10 beginner questions on the CCNA 200-301 exam topics: network fundamentals (IPv6 link-local addresses, private IPv4, subnetting), network access (802.1Q trunks, Rapid PVST+), IP connectivity (longest prefix match, administrative distance), IP services (DHCP relay), security fundamentals (AAA) and automation and programmability (agentless Ansible). Every topic is also covered by the CCNA v2.0 exam topics.

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. An engineer enables IPv6 on a router interface without configuring any address. show ipv6 interface brief now shows an address that begins with FE80. What type of address is it?

    • A. A global unicast address
    • B. A multicast address
    • C. A link-local address ✔ correct
    • D. A unique local address

    Answer: C. Addresses in FE80::/10 are link-local unicast addresses. They are created automatically on every IPv6-enabled interface and are valid only on that link; routers never forward them. Global unicast addresses use 2000::/3, unique local FC00::/7 and multicast FF00::/8.

    Source: www.rfc-editor.org/rfc/rfc4291 · Domain: Network Fundamentals

  2. Which of these IPv4 addresses is a private address defined in RFC 1918?

    • A. 172.32.10.5
    • B. 192.169.1.20
    • C. 11.0.0.1
    • D. 172.20.5.10 ✔ correct

    Answer: D. RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) and 192.168.0.0/16. 172.20.5.10 is inside 172.16.0.0/12; 172.32.10.5 is just outside it, and 192.169.1.20 is outside 192.168.0.0/16.

    Source: www.rfc-editor.org/rfc/rfc1918 · Domain: Network Fundamentals

  3. An administrator assigns the subnet 192.168.10.64/26 to a branch office LAN. How many usable host addresses does this subnet provide?

    • A. 62 ✔ correct
    • B. 64
    • C. 30
    • D. 126

    Answer: A. A /26 mask (255.255.255.192) leaves 6 host bits: 2^6 = 64 addresses. The all-zeros (network) and all-ones (broadcast) host values cannot be assigned, so 62 addresses are usable.

    Source: www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13788-3.h · Domain: Network Fundamentals

  4. On an IEEE 802.1Q trunk between two Cisco switches, how are frames that belong to the native VLAN sent by default?

    • A. With an 802.1Q tag for VLAN 4094
    • B. Untagged ✔ correct
    • C. Encapsulated in ISL
    • D. Dropped until the trunk is configured

    Answer: B. On an 802.1Q trunk, traffic in the native VLAN is sent without a tag, and received untagged frames are placed in the native VLAN (VLAN 1 by default). The native VLAN should match on both ends of the trunk.

    Source: www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9400/software/release/17-8/co · Domain: Network Access

  5. In Rapid PVST+ mode, each VLAN runs its own spanning-tree instance.

    • A. True ✔ correct
    • B. False

    Answer: A. True. Rapid PVST+ is per-VLAN spanning tree with the rapid convergence of IEEE 802.1w, so each VLAN has its own instance (and can have its own root bridge). It is the default STP mode on Catalyst switches.

    Source: www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-17/c · Domain: Network Access

  6. A router has these routes: 10.1.0.0/16 via 192.0.2.1, 10.1.1.0/24 via 192.0.2.2 and 0.0.0.0/0 via 192.0.2.3. Where does it forward a packet for 10.1.1.20?

    • A. 192.0.2.1, because /16 was learned first
    • B. 192.0.2.3, because the default route matches everything
    • C. 192.0.2.2, because /24 is the longest matching prefix ✔ correct
    • D. It load-balances across all three next hops

    Answer: C. A router forwards using the longest prefix match: all three routes contain 10.1.1.20, but 10.1.1.0/24 is the most specific, so the packet goes to 192.0.2.2. The default route is used only when nothing more specific matches.

    Source: www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol · Domain: IP Connectivity

  7. A router learns the same prefix from internal EIGRP and from OSPF, both with default settings. Which route is installed in the routing table?

    • A. The EIGRP route, because its administrative distance (90) is lower than OSPF (110) ✔ correct
    • B. The OSPF route, because its administrative distance (110) is higher than EIGRP (90)
    • C. Both routes, because they come from different protocols
    • D. The route with the lower metric, whichever protocol it comes from

    Answer: A. When protocols offer the same prefix, the router prefers the lowest administrative distance. Internal EIGRP is 90 and OSPF is 110, so the EIGRP route wins. Metrics are compared only between routes from the same protocol.

    Source: www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/15986-admin-di · Domain: IP Connectivity

  8. PCs in VLAN 20 must get IP addresses from a DHCP server at 10.0.0.5 in another subnet. What should the network engineer configure on the VLAN 20 gateway interface?

    • A. ip dhcp pool 10.0.0.5
    • B. ip helper-address 10.0.0.5 ✔ correct
    • C. ip default-gateway 10.0.0.5
    • D. ip name-server 10.0.0.5

    Answer: B. DHCP discovers are broadcasts that routers do not forward. ip helper-address on the interface that receives the client broadcasts turns the router into a DHCP relay agent that forwards them as unicast to the server.

    Source: www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/xe-16-12/dhc · Domain: IP Services

  9. A company wants its routers and switches to check administrator logins against a central AAA server. Which two protocols can the devices use as AAA clients? (Select TWO)

    • A. TACACS+ ✔ correct
    • B. RADIUS ✔ correct
    • C. SNMP
    • D. NTP
    • E. CDP

    Answer: A, B. TACACS+ (over TCP, encrypts the whole packet body, separates AAA functions) and RADIUS (over UDP, encrypts only the password) are the AAA protocols. SNMP, NTP and CDP handle monitoring, time and neighbor discovery.

    Source: www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user- · Domain: Security Fundamentals

  10. Ansible can manage Cisco routers and switches without installing an agent on them: its network modules run on the Ansible control node and most often connect to the devices with CLI over SSH.

    • A. True ✔ correct
    • B. False

    Answer: A. True. Ansible is agentless. Most network devices cannot run Python, so network modules execute on the control node and reach the devices over SSH (network_cli), NETCONF or HTTP(S) APIs. Nothing extra is installed on the routers or switches.

    Source: docs.ansible.com/projects/ansible/latest/network/getting_started/network_differe · Domain: Automation and Programmability

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public Cisco exam objectives (CCNA Exam v1.1 (200-301) exam topics; v2.0 replaces it on 2027-02-03), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by Cisco; exam names are trademarks of their owners. Official exam page: www.cisco.com/site/us/en/learn/training-certifications/exams/ccna.html.

Last modified: Sunday, 25 October 2026, 9:57 PM