200-301 Cisco Certified Network Associate Exam Topics and Questions

Network Fundamentals sets the floor for everything else on the exam. Get it wrong and topology questions, routing decisions, and security scenarios all become harder to reason through. The topic spans physical hardware, cabling, addressing, wireless, and switching concepts. At 20%, it is not a section you can skim. The penalty for gaps here compounds across later topics, because almost every scenario-based item assumes you can identify what a device does and why it is placed where it is.

– Devices and what they actually do

The exam does not ask you to define a router in the abstract. It gives you a scenario and expects you to know which device handles a specific job and why another device cannot. Routers forward between Layer 3 networks. Layer 2 switches forward frames based on MAC addresses; Layer 3 switches can also route between VLANs without a separate router. Next-generation firewalls do stateful inspection and application-layer filtering; an IPS sits inline and blocks malicious traffic rather than just alerting. Access points bridge wireless clients onto a wired segment, and the controller (Cisco DNA Center or a WLC) manages them at scale. Endpoints and servers matter because items often describe traffic flows and ask what happens at each hop. PoE is testable in terms of which standard supplies how much power and which switch ports support it. Know which device lives at which layer, and know what breaks when you substitute one for another.

– Topology architectures and physical media

Two-tier (collapsed core) puts distribution and core on the same layer; three-tier separates them. Spine-leaf is the data-centre architecture where every leaf connects to every spine, giving predictable east-west latency. WAN topologies cover how sites connect across provider infrastructure. SOHO collapses many functions into a single device. On-premise versus cloud is about where the control plane and data live, not just where the servers sit.

For cabling, the exam distinguishes single-mode fibre (long distances, laser light source) from multimode (shorter distances, LED source) and copper. Ethernet shared media versus point-to-point changes how collisions are handled. Interface issues such as duplex mismatches and speed mismatches produce specific, predictable symptoms: a half/full duplex mismatch causes late collisions and poor throughput on the full-duplex side. Recognising the symptom and tracing it to a configuration error is the skill the exam probes.

– Addressing: IPv4, IPv6, and subnetting

Subnetting is the most calculation-heavy part of this topic. You need to find network addresses, broadcast addresses, and valid host ranges quickly. Private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) come up in NAT scenarios later, so know them cold here.

IPv6 address types are a frequent source of exam losses. Global unicast is publicly routable. Unique local is the IPv6 equivalent of private space. Link-local (fe80::/10) is mandatory on every IPv6 interface and is never routed off-link. Anycast assigns the same address to multiple interfaces; the nearest one answers. Multicast replaces broadcast in IPv6. Modified EUI-64 derives the interface ID from the MAC address by inserting FF:FE in the middle and flipping the universal/local bit. TCP versus UDP is testable in terms of reliability, ordering, and which well-known applications use each. Verifying IP parameters across Windows, macOS, and Linux means knowing the right command on each platform, not just the concept.

– Wireless, virtualization, and switching concepts

Wireless items focus on the practical: non-overlapping channels in 2.4 GHz are 1, 6, and 11. RF interference, SSID configuration, and encryption choices (WPA2 versus WPA3) all appear. Know why channel overlap causes problems and how to avoid it in a small deployment.

Virtualization fundamentals cover server virtualization (hypervisors abstracting physical hardware), containers (shared OS kernel, lighter weight than VMs), and VRFs (virtual routing and forwarding instances that partition a router's routing table). VRFs are the one that trips candidates up because they look like a WAN or routing topic but appear here.

Switching concepts underpin the whole VLAN and STP discussion in Topic 2. MAC learning populates the table when a frame arrives; aging removes stale entries. When the destination MAC is unknown, the switch floods the frame out all ports except the one it arrived on. Frame switching, once the MAC is known, sends the frame only to the correct port. Understanding the MAC address table and its states is what makes flooding versus forwarding questions answerable.

How Network Fundamentals is tested

At 20% of the exam, this topic generates more items than any other single area. Expect a mix of recall and scenario items. Recall items check whether you know a specific fact: a cabling type, an IPv6 address range, a TCP versus UDP behaviour. Scenario items embed a device or addressing decision inside a network description and ask what happens or what you should configure.

The biggest mark losses come from subnetting errors under time pressure and from IPv6 address type confusion. Candidates who can subnet on paper often slow down when the prefix length is unusual or when the question involves IPv6. Practise until both feel automatic.

Wireless channel and RF items reward knowing the specific non-overlapping channel numbers, not just that overlap is bad. Switching concept items reward tracing a frame through the MAC table step by step rather than pattern-matching on keywords.

Modified EUI-64 is a reliable trap: candidates who know the concept but misremember which bit flips will pick a plausible-looking wrong address. The detail that distinguishes the strongest option is the bit inversion, not just the FF:FE insertion.

Where Topic 1 built the conceptual base, Network Access is where you prove you can configure and verify the Layer 2 infrastructure that carries everything else. VLANs, trunking, Spanning Tree, EtherChannel, and wireless architecture all live here. The scenarios get more specific: a port is misconfigured, a VLAN is missing, STP has blocked the wrong port. At 20%, this topic rewards candidates who have actually typed the commands, not just read about them.

– VLANs, trunks, and interswitch connectivity

VLANs segment a switched network at Layer 2. Access ports carry traffic for a single VLAN; voice ports add a second VLAN for IP phones on the same physical port. The default VLAN (VLAN 1) is where untagged traffic lands unless you change it, and leaving management traffic on VLAN 1 is a security risk the exam knows about.

InterVLAN connectivity requires either a router-on-a-stick (a trunk to a router with subinterfaces) or a Layer 3 switch with SVIs. Trunk ports carry multiple VLANs between switches using 802.1Q tagging. The native VLAN is the one that crosses the trunk untagged; a native VLAN mismatch between two switches is a classic troubleshooting scenario. Cisco Discovery Protocol and LLDP let devices advertise themselves to neighbours; knowing what each protocol discovers and which vendor supports which is testable. EtherChannel (LACP) bundles physical links into a logical one; the exam tests whether the negotiation mode on each end is compatible.

– Spanning Tree Protocol

Rapid PVST+ is the STP variant the exam focuses on. The root bridge is elected by the lowest bridge ID (priority, then MAC address). Root ports are the best path toward the root on non-root switches. Designated ports forward on each segment; all others block.

Port states matter: a port in forwarding passes traffic; a port in blocking does not. PortFast skips the listening and learning states and should only be on access ports connected to end devices, never to other switches. BPDU guard shuts a PortFast-enabled port the moment it receives a BPDU, preventing an unauthorised switch from joining. BPDU filter suppresses BPDUs entirely, which is dangerous on trunk ports. Root guard prevents a port from becoming a root port even if it receives a superior BPDU. Loop guard prevents a port from transitioning to forwarding if it stops receiving BPDUs, protecting against unidirectional link failures. Confusing these four protective features is where candidates drop marks.

– Wireless architecture and management access

Cisco wireless architecture separates the access point from the controller. Autonomous APs manage themselves; lightweight APs offload control to a WLC using CAPWAP. FlexConnect lets a lightweight AP forward traffic locally when the WLC link is down. The physical connection of a WLC to the network uses trunk ports and LAGs; AP ports are typically access ports.

Network device management access covers the full range: console for out-of-band local access, Telnet (cleartext, avoid it), SSH (encrypted, use this), HTTP and HTTPS for web-based management, and TACACS+/RADIUS for centralised authentication. TACACS+ separates authentication, authorisation, and accounting into discrete exchanges; RADIUS combines authentication and authorisation. Cloud-managed devices (Meraki-style) push configuration from a cloud dashboard.

The wireless GUI items ask you to interpret WLAN creation steps, security settings (PSK versus 802.1X), QoS profiles, and advanced settings. You do not need to memorise every GUI field, but you need to know what each setting controls and what a misconfiguration looks like.

How Network Access is tested

Network Access items tend to be scenario-based. A switch configuration is shown, something is broken, and you identify the cause or the fix. The most common traps are native VLAN mismatches, wrong STP port roles, and incompatible EtherChannel modes.

STP questions reward knowing the election logic precisely. Candidates who approximate the rules (lower is better) without knowing whether priority or MAC address breaks a tie will pick the wrong root bridge in a scenario where both matter.

Wireless items reward distinguishing AP modes: autonomous, lightweight, and FlexConnect behave differently in the same failure scenario. Items about management protocols reward knowing which protocol encrypts what, and whether TACACS+ or RADIUS separates its AAA functions.

The GUI-based wireless item is often a drag-and-drop or exhibit question. Marks go to candidates who can read a configuration screen and spot what is missing or wrong, not to those who have memorised a sequence of clicks. Practise reading exhibit-style output as much as you practise typing commands.

IP Connectivity is the largest topic on the exam at 25%, and it is where the most marks are won or lost. The shift from Layer 2 to Layer 3 means you are now reasoning about routing decisions, not just switching behaviour. Every forwarding decision a router makes follows a specific, deterministic logic, and the exam tests whether you know that logic precisely enough to predict the outcome in a scenario you have never seen before.

– Reading and interpreting the routing table

The routing table is the starting point for almost every IP Connectivity item. Each entry carries a routing protocol code that tells you how the route was learned (C for connected, S for static, O for OSPF, and so on). The prefix and mask define the destination network. The next hop tells the router where to send the packet. Administrative distance ranks the trustworthiness of the source: a directly connected route beats a static route, which beats OSPF, which beats other protocols with higher AD values. The metric is used to choose between routes learned by the same protocol. The gateway of last resort is the fallback when no more-specific match exists.

Knowing what each field means is necessary but not sufficient. Items show a routing table and ask which route a specific packet matches. That requires applying longest prefix match before anything else, then AD, then metric. Candidates who jump to the metric without checking prefix length first pick the wrong entry.

– Forwarding decisions and static routing

The router's forwarding logic is strict: find the longest matching prefix first. If two routing protocols both have a route to the same prefix, the one with the lower administrative distance wins regardless of metric. If the same protocol has two routes to the same prefix with the same metric, they load-balance.

Static routes give you direct control. A default route (0.0.0.0/0) matches any destination not covered by a more-specific entry. A network route covers a range. A host route (/32 for IPv4, /128 for IPv6) matches exactly one address. A floating static route has a manually raised administrative distance, so it stays dormant behind a dynamic route and activates only when the dynamic route disappears. Floating statics are a common scenario item: configure one incorrectly and it either never activates or overrides the dynamic route permanently.

– OSPFv2 configuration and verification

Single-area OSPFv2 is the dynamic routing protocol the exam tests in depth. Neighbour adjacencies form only when specific parameters match: area ID, authentication, hello and dead timers, and subnet. A mismatch on any of these prevents adjacency, and the exam will show you a broken configuration and ask why two routers are not becoming neighbours.

The router ID is chosen in order: manually configured ID first, then the highest loopback address, then the highest active interface address. On a broadcast segment (Ethernet), OSPF elects a Designated Router and Backup Designated Router based on priority, then router ID. On a point-to-point link, no DR/BDR election occurs. Knowing which network type triggers which behaviour is a reliable exam question. Verification commands (show ip ospf neighbor, show ip route ospf) are testable both for what they display and for what a specific output means about the network state.

– First hop redundancy protocols

First hop redundancy protocols (FHRPs) solve the problem of a single default gateway being a failure point. HSRP, VRRP, and GLBP each present a virtual IP address to end hosts; when the active router fails, another takes over the virtual IP without requiring any change on the clients.

The exam asks you to describe the purpose and the mechanics: which router is active, how failover is triggered, and what the end host sees. HSRP uses active and standby roles; VRRP uses master and backup; GLBP adds load balancing across multiple gateways. You do not need to configure all three, but you do need to know what distinguishes them and why you would choose one over another in a given scenario. Items in this area reward understanding the failover trigger (hello timeout) and the client behaviour (ARP cache) over memorising command syntax.

How IP Connectivity is tested

At 25%, this topic alone accounts for a quarter of your score. Items range from routing table interpretation to OSPF neighbour troubleshooting to static route configuration. The volume means you cannot afford to be slow: routing table items in particular need to be answered quickly so you have time for the OSPF scenarios.

The most common mark loss is applying administrative distance and metric in the wrong order. Items reward checking prefix length first, then AD, then metric, in that sequence. Candidates who skip to metric pick plausible but wrong entries.

OSPF neighbour items reward knowing the exact list of parameters that must match. Items do not tell you which parameter is wrong; they show you two router configurations and expect you to find the mismatch. The strongest response identifies the specific mismatched field, not just that OSPF is broken.

Floating static route items reward understanding that the AD must be higher than the dynamic protocol's AD, not just that it should be high. Getting the direction of the comparison wrong produces a route that never floats.

IP Services covers the supporting protocols that keep a network operational day to day. After the routing and switching depth of the previous topics, this one is narrower in scope but not in precision. NAT, DHCP, DNS, NTP, SNMP, syslog, QoS, SSH, and TFTP/FTP are each testable at the configuration-and-verification level. At 10%, the items here are fewer, but they are often straightforward marks to bank if you have covered the material.

– Address translation and dynamic host configuration

NAT translates private IPv4 addresses to public ones. Static NAT maps one inside local address to one inside global address permanently. Pool-based NAT maps many inside addresses to a pool of public addresses dynamically. PAT (overload) maps many inside addresses to a single public address using port numbers to track sessions. The exam tests configuration and verification: know the inside and outside interface designations, the access list that defines which traffic gets translated, and what show ip nat translations reveals.

DHCP assigns IP addresses, subnet masks, default gateways, and DNS server addresses to clients automatically. A DHCP relay (ip helper-address) forwards DHCP broadcasts from a client on one subnet to a DHCP server on another. Configuring a device as a DHCP client means setting the interface to obtain an address automatically. Items test both the server-side pool configuration and the relay configuration, and they ask you to verify operation using show commands.

– Network management and monitoring

NTP synchronises clocks across devices. A device can operate as an NTP client (receiving time from a server) or as an NTP server (distributing time to others). Clock accuracy matters for syslog timestamps and certificate validation; an item may ask why log entries appear out of order and the answer traces back to NTP misconfiguration.

SNMP lets a management station poll devices for performance data and receive traps when events occur. Version 3 adds authentication and encryption; versions 1 and 2c use community strings. Syslog sends log messages to a central server; severity levels run from 0 (emergencies) to 7 (debugging), and the exam tests whether you know which level number corresponds to which severity name. TFTP transfers files without authentication (useful for IOS image backup); FTP adds authentication and is bidirectional. SSH provides encrypted remote management; configuring it requires generating RSA keys and setting the transport input on the VTY lines. QoS classification, marking, queuing, policing, and shaping are conceptual at this level: know what each mechanism does to traffic and when you would apply it.

How IP Services is tested

IP Services items at this exam level sit mostly at the configure-and-verify tier. You will see a partial configuration and be asked what is missing or wrong, or you will see show command output and be asked what it indicates about the network state.

NAT troubleshooting items reward understanding the flow: inside local to inside global translation, and the role of the access list in permitting the traffic. Candidates who confuse inside and outside interface designations consistently pick the wrong fix.

Syslog level items reward knowing the numeric scale direction. Many candidates remember that lower numbers are more severe but then apply the rule backwards when an item asks which messages a device set to level 3 will send. The device sends level 3 and below (0, 1, 2, 3), not level 3 and above.

QoS items reward knowing the sequence of mechanisms: classify and mark first, then queue and schedule, then police or shape at the edge. Items that describe a traffic problem reward identifying which mechanism in that sequence is missing or misconfigured, rather than naming QoS in general.

Security Fundamentals shifts the exam from operational configuration to defensive thinking. The question is no longer just whether traffic flows, but whether it flows safely and only where it should. At 15%, this topic tests a wider range of security controls than many candidates expect: conceptual threat modelling, password policy, ACLs, Layer 2 protections, VPNs, and wireless security all appear. The items reward understanding what each control prevents, not just how to configure it.

– Threats, vulnerabilities, and security programme foundations

The exam distinguishes threats (potential harmful events), vulnerabilities (weaknesses that can be exploited), and exploits (the actual mechanism of attack). Mitigation techniques are the controls applied to reduce the likelihood or impact of an exploit succeeding. Items in this area present a scenario and ask which control addresses a described weakness.

Security programme elements cover user awareness training (reducing the human attack surface), and physical access control (preventing unauthorised physical access to devices). These are not deep questions, but they do appear, and candidates who dismiss them as too basic occasionally miss them by overthinking.

Password policy items are more specific: complexity requirements, minimum length, ageing and reuse restrictions, and alternatives. Multifactor authentication requires two or more factors from different categories (something you know, have, or are). Certificates bind an identity to a public key. Biometrics authenticate using a physical characteristic. Items ask which alternative provides what assurance, not just that alternatives exist.

– VPNs and access control lists

IPsec VPNs come in two forms here. A site-to-site VPN connects two networks permanently over an encrypted tunnel; the endpoints are routers or firewalls. A remote-access VPN connects an individual user to a network; the endpoint on the user side is a client. The exam tests the conceptual difference and the use case, not full IPsec phase negotiation.

ACLs filter traffic based on source address, destination address, and protocol. Standard ACLs match only on source address and should be placed close to the destination. Extended ACLs match on source, destination, and protocol, and should be placed close to the source to stop unwanted traffic early. The implicit deny at the end of every ACL drops anything not explicitly permitted. Items show an ACL and ask which traffic is permitted or denied, requiring you to process the entries in order and stop at the first match. Getting the order wrong produces the wrong answer even when you know what each entry does.

– Layer 2 security, AAA, and wireless security

DHCP snooping builds a binding table of legitimate DHCP assignments and drops DHCP replies from untrusted ports, preventing rogue DHCP servers. Dynamic ARP Inspection uses that binding table to validate ARP packets, blocking ARP spoofing attacks. Port security limits which MAC addresses can use a switch port and defines what happens when a violation occurs: protect, restrict, or shutdown. Each violation mode has a different effect on traffic and logging.

AAA separates three functions: authentication (who are you), authorisation (what are you allowed to do), and accounting (what did you do). TACACS+ handles each function in a separate exchange; RADIUS combines authentication and authorisation. This distinction drives the choice between them in enterprise environments.

Wireless security protocols improve over generations: WPA addressed WEP's weaknesses, WPA2 introduced AES-CCMP, and WPA3 added SAE for stronger key exchange. Configuring a WLAN in the WLC GUI with WPA2 PSK means selecting the correct security policy and passphrase. Items test whether you know what changes between WPA, WPA2, and WPA3 and why the change matters.

How Security Fundamentals is tested

Security Fundamentals items split between conceptual and applied. Conceptual items describe an attack or a policy requirement and ask which control or protocol addresses it. Applied items show a configuration and ask whether it achieves the stated security goal.

ACL items are the most reliable source of errors. Candidates who know what each entry does still lose marks by processing entries out of order or forgetting the implicit deny. Items reward tracing each line in sequence and stopping at the first match, not scanning for the entry that looks relevant.

Layer 2 security items reward knowing the specific mechanism each feature targets. DHCP snooping stops rogue DHCP servers; dynamic ARP inspection stops ARP spoofing; port security stops unauthorised MAC addresses. An item that describes ARP poisoning as the attack rewards selecting DAI, not port security, even though both are Layer 2 controls.

Wireless security items reward knowing what SAE replaces and why WPA3 is stronger, not just that it is newer. The distinction between PSK and 802.1X authentication modes also appears in GUI-based items.

Automation and Programmability closes the exam with the furthest departure from traditional CLI-based networking. The items here do not ask you to write Python or configure a controller from scratch. They ask whether you understand what automation changes, how controller-based architectures differ from device-by-device management, and what the building blocks of programmatic network control look like. At 10%, this is a focused section, but candidates who have never worked with APIs or automation tools often find the vocabulary unfamiliar.

– Controller-based architecture and the separation of planes

Traditional networks configure each device individually; controller-based networks centralise the control plane. The controller holds the network-wide view and pushes policy to devices, which handle only the data plane (forwarding). The overlay is the logical network built on top of the physical underlay; the fabric is the combined system. Cisco DNA Center is the management and automation platform that sits above this architecture.

The control plane and data plane separation is the architectural principle that makes automation possible. Northbound APIs connect the controller to management applications and orchestration tools (the layer above). Southbound APIs connect the controller to the network devices below it. Knowing which direction each API faces and what it carries is the specific fact the exam tests, not the API syntax itself.

– APIs, data formats, and configuration management

REST-based APIs use HTTP verbs: GET retrieves data, POST creates, PUT updates (replacing the whole resource), PATCH updates partially, and DELETE removes. CRUD (Create, Read, Update, Delete) maps to those verbs. Authentication options include basic auth, token-based, and OAuth. Data encoding for REST APIs is typically JSON or XML; the exam focuses on JSON.

JSON-encoded data uses key-value pairs in curly braces for objects and square brackets for arrays. Items show a JSON structure and ask what a specific value represents or where a particular piece of data sits in the hierarchy. You do not need to write JSON, but you do need to read it.

Ansible uses agentless, YAML-based playbooks pushed over SSH. Terraform uses declarative configuration files to provision infrastructure. The exam asks you to recognise what each tool does and its key characteristic, not to write playbooks or configuration files.

AI and machine learning in network operations cover predictive analytics (anticipating failures from historical data) and generative AI (producing configurations or summaries from natural language). The exam tests awareness of what these capabilities offer, not implementation depth.

How Automation and Programmability is tested

Automation and Programmability items are predominantly conceptual. The exam is not asking you to debug a Python script or call a REST API live. It is checking whether you can distinguish the roles of components, identify the correct HTTP verb for a described operation, or read a JSON structure and extract meaning from it.

The most common trap is confusing northbound and southbound APIs. Items describe a tool communicating with the controller and ask which API direction is in use. The direction is determined by whether the communicating party is above or below the controller in the architecture, not by which product is named.

JSON items reward reading the structure rather than guessing from context. An array inside an object inside another object requires tracing the nesting correctly; candidates who read only the outermost key pick the wrong value.

Ansible versus Terraform items reward knowing the key distinguishing trait of each: Ansible is procedural and agentless; Terraform is declarative and state-aware. Items present a requirement and reward selecting the tool whose characteristic matches it, not the one that sounds more familiar.