CCNA 200-301 Exam Topics — 1.1.c Next-generation firewalls and IPSReport a problem with this question

4. 4. A security team wants exploit traffic aimed at a web server to be dropped automatically before it reaches the server, not just reported. Which sensor type and placement meets this goal?

   • A.An IPS connected to a SPAN port receiving mirrored copies
   • B.An IPS placed inline in the traffic path to the server✓ Answer
   • C.An IDS placed inline that only logs matching signatures
   • D.An IDS fed a copy of traffic from a switch SPAN port

   Only a device that sits inline handles the original packets, so only an inline device can drop a malicious packet before it is delivered. An IPS deployed inline does exactly that. A sensor on a SPAN port receives only mirrored copies, so even an IPS there cannot stop the original packet. An IDS by definition detects and alerts but does not block.

   Ref QB-ZJJGCBSource: Cisco CCNA 200-301 Exam Topics — 1.1.c Next-generation firewalls and IPSReport a problem with this question

5. 5. A new outdoor PTZ camera needs about 25 W at the device. The access switch port that powers it is the power sourcing equipment (PSE), and the camera is the powered device (PD). Which is the lowest IEEE PoE standard that can supply it?

   • A.802.3az, which defines the PoE power classes
   • B.802.3af (PoE), up to about 15.4 W at the PSE
   • C.802.3at (PoE+), up to about 30 W at the PSE✓ Answer
   • D.802.3bt (4PPoE), needed for anything over 15.4 W

   802.3at (PoE+) supplies about 30 W at the PSE, which leaves about 25.5 W at the PD after cable loss. That is enough for a 25 W camera. 802.3af supplies only 15.4 W at the PSE (about 13 W at the PD). 802.3bt (60 to 90 W) would also work, but it is not the lowest standard that fits and is not required just above 15.4 W. 802.3az is Energy Efficient Ethernet, not a PoE standard.

   Ref QB-H3RNXBSource: IEEE 802.3at (PoE+); Cisco CCNA 200-301 Exam Topics — 1.1.h PoEReport a problem with this question

6. 6. In a three-tier campus design, an engineer must decide where to place the Layer 2/Layer 3 boundary, inter-VLAN routing for a building's access switches, and policy such as ACL filtering. Which layer is the right place?

   • A.Distribution layer, which aggregates the access switches✓ Answer
   • B.Access layer, where the endpoints plug into the network
   • C.Every layer equally, applied identically at each hop
   • D.Core layer, since all traffic between buildings meets there

   The distribution layer aggregates the access switches. It is the usual Layer 2/Layer 3 boundary, routes between VLANs, and is where policy such as ACLs is applied. The core layer should be a fast, highly available backbone with no CPU-heavy policy or filtering. The access layer connects endpoints and handles port-level features such as port security and PoE. Repeating the same policy at every hop wastes resources and makes troubleshooting harder.

   Ref QB-YJ767ASource: Cisco CCNA 200-301 Exam Topics — 1.2.b Three-tierReport a problem with this question

7. 7. A small company campus has one building with six access switches. The designer wants a hierarchical design but cannot justify buying a separate set of core switches. Which architecture fits?

   • A.Spine-leaf, with every access switch linked to every spine
   • B.Three-tier, with a dedicated core above distribution
   • C.Full mesh, with every access switch linked to all others
   • D.Two-tier (collapsed core), merging core and distribution✓ Answer

   A two-tier (collapsed core) design combines the core and distribution functions in one pair of switches, which keeps the hierarchy while avoiding the cost of a separate core. That suits a smaller, single-building campus. Three-tier adds a dedicated core, which pays off only when many distribution blocks must be interconnected. Spine-leaf is a data center fabric design, and a full mesh of access switches does not scale and breaks the hierarchy.

   Ref QB-G3DBSASource: Cisco CCNA 200-301 Exam Topics — 1.2.a Two-tierReport a problem with this question

8. 8. A spine-leaf data center fabric has four spines and twelve leaves. It has run out of server-facing ports, while uplink bandwidth is still adequate. How should the fabric be expanded while keeping its design rules?

   • A.Add a spine and connect the new servers directly to it
   • B.Add a leaf and connect it to one spine to save uplink ports
   • C.Add a leaf and connect it to the two nearest existing leaves
   • D.Add a leaf and connect it to every one of the four spines✓ Answer

   In spine-leaf, servers and other endpoints attach only to leaves, every leaf connects to every spine, and leaves never connect to other leaves. Adding a leaf adds access ports, and adding a spine adds fabric bandwidth. Because this fabric needs ports, the answer is a new leaf with an uplink to all four spines. That keeps every leaf-to-leaf path at the same hop count (leaf-spine-leaf). Connecting servers to a spine, linking leaves together, or uplinking to only one spine each breaks those rules.

   Ref QB-3K96QDSource: Cisco CCNA 200-301 Exam Topics — 1.2.c Spine-leafReport a problem with this question

9. 9. A company moves an application to a cloud provider. The provider supplies virtual machines, storage and networking, and the company's own staff install and patch the operating systems and the application. Which cloud service model is this?

   • A.Software as a Service (SaaS)
   • B.Platform as a Service (PaaS)
   • C.Hybrid cloud (a deployment model)
   • D.Infrastructure as a Service (IaaS)✓ Answer

   In IaaS the provider runs the physical hardware, the virtualization layer, storage and networking, and the customer manages everything from the guest operating system up. In PaaS the provider also manages the operating system and runtime, so the customer deploys only code. In SaaS the provider runs the whole application. Hybrid cloud is a deployment model that combines private and public clouds, not a service model.

   Ref QB-K3FBAESource: NIST SP 800-145 cloud service models; Cisco CCNA 200-301 Exam Topics — 1.2.f On-premises and cloudReport a problem with this question

10. 10. Two buildings on a campus are about 2 km apart and must be joined by a 1 Gbps Ethernet link. Which media and standard fit this distance?

    • A.Shielded Cat 6a copper with 1000BASE-T
    • B.Multimode fiber with 1000BASE-SX optics
    • C.Category 6 UTP with 1000BASE-T ports
    • D.Single-mode fiber with 1000BASE-LX optics✓ Answer

    1000BASE-LX uses a long-wavelength laser over single-mode fiber and reaches at least 5 km, so a 2 km run fits. 1000BASE-SX over multimode fiber tops out at about 550 m. Every twisted-pair copper standard, shielded or not, is limited to 100 m.

    Ref QB-E4ZU8GSource: IEEE 802.3z (1000BASE-X); Cisco CCNA 200-301 Exam Topics — 1.3.a Single-mode fiber, multimode fiber, copperReport a problem with this question

11. 11. Two older switches must be connected copper port to copper port. Neither switch supports Auto-MDIX. The technician first tries a straight-through cable, and the link stays down. Which cable is needed, and why?

    • A.A rollover cable, because switch-to-switch links use console pinouts
    • B.A straight-through cable with the speed set manually on both ends
    • C.A crossover cable, because both switches transmit on the same pairs✓ Answer
    • D.A single-mode fiber patch, because copper can't link two switches

    Like devices, such as two switches, transmit and receive on the same pairs (at 10/100 Mbps, both receive on pins 1,2 and transmit on 3,6). A crossover cable is needed so each side's transmit pair reaches the other side's receive pair, unless Auto-MDIX swaps them automatically. A rollover cable is for console access. Setting the speed does not change the pinout, and copper links between switches are normal.

    Ref QB-WKTPNFSource: IEEE 802.3 MDI/MDI-X pinouts; Cisco CCNA 200-301 Exam Topics — 1.3 Compare physical interface and cabling typesReport a problem with this question

12. 12. A lab still uses a hub to connect eight hosts. The hub is replaced with a switch, and each host autonegotiates with its own switch port. How does Ethernet operation on each link change?

    • A.Links stay half duplex but CSMA/CD becomes faster
    • B.Links run full duplex and CSMA/CD is no longer needed✓ Answer
    • C.Links stay half duplex because switches still use CSMA/CD
    • D.Links run full duplex but still share one collision domain

    A hub is shared media. Every host is in one collision domain, runs half duplex, and must use CSMA/CD. A switch port connected to a single host is a point-to-point link, so both ends negotiate full duplex. Collisions can no longer occur, CSMA/CD is disabled, and each port is its own collision domain.

    Ref QB-F4C7EHSource: Cisco CCNA 200-301 Exam Topics — 1.3.b Connections (Ethernet shared media and point-to-point)Report a problem with this question

13. 13. A server NIC was hard-coded to 100 Mbps full duplex. The switch port it connects to was left on auto speed and auto duplex, and the switch's port status shows the link at a-100 and a-half. Users report slow transfers. What explains this?

    • A.The switch matched both speed and duplex from the server
    • B.A speed mismatch occurred, so the link is running degraded
    • C.The switch sensed the speed but defaulted to half duplex✓ Answer
    • D.The cable is too long, so the switch lowered the duplex

    A hard-coded NIC does not take part in autonegotiation. The auto side can still detect the speed from the incoming signal, but it cannot learn the duplex, so at 10 or 100 Mbps it falls back to half duplex. The result is a duplex mismatch: the half-duplex switch port records late collisions and the full-duplex server records CRC errors and runts. A real speed mismatch would bring the link down. Fix it by setting both ends the same way or setting both to auto.

    Ref QB-XK62UGSource: IEEE 802.3 Clause 28 (Auto-Negotiation); Cisco CCNA 200-301 Exam Topics — 1.4 Identify interface and cable issuesReport a problem with this question

14. 14. A router's WAN link to a branch reports 'Serial0/0/0 is up, line protocol is down'. The cable and the provider circuit have been tested and are good. The local end uses HDLC, and the branch end was configured for PPP. What does this state indicate?

    • A.A Layer 2 problem, here mismatched encapsulation✓ Answer
    • B.A Layer 1 problem, such as a missing clock or cable
    • C.The interface was disabled with the shutdown command
    • D.A Layer 3 problem, such as addresses in different subnets

    The first status (up) reflects Layer 1, and the second (line protocol) reflects Layer 2. Up/down means the physical link works but the data link protocol is not coming up, which is the classic result of mismatched encapsulation or failed keepalives. A Layer 1 fault would show down/down, and a shutdown interface shows administratively down. An addressing mismatch is a Layer 3 issue and does not take the line protocol down.

    Ref QB-G4QHKJSource: Cisco CCNA 200-301 Exam Topics — 1.4 Identify interface and cable issuesReport a problem with this question

15. 15. A switch port connected to a factory-floor PC shows CRC and input errors climbing steadily, with zero collisions and zero late collisions. Both ends were verified at 1000 Mbps full duplex, and the UTP cable runs alongside large motors. What is the most likely cause?

    • A.A speed mismatch that forces the link to retransmit
    • B.EMI or damaged cabling corrupting the frames✓ Answer
    • C.A duplex mismatch between the PC and the switch port
    • D.Too many MAC addresses learned on the switch port

    A CRC error means the frame check sequence did not match, so the frame was corrupted in transit. With both ends confirmed full duplex and no collisions, electrical noise from the motors or faulty cabling is the likely cause, and shielded cable, rerouting, or fiber would fix it. A duplex mismatch is ruled out, and it would show late collisions on a half-duplex side. A speed mismatch brings the link down instead of causing CRCs, and the number of learned MAC addresses does not corrupt frames.

    Ref QB-YKHCZHSource: Cisco CCNA 200-301 Exam Topics — 1.4 Identify interface and cable issuesReport a problem with this question

16. 16. A backup application sends large files to a storage server. When the server's receive buffer fills, the server must be able to make the sender slow down, and any lost segments must be resent. Which transport protocol mechanism provides this?

    • A.TCP windowing with acknowledgments and retransmission✓ Answer
    • B.UDP checksums that request resending of bad datagrams
    • C.TCP's 8-byte header that carries a fixed transmit rate
    • D.UDP port numbers that pace each application's datagrams

    The TCP receiver advertises a window size, and shrinking that window slows the sender down (flow control). Sequence numbers and acknowledgments let TCP detect missing segments and retransmit them. A UDP checksum only lets the receiver detect and discard a damaged datagram, and UDP never retransmits. Port numbers are for multiplexing, not pacing. The TCP header is 20 bytes; the 8-byte header belongs to UDP.

    Ref QB-H43VRKSource: IETF RFC 9293 (TCP); Cisco CCNA 200-301 Exam Topics — 1.5 Compare TCP to UDPReport a problem with this question

17. 17. A firewall between a primary and a secondary DNS server permits only UDP port 53. Ordinary name queries between them succeed, but the secondary never completes its zone transfer from the primary. Why?

    • A.Zone transfers use TCP port 443, which the firewall blocks
    • B.Zone transfers use UDP port 69, which the firewall blocks
    • C.Zone transfers use UDP 53 but need multicast to be allowed
    • D.Zone transfers use TCP port 53, which the firewall blocks✓ Answer

    DNS uses UDP 53 for ordinary queries because they are small and fast. Zone transfers and responses too large for UDP use TCP 53, because a full copy of the zone needs reliable, ordered delivery. UDP 69 is TFTP, TCP 443 is HTTPS, and zone transfers are not sent by multicast.

    Ref QB-ZKVP6KSource: IETF RFC 1035 and RFC 7766 (DNS transport over TCP); Cisco CCNA 200-301 Exam Topics — 1.5 Compare TCP to UDPReport a problem with this question

18. 18. A voice engineer explains why IP phone audio is carried over UDP (with RTP) instead of TCP. Which reason is correct?

    • A.A retransmitted voice packet would arrive too late to be played✓ Answer
    • B.TCP cannot carry traffic that uses dynamic port numbers
    • C.UDP guarantees in-order delivery, which voice codecs need
    • D.UDP's three-way handshake sets up calls faster than TCP

    Voice is real-time traffic. By the time a lost packet could be detected and resent, its playout moment has passed, so TCP's retransmission and windowing would only add delay and jitter. UDP's low overhead and lack of retransmission suit voice better. UDP does not guarantee ordering (RTP sequence numbers let the receiver handle that), UDP has no handshake, and TCP uses dynamic ports without any problem.

    Ref QB-A4KHJBSource: IETF RFC 768 (UDP) and RFC 3550 (RTP); Cisco CCNA 200-301 Exam Topics — 1.5 Compare TCP to UDPReport a problem with this question

19. 19. A developer on a Linux container host tries to run a container image built for a Windows application, and it will not start. Windows VMs run fine on a hypervisor in the same rack. What explains the difference?

    • A.Containers each include a full guest OS, which needs more RAM
    • B.Containers share the host OS kernel; VMs run their own guest OS✓ Answer
    • C.Containers run only on bare metal with no operating system
    • D.Containers require a Type 2 hypervisor installed on the host

    A container packages only an application and its dependencies and runs on the host operating system's kernel. That makes containers light and fast to start, but a container must match the host kernel's OS type, so a Windows container cannot run on a Linux kernel. A VM includes its own complete guest OS on virtual hardware from the hypervisor, so a Windows VM runs on any suitable hypervisor. Containers do not need a Type 2 hypervisor or bare metal.

    Ref QB-SKDCYASource: Cisco CCNA 200-301 Exam Topics — 1.12 Explain virtualization fundamentals (server virtualization, containers, and VRFs)Report a problem with this question

20. 20. A service provider edge router must connect two customers, and both customers number their internal networks 10.1.1.0/24. Each customer's traffic must stay separate. Which feature lets one physical router serve both without readdressing?

    • A.VRFs, giving each customer its own routing table✓ Answer
    • B.Secondary IP addresses on one shared routing table
    • C.VLANs, giving each customer its own MAC address table
    • D.A Type 1 hypervisor running each customer as a container

    VRF (Virtual Routing and Forwarding) splits one router into several virtual routers, each with its own interfaces and routing table, so the same prefix can exist in different VRFs without conflict. Traffic does not pass between VRFs unless route leaking is configured. VLANs separate Layer 2 segments, but the router would still hold both 10.1.1.0/24 networks in one routing table. Hypervisors and containers are server virtualization, and secondary addresses in one table would overlap.

    Ref QB-5WYCP5Source: Cisco CCNA 200-301 Exam Topics — 1.12 Explain virtualization fundamentals (server virtualization, containers, and VRFs)Report a problem with this question

21. 21. SW1 has four access ports: Fa0/1, Fa0/2 and Fa0/3 in VLAN 10, and Fa0/4 in VLAN 20. Its MAC table holds only one dynamic entry: host B (0000.0c22.2222) on Fa0/2. Host A (0000.0c11.1111) on Fa0/1 sends a unicast frame to host C (0000.0c33.3333), which is not in the table. What does SW1 do?

    • A.Learns A on Fa0/1 and sends the frame only out Fa0/2
    • B.Learns C on Fa0/1 and floods the frame out Fa0/2 to Fa0/4
    • C.Learns A on Fa0/1 and floods the frame out Fa0/2 and Fa0/3✓ Answer
    • D.Drops the frame, since C has no entry in the MAC table yet

    A switch learns from the source MAC, so it records A on Fa0/1 in VLAN 10. It forwards based on the destination MAC. Because C is unknown, the frame is an unknown unicast and is flooded out every port in the same VLAN except the one it arrived on, which here is Fa0/2 and Fa0/3. Fa0/4 is in VLAN 20 and receives nothing. A switch does not drop unknown unicasts and never learns from the destination address.

    Ref QB-ND6J96Source: IEEE 802.1D transparent bridging; Cisco CCNA 200-301 Exam Topics — 1.13 Describe switching conceptsReport a problem with this question

22. 22. A network printer on switch port Gi1/0/8 sends no frames for 10 minutes. An engineer then checks the MAC address table and finds no entry for the printer, although the port is up. With default settings, why did the entry disappear, and what happens to the next frame sent to the printer?

    • A.It aged out after 60 s idle; the next frame is dropped by the switch
    • B.It aged out after 300 s idle; the switch ARPs for the printer first
    • C.It aged out after 300 s idle; the next frame is flooded in the VLAN✓ Answer
    • D.It was removed by a port error; the next frame goes to the gateway

    Dynamic MAC entries are refreshed each time a frame arrives with that source address, and they are removed after the aging time passes with no such frame. The default aging time is 300 seconds. After 10 silent minutes the printer's entry is gone, so a frame addressed to it is an unknown unicast and is flooded out all ports in the VLAN except the ingress port. When the printer replies, the switch relearns it. A Layer 2 switch does not send ARP for hosts; ARP is a host function.

    Ref QB-6WBQU6Source: Cisco CCNA 200-301 Exam Topics — 1.13.a MAC learning and agingReport a problem with this question

Practice questions written to Cisco's published CCNA 200-301 exam topics and the IEEE and IETF standards behind them. Cisco and CCNA are trademarks of Cisco Systems, Inc.; this site is not affiliated with or endorsed by Cisco. Exam topics are revised periodically — check the current official topic list before you book. About the CCNA exam (Cisco) →