SaveMyCert
Log in
5 of 5 free questions left today·for 10 a day
CCNA practice

Free CCNA practice questions

Drill exam-realistic Cisco Certified Network Associate (CCNA 200-301 v2.0) questions by domain, with an explanation on every option — not just the right one. 5 fully worked examples are further down this page, answers included.

Question bank
957
across 5 domains
Free, no account
5/day
a free account allows 10 a day
Real exam
120 min
question count not yet published · pass Pass / fail
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across all domains, in Learn mode.

Review what you missed

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

5 sample CCNA questions, fully explained

Real questions from the CCNA bank, with the answer key and the reasoning behind every option. Read them, then go back up the page and try the rest.

Question 1Network Infrastructure and Connectivity

Users behind a router complain of slow file transfers. An engineer collects counters from both ends of the link between SW1 Gi1/0/3 and R1 Gi0/0/1:SW1# show interfaces gi1/0/3 Half-duplex, 100Mb/s, media type is 10/100/1000BaseTX 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 output errors, 152 collisions, 0 interface resets 0 babbles, 87 late collision, 0 deferred R1# show interfaces gi0/0/1 Full Duplex, 100Mbps, link type is auto, media type is RJ45 210 runts, 0 giants, 0 throttles 341 input errors, 341 CRC, 0 frame, 0 overrun, 0 ignoredWhat is the most likely cause?

Choose one.

  • a
    The two ends of the link are running different duplex settings Correct

    Late collisions on the half-duplex switch side plus CRC errors and runts on the full-duplex router side is the classic duplex-mismatch signature.

  • b
    The copper cable between the two ends has a damaged pair

    A damaged pair would raise CRC errors, but it would not explain late collisions on one end while the other end runs full duplex.

  • c
    The copper run between the two ends exceeds its rated length

    An over-length run can cause late collisions, but both ends would then share the same duplex; here they plainly differ.

  • d
    The two ends of the link are running different speed settings

    Both ends report 100 Mb/s, and a speed mismatch would keep the link down rather than pass traffic with errors.

The concept

A duplex mismatch produces different symptoms on each end of the same link.

Why that’s the answer

The half-duplex end transmits when it senses the line idle and treats incoming frames during its transmission as collisions, many detected after the first 64 bytes (late collisions). The full-duplex end ignores carrier sense, so it transmits over the half-duplex end's frames, and the frames the half-duplex end aborts arrive truncated as runts or with bad FCS (CRC errors). Here the outputs show 'Half-duplex' versus 'Full Duplex' at the same 100 Mb/s, which rules out a speed mismatch; a damaged cable or over-length run would not explain the asymmetric counters.

How to reason it out
  1. Compare the duplex and speed lines of both outputs.
  2. Note that speeds match but duplex differs.
  3. Match late collisions to the half-duplex end and CRC/runts to the full-duplex end.
  4. Conclude duplex mismatch and set both ends to the same duplex (preferably autonegotiate both).

Exam tip: Late collisions on one end plus CRC errors on the other end of the same link means duplex mismatch.

CCNA Interface and Cable Issues: Duplex, Errors, Copper and Fiber Troubleshooting — the lesson that teaches this.

Question 2Switching and Network Access

Two new Catalyst switches are cabled together on Gi1/0/24, but hosts in VLAN 20 on SW2 cannot reach VLAN 20 hosts on SW1. Neither port has been configured. The engineer runs this on both switches and sees the same result:SW1# show interfaces gi1/0/24 switchport | include Mode Administrative Mode: dynamic auto Operational Mode: static accessWhat is the most likely cause?

Choose one.

  • a
    Both ports need the trunk encapsulation set to 802.1Q first

    Encapsulation is not the problem: the operational mode is static access, meaning negotiation never produced a trunk. Catalyst 9000 switches support only 802.1Q anyway.

  • b
    Both ports exclude VLAN 20 from their trunk allowed VLAN list

    An allowed list only applies to a port that is trunking. These ports operate as access ports, so no allowed list is in effect.

  • c
    Both ports wait for the neighbour to start trunk negotiation Correct

    Dynamic auto only answers DTP requests; it never initiates. Two dynamic auto ports therefore both stay access ports, so only one VLAN crosses the link.

  • d
    Both ports use a different native VLAN from their neighbour

    Unconfigured ports share the default native VLAN 1, and a native VLAN mismatch would not leave the port in static access mode.

The concept

DTP negotiation between two dynamic auto ports

Why that’s the answer

The default administrative mode on these switch ports is dynamic auto. A dynamic auto port becomes a trunk only if the neighbour actively asks for one (trunk or dynamic desirable). With dynamic auto on both ends nobody asks, so both operate as access ports in VLAN 1 and VLAN 20 cannot cross. Encapsulation, allowed lists and native VLANs only matter once the link is trunking.

How to reason it out
  1. Read Operational Mode: static access means no trunk formed.
  2. Note the Administrative Mode on both ends is dynamic auto.
  3. Recall that dynamic auto responds to DTP but never initiates.
  4. Set one or both ends to switchport mode trunk to form the trunk.

Exam tip: Dynamic auto on both ends never forms a trunk: someone has to ask.

CCNA Trunks, LACP EtherChannel, Routed Ports and SVIs — the lesson that teaches this.

Question 3IP Routing

Branch router BR1 has a single WAN link to its ISP. The ISP router's address, 203.0.113.1, is on the subnet connected to BR1's Gi0/0/0. BR1 has IP routing enabled and must send every packet whose destination is not in its routing table to the ISP. Which command meets the requirement?

Choose one.

  • a
    ip route 0.0.0.0 0.0.0.0 203.0.113.1 Correct

    Prefix 0.0.0.0 with mask 0.0.0.0 matches every destination, so it is the IPv4 default route, and the next hop is the ISP router.

  • b
    ip route 0.0.0.0 255.255.255.255 203.0.113.1

    Mask 255.255.255.255 makes this a host route for the single address 0.0.0.0, not a route that matches every destination.

  • c
    ip default-gateway 203.0.113.1

    ip default-gateway is used only when IP routing is disabled (a host-like device). A routing router ignores it for forwarded traffic.

  • d
    ip route 203.0.113.1 255.255.255.255 Gi0/0/0

    This is a host route to the ISP router itself. It does nothing for traffic to other unknown destinations.

The concept

An IPv4 default route is a static route to 0.0.0.0/0.

Why that’s the answer

The default route is written as ip route 0.0.0.0 0.0.0.0 followed by a next hop or exit interface. A /0 prefix matches every destination, so the router uses it whenever no more specific route exists. Mask 255.255.255.255 turns the entry into a host route, and ip default-gateway only applies when the device is not routing.

How to reason it out
  1. Note that BR1 is routing, so the answer must be an ip route entry.
  2. Recall that a default route has prefix 0.0.0.0 and mask 0.0.0.0.
  3. Point it at the ISP router's address on the connected subnet.

Exam tip: Default route = ip route 0.0.0.0 0.0.0.0 <next hop>; ip default-gateway is only for non-routing devices.

CCNA Static Routing: Default, Network, Host and Floating Static Routes (IPv4 and IPv6) — the lesson that teaches this.

Question 4Network Services and Security

An engineer is creating a break-glass account on router R1 for use when the AAA servers are down. Policy says the stored credential must be a one-way hash that cannot be reversed even if someone reads the configuration, and the account must reach privileged EXEC directly at login. Which command meets the policy?

Choose one.

  • a
    username breakglass privilege 15 password Xq7!vR2p

    The password keyword stores the text in clear, or as reversible type 7 with service password-encryption, which breaks the hashing rule.

  • b
    username breakglass privilege 1 secret Xq7!vR2p

    The credential is hashed, but privilege 1 lands the user in user EXEC, so they would still need the enable secret.

  • c
    username breakglass privilege 1 password Xq7!vR2p

    Both parts fail: password stores clear text or reversible type 7, and privilege 1 lands the user in user EXEC.

  • d
    username breakglass privilege 15 secret Xq7!vR2p Correct

    The secret keyword stores a one-way hash, and privilege 15 places the user in privileged EXEC at login.

The concept

Local accounts are created with the username command; secret hashes the credential and privilege sets the starting level.

Why that’s the answer

username <name> privilege 15 secret <pw> creates a local account whose credential is stored as a one-way hash and whose session starts at level 15. The password keyword is the tempting near-twin: it stores clear text, and service password-encryption only turns it into reversible type 7. Privilege 1 would leave the user at the > prompt, needing the enable secret. Only the combination of secret and privilege 15 meets both rules.

How to reason it out
  1. Spot the two requirements: a one-way hash and level 15 at login.
  2. Choose secret, not password, for the hash.
  3. Check the privilege value on the same line.
  4. Keep only the option that gets both parts right.

Exam tip: Local accounts: username NAME privilege 15 secret PW. Secret is a hash; password is clear or type 7.

CCNA AAA and Secure File Transfer: Local Users, TACACS+, RADIUS, SCP and SFTP — the lesson that teaches this.

Question 5AI, and Network Operations and Management

A network team is trialling two AI tools. Tool 1 drafts an IOS XE configuration whenever an engineer asks for one. Tool 2 watches telemetry, notices rising input errors on an uplink, runs show commands through an API, and opens a change request with a proposed fix. How is Tool 2 best described?

Choose one.

  • a
    An agentic AI system that pursues a goal by taking its own actions Correct

    Tool 2 notices a condition, plans, calls tools (show commands) and takes an action (a change request) without a person prompting each step.

  • b
    A generative AI chat assistant that answers one prompt at a time

    That describes Tool 1: it produces content when asked and then waits. Tool 2 starts on its own and takes several steps.

  • c
    A rule-based alert script that forwards matching syslog messages

    A fixed rule can raise an alert, but it does not decide which commands to run next or draft a fix.

  • d
    A language model on its own that predicts text with no device access

    Tool 2 reads live device data through an API, so it is more than a model generating text.

The concept

Generative AI creates content from a prompt; agentic AI pursues a goal over several steps and uses tools to observe and act.

Why that’s the answer

Tool 2 is triggered by what it observes, chooses which show commands to run, interprets the results and acts by opening a change request. Goal-driven, multi-step behaviour with tool use is what makes a system agentic. Tool 1 is generative AI: useful, but it waits for a prompt and only returns content.

How to reason it out
  1. Ask what starts each tool: a prompt, or an observed condition.
  2. Ask whether the tool calls other systems (APIs, show commands) itself.
  3. Several self-directed steps with tool calls point to an agent.

Exam tip: Generative AI answers; agentic AI observes, decides and acts toward a goal.

CCNA Agentic AI and Prompting: AI Agents, Guardrails and Prompt Components for Network Operations — the lesson that teaches this.

The CCNA question bank, by domain

The bank is built to the exam's own weighting, so the practice you get reflects the marks that are actually on offer — not whichever domain was easiest to write questions for.

Published CCNA practice questions per exam domain
DomainExam weightTopicsQuestions
Network Infrastructure and Connectivity25%6239
Switching and Network Access25%4240
IP Routing20%4190
Network Services and Security20%6192
AI, and Network Operations and Management10%496
Total100%24957

Practise CCNA one domain at a time

How CCNA questions are worded

Most CCNA questions are not asking whether you can recall a definition. They describe a situation and ask which option satisfies it — so the skill being tested is reading the requirement precisely and eliminating options that fail it.

Single-response vs multiple-response

A single-response question has exactly one right answer. A multiple-response question tells you how many to pick ("Choose TWO") and there is no partial credit — getting one of the two right scores nothing. Read that instruction before you read the options.

Read the last line first

The final sentence is the actual question; everything before it is scenario. Read it first, then read the scenario knowing what you are looking for. It stops you from building an answer in your head that the question never asked for.

Hunt for the qualifier

Most scenarios turn on one word — MOST cost-effective, LEAST operational overhead, with the LEAST latency, without changing application code. Two options are frequently both technically correct, and the qualifier is the only thing separating them.

Eliminate, then choose

Distractors are almost always real Cisco services doing a real job — just not this job. Rule out the ones that break a stated constraint before you compare what's left. On a question you truly don't know, eliminating two options turns a guess into a coin flip.

Practise CCNA from your browser

The SaveMyCert Chrome extension opens a daily drill of 5 CCNA questions in the side panel, with the full explanation behind every answer. No account needed.

Get the Chrome extension (opens in a new tab)

Beyond CCNA practice

CCNA practice questions: your questions

Yes. You can answer 5 questions a day with no account at all, and a free account raises that to 10 a day across the full 957-question CCNA bank, with an explanation on every option. Pro removes the daily cap entirely.

Source

Exam structure, domain weights and scoring on this page come from the official CCNA exam guide.