Cisco Certified Network Associate (CCNA) Study Guide

Issuing body: Cisco Jurisdiction: Global (vendor certification — not a legal license to practice) Level: Associate Prerequisites: None formal; basic networking familiarity recommended. (Source: catalogue record computer-cert-001.) Renewal: 3-year validity; renew by re-exam or continuing education credits (Cisco standard 3-year policy across the CCNA/CCNP/CCIE family).

1. What this exam is

CCNA (exam 200-301) is the foundation credential for network engineering — the designed entry point of the CCNA → CCNP → CCIE progression. It tests whether you understand how packets actually move: addressing, switching, routing, wireless basics, security fundamentals, and automation/programmability concepts. It's broad rather than deep, but the breadth is load-bearing: every advanced networking concept assumes this layer. Note: Cisco folded the former DevNet content into an Automation track (effective 2026-02-03 per Cisco Learning Network), so expect programmability questions inside the associate exam.

2. Pathway and exam format

Typical path: CompTIA Network+ (optional, gentler on-ramp) → CCNA 200-301 → 1–2 years of hands-on network operations → CCNP Enterprise (ENCOR + concentration).
Format: ~100 questions (Cisco doesn't publish exact counts), ~120 minutes, multiple-choice / drag-and-drop / testlets / simulations. Passing score ~825/1000 (Cisco uses scaled scoring; treat ~82% as the target). Exam fee ~$300 USD via Pearson VUE.
Simulations matter: you'll configure and verify on emulated IOS devices. Know the CLI cold — show commands are half the exam.
The exam tests verification, not just configuration. For every technology, know the show command that proves it works: show ip route, show ip ospf neighbor, show etherchannel summary, show vlan brief, show ip interface brief.

3. Knowledge domains (with theory)

Cisco's published blueprint (approximate weightings): Network Fundamentals 20%, Network Access 20%, IP Connectivity 25%, IP Services 10%, Security Fundamentals 15%, Automation and Programmability 10%.

Network fundamentals: the physics of addressing

OSI vs TCP/IP: know both models and which protocols live where — but more importantly, know encapsulation: each layer adds its header (segments → packets → frames → bits), and troubleshooting is the art of finding which layer broke. A ping failure with good ARP means L2 works and L3+ is suspect; that's the whole game.

IPv4 addressing and subnetting — the non-negotiable skill:

Subnet math must be reflexive. Given 192.168.10.0/26: block size = 64, subnets increment by 64 (0, 64, 128, 192), usable hosts .1–.62, broadcast .63. Practice until this takes <30 seconds.
VLSM: allocate from largest requirement down. Wasting a /24 on a point-to-point link (needs /30 or /31) is the classic exam trap.
/31 subnets (RFC 3021): valid on point-to-point links — no network/broadcast addresses needed, both addresses usable. The exam loves testing whether you know /31 exists.
Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. APIPA 169.254.0.0/16 (DHCP failure signature). NAT: static (1:1), dynamic, PAT/overload (many:1 — the SOHO default). Know inside/outside local/global terminology.

IPv6 — know it structurally:

128-bit, hex, compress with :: once. Link-local FE80::/10 (auto-configured, non-routable), unique local FC00::/7, global unicast 2000::/3, multicast FF00::/8.
SLAAC (router advertisements give prefix; host builds the rest via EUI-64 or privacy extensions) vs stateless DHCPv6 (DNS info only) vs stateful DHCPv6 (addresses too). No broadcast in IPv6 — neighbor discovery uses multicast (solicited-node).
Dual-stack is the migration reality; tunneling (6to4, GRE) is legacy trivia.

Network access: switching

VLANs and trunking: VLANs = broadcast domain segmentation at L2. Access ports (one VLAN, untagged) vs trunk ports (802.1Q tagged, multiple VLANs). Native VLAN (untagged on a trunk, default VLAN 1 — change it; VLAN hopping attacks exploit native VLAN 1). switchport mode trunk, switchport trunk allowed vlan.

DTP (Dynamic Trunking Protocol): negotiate trunking — disable with switchport nonegotiate on security-sensitive ports.

Spanning Tree (STP 802.1D / RSTP 802.1w / PVST+):

Purpose: loop-free L2 topology. Root bridge election (lowest bridge ID = priority + MAC). Port roles: root, designated, blocking/alternate. Port states: blocking → listening → learning → forwarding (30–50 s convergence in classic STP — that's why RSTP exists).
RSTP converges in ~1–2 s via proposal/agreement handshake. PortFast (edge ports — skip listening/learning; only for end hosts, never for switches), BPDU Guard (shut down PortFast ports that receive BPDUs — the rogue-switch defense). The exam's STP questions are almost always about PortFast/BPDU Guard placement.

EtherChannel: bundle 2–8 physical links into one logical link (LACP 802.3ad preferred over PAgP). Requirements: same speed/duplex, same VLAN config, LACP modes active/passive (at least one side active). show etherchannel summary — verify (P) bundled vs (I) standalone.

Wireless basics (WLC architecture): lightweight APs + Wireless LAN Controller (CAPWAP tunnel). SSID → VLAN mapping, WPA2/WPA3 (WPA3-SAE replaces PSK handshake — know SAE exists), 2.4 vs 5 GHz trade-offs (range vs throughput/interference).

IP connectivity: routing

Static vs dynamic: static routes (administrative distance 1) for stubs; dynamic protocols for everything else. Longest-prefix-match is how forwarding decisions are made — always. Administrative distance (trustworthiness of the source: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120, iBGP 200) vs metric (best path within a protocol). AD breaks ties between protocols; metric breaks ties within.

OSPF (the exam's routing protocol):

Link-state: every router builds the full topology (LSDB) via LSAs, runs Dijkstra's SPF to compute shortest paths. Converges fast, scales with areas.
Area 0 (backbone) is mandatory — all areas must connect to it (or use virtual links). ABRs sit on area boundaries; stub areas (no external LSAs), totally stubby (default route only).
Neighbor formation: Hello (10 s, dead 40 s on broadcast) → 2-way → ExStart → Exchange → Loading → Full. Must match: area ID, authentication, hello/dead timers, stub flag, MTU. Network types: broadcast (DR/BDR elected), point-to-point (no DR/BDR — the exam's "why is there no DR?" answer).
DR/BDR election: highest priority, then highest router ID (loopback > physical). DROthers only form adjacencies with DR/BDR (reduces adjacency count from O(n²) to O(n)).
Single-area OSPFv2 config: router ospf 1, network 10.0.0.0 0.255.255.255 area 0. OSPFv3 for IPv6 (separate process, link-local peering).

First-hop redundancy: HSRP (Cisco, active/standby, virtual IP + virtual MAC 0000.0c07.acXX), VRRP (open standard, master/backup), GLBP (Cisco, active load balancing via multiple virtual MACs). Know the default timers and preemption behavior.

IP services

DHCP: DORA (Discover, Offer, Request, Ack). DHCP relay (ip helper-address) forwards broadcasts to the server. DHCP snooping (security: builds binding table, drops rogue server responses on untrusted ports) — pairs with Dynamic ARP Inspection. DNS: recursive vs authoritative; know the resolution chain. NTP: stratum hierarchy; authentication; why time matters (logs, certs, Kerberos). SNMP: v2c (community strings, plaintext) vs v3 (authPriv — the only acceptable answer). QoS basics: classification/marking (DSCP), queuing (priority for voice), trust boundaries. TFTP/FTP for IOS management.

Security fundamentals

Threats: malware, phishing, DoS/DDoS, MITM, rogue APs/dhcp, VLAN hopping (double-tagging — mitigated by not using VLAN 1 as native and pruning).
Device hardening: enable secret (not enable password), SSH only (no telnet), banner MOTD, disable unused services, port security (sticky MACs, violation modes: protect/restrict/shutdown), DHCP snooping + DAI + IP Source Guard (the L2 security trio).
AAA: authentication/authorization/accounting via TACACS+ (Cisco, separates AAA, TCP 49 — device admin) vs RADIUS (UDP 1812/1813, combines auth/authz — network access). VPNs: site-to-site IPsec (IKE phases 1/2), remote-access SSL/TLS.
Firewalls/IPS/IDS concepts: stateful inspection, zones (inside/outside/DMZ), IDS (detect) vs IPS (prevent, inline).

Automation and programmability

Controller-based networking: DNA Center (enterprise intent-based), controllers separate control plane from devices (SDN concept: centralized control, distributed forwarding).
Data models: YANG models device config; NETCONF (XML over SSH, port 830) and RESTCONF (HTTP verbs on YANG data, JSON/XML) are the programmatic interfaces. Know which is which — the exam tests the distinction.
JSON data format fluency (read/parse). Basic Python/Ansible awareness: idempotent playbooks for config management.
REST API verbs (GET/POST/PUT/DELETE/PATCH) and response codes.

4. Key formulas and numbers

Subnetting: hosts = 2^h − 2 (h = host bits); subnets = 2^s. Block size = 256 − interesting octet of mask.
OSPF cost: reference bandwidth (10^8 bps default) / interface bandwidth. 10^8/10^7 (10 Mbps) = 10; gigabit = 1. Change reference bandwidth (auto-cost reference-bandwidth 10000) when links exceed 100 Mbps or costs distort.
EIGRP metric (for awareness): 256 × (10^7/min-BW + cumulative-delay/10). Composite of bandwidth + delay; K-values default K1=K3=1.
Wildcard masks: inverse of subnet mask (0 = match, 1 = ignore). /24 → 0.0.0.255.
Throughput math: serialization delay = frame size / bandwidth. A 1500-byte frame on 1 Gbps ≈ 12 µs; on T1 (1.544 Mbps) ≈ 7.8 ms — why QoS matters on slow WAN links.
Cable limits: copper Ethernet 100 m; know fiber types loosely (multimode short, single-mode long).

5. Worked examples

Example 1 — VLSM design. Scenario: HQ needs 120 hosts, Branch A 60, Branch B 28, plus 3 point-to-point WAN links. Allocate from 10.10.0.0/23 with minimal waste. Solution: /23 = 512 addresses. Largest first: HQ 120 → /25 (126 usable): 10.10.0.0/25 (.0–.127). Branch A 60 → /26 (62): 10.10.0.128/26. Branch B 28 → /27 (30): 10.10.0.192/27. WAN links → /30s (2 usable): 10.10.0.224/30, .228/30, .232/30. Total used: 128+64+32+12 = 236 of 512 — the rest reserved. Key discipline: always sort descending, and point-to-point gets /30 (or /31), never more.

Example 2 — OSPF neighbor stuck in EXSTART. Scenario: Two routers show OSPF neighbor in EXSTART/EXCHANGE, never reaching FULL. Diagnose. Solution: EXSTART negotiates master/slave for DBD exchange — stuck here means DBD packets aren't getting through. Checklist in order: (1) MTU mismatch (most common — ip ospf mtu-ignore as workaround, fix MTU as cure), (2) duplicate router IDs, (3) unicast vs multicast reachability (ACL blocking 224.0.0.5/6), (4) authentication mismatch (usually fails earlier, at INIT/2-WAY). Fix MTU, clear with clear ip ospf process.

Example 3 — Inter-VLAN routing design. Scenario: 4 VLANs need to route between each other on a Layer 3 switch; also need DHCP for each VLAN. Solution: Create SVIs (interface Vlan10, ip address...), ip routing enabled — the L3 switch routes between VLANs at wire speed (no router-on-a-stick needed unless it's an L2-only switch). DHCP: either a local pool per VLAN (ip dhcp pool) or ip helper-address on each SVI pointing to the central server. Verify: show ip route (connected C routes for each SVI subnet), show ip interface brief.

Example 4 — EtherChannel won't bundle. Scenario: Two links between switches; show etherchannel summary shows one (P) and one (I). Diagnose. Solution: (I) = standalone, failed negotiation. Check: (1) LACP modes — if both sides passive, no LACP packets ever sent (set at least one side active); (2) speed/duplex mismatch; (3) trunk allowed-VLAN mismatch; (4) one side in wrong channel-group number. Fix and verify both (P). Lesson: EtherChannel requires identical L2 config on all member ports.

Example 5 — Rogue DHCP server. Scenario: Users intermittently get wrong gateways/DNS. Diagnose and fix. Solution: Rogue DHCP server on the access layer. Fix: enable DHCP snooping (ip dhcp snooping, ip dhcp snooping vlan 10), mark uplinks trusted (ip dhcp snooping trust), all access ports untrusted by default — rogue OFFERs/ACKs get dropped. Add DAI (ip arp inspection vlan 10) using the snooping binding table to kill ARP spoofing too. The trio (snooping + DAI + IP Source Guard) is the complete L2 access-layer defense.

6. Standards and regulations cross-reference

IEEE 802.3 (Ethernet) — the L1/L2 foundation: frame format, CSMA/CD (legacy half-duplex), speed standards (802.3ab gigabit copper, 802.3ae 10G fiber...). Know what the standard defines vs what vendors add.
IEEE 802.11 (Wi-Fi) — 802.11a/b/g/n/ac/ax generations; channels, interference, and why the exam cares about 2.4 GHz overlap (channels 1/6/11).
IEEE 802.1X — port-based network access control: supplicant/authenticator/authentication server (RADIUS), EAP methods. The NAC answer for wired/wireless access.
IETF RFCs (TCP/IP suite) — RFC 791 (IPv4), 8200 (IPv6), 826 (ARP), 792 (ICMP), 768/793 (UDP/TCP). TCP flags, three-way handshake, sequence numbers — the exam assumes fluency.
FCC Part 15 — radio frequency devices: Wi-Fi gear operates under Part 15 (unlicensed) — power limits, interference rules. Relevant when deploying wireless: you must know the regulatory domain's channel/power constraints.
CALEA — Communications Assistance for Law Enforcement Act: telecom providers must build in lawful-intercept capability. Know it exists as a carrier obligation; not a configuration topic.
PCI DSS v4.0 — network segmentation for cardholder data (firewall rulesets, no direct public access to CDE), Requirement 1 (firewall configs) and 11 (testing). CCNA-level: VLANs/ACLs as segmentation tools.

7. Pitfalls, traps, and exam strategy

Trap patterns:

The /31 trap: point-to-point links with /31 — both addresses usable, no broadcast. If you reflexively subtract 2, you'll miss it.
The AD vs metric trap: "which route wins" between OSPF (110) and EIGRP (90)? Lower AD wins regardless of metric. Within OSPF, lowest cost wins.
The native VLAN trap: trunk carrying VLAN 1 untagged; exam asks about VLAN hopping — answer involves native VLAN, not encryption.
The DTP trap: "switchport mode dynamic desirable" on both ends negotiates a trunk you didn't want. Exam wants switchport mode access / nonegotiate on access ports.
The simulation trap: sims eat time. Read the task, do the minimum config to satisfy it, verify with one show command, move on.
The automation-vocabulary trap: NETCONF vs RESTCONF vs SNMP — know the transport and data format of each.

Strategy: subnetting speed is the gate — if VLSM takes >60 seconds, drill until it doesn't. Memorize: private ranges, well-known ports (22/23/53/67/68/80/443/1812/49/162), AD values, OSPF neighbor states in order, STP port states. For sims, show run | section and show ip interface brief orient you in 10 seconds. Bank the wireless/automation vocabulary questions fast; spend time on routing sims.

8. Practice problems

P1. Subnet 172.16.0.0/22 into the maximum number of /26 subnets. How many, and what is the address range of the 5th subnet? Answer: /22 → /26 borrows 4 bits = 16 subnets, each 64 addresses. Subnets: 172.16.0.0/26, .64/26, .128/26, .192/26, 172.16.1.0/26 (5th). Range: 172.16.1.0–172.16.1.63, usable .1–.62, broadcast .63.

P2. A router has: a static route to 10.0.0.0/8 (AD 1), an OSPF route to 10.1.0.0/16 (cost 50), and an EIGRP route to 10.1.5.0/24. A packet arrives for 10.1.5.10. Which route is used and why? Answer: Longest prefix match first: 10.1.5.0/24 (EIGRP) is the most specific — it wins before AD is even consulted. (If the EIGRP route were also /16, AD 90 would beat OSPF's 110.)

P3. Two switches connect via a trunk. PC-A in VLAN 20 on switch 1 cannot ping PC-B in VLAN 20 on switch 2, but both can ping their own gateways. List the checks in order. Answer: (1) show interfaces trunk — is VLAN 20 in the allowed list on both ends? (2) show vlan brief — is the access port actually in VLAN 20 (not VLAN 1 by default)? (3) Native VLAN mismatch won't break tagged VLAN 20, but check anyway. (4) STP: show spanning-tree vlan 20 — is the trunk port forwarding for VLAN 20 (PVST+ per-VLAN blocking is the classic gotcha)?

P4. An OSPF network has 6 routers on one Ethernet segment. How many adjacencies form, and why not 15? Answer: With DR/BDR: each DROther forms adjacencies only with DR and BDR → 4 DROthers × 2 = 8, plus DR↔BDR = 9 total. (Full mesh would be 6×5/2 = 15.) The DR/BDR mechanism exists precisely to avoid O(n²) adjacency churn.

P5. A host gets IP 169.254.10.5. What happened, and what are the three most likely causes in order? Answer: APIPA — DHCP failed. Causes: (1) no DHCP server reachable (server down or relay/helper-address missing on the router), (2) exhausted DHCP pool, (3) L2 issue (VLAN mismatch, port-security blocking). Check ipconfig/link first, then the helper-address, then the server.

P6. Which protocol(s) would you use to push a configuration change to 50 switches programmatically, and why not SNMP? Answer: NETCONF or RESTCONF (model-driven, transactional, with rollback-on-error) — or Ansible over SSH as the pragmatic answer. Not SNMP: it's for monitoring (and limited config), plaintext in v2c, no transactions, no structured validation. The exam wants the YANG/NETCONF/RESTCONF vocabulary here.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.

Cisco Certified Network Associate (CCNA) Study Guide