CCNA practice test: 494 questions with full explanations

Questions on the exam

about 100 — vendor indicates, no fixed count published

Time allowed

120 minutes format →

Exam fee

$300 — vendor, checked September 4, 2026 detail →

494 practice test questions for Cisco CCNA 200-301, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min CCNA readiness check →

CCNA exam format →  ·  CCNA passing score →  · CCNA exam cost →

Questions by domain

• Network Fundamentals — 116 questions →
• IP Connectivity — 97 questions →
• Network Access — 96 questions →
• Security Fundamentals — 68 questions →
• IP Services — 66 questions →
• Automation and Programmability — 51 questions →

Sample questions

14, found by removing the network and broadcast addresses: How many usable host addresses does this subnet pro

1. 14, found by removing the network and broadcast addresses from the sixteen that a /28 provides ✓

   A /28 leaves 4 host bits, so 2^4 = 16 total addresses. Subtracting the reserved network and broadcast addresses gives 16 - 2 = 14 usable host addresses.
2. 16, counting every address combination available across all four host bits of the /28 subnet

   16 is the total address count in a /28, but the network and broadcast addresses cannot be assigned to hosts, so only 14 remain usable.
3. 12, reserving exactly the number of addresses the twelve branch-office hosts are expected to use

   12 matches the host requirement, but a /28 actually yields 14 usable addresses; the subnet accommodates the 12 hosts with 2 addresses to spare.
4. 30, applying the usable-host formula to five host bits rather than the four a /28 mask leaves

   30 usable hosts corresponds to a /27, which has five host bits (2^5 - 2 = 30). A /28 has only four host bits and yields 14.

All 116 Network Fundamentals questions →

Static route — Administrative Distance 1 is lower than: Which route will the router prefer and why?

1. Static route — Administrative Distance 1 is lower than OSPF's AD of 110 ✓

   Administrative distance decides which source wins when the same prefix is learned twice. A static route has AD 1 and OSPF has AD 110, so the lower AD static route is installed in the routing table.
2. OSPF route — a dynamic protocol is more reliable than a static route

   Being dynamic or 'more reliable' does not decide preference; administrative distance does. A static route at AD 1 always beats an OSPF route at AD 110 for the same destination.
3. OSPF route — its metric is lower than that of the competing static route

   Metric is only compared among routes from the same protocol, and AD is evaluated first; with different ADs, OSPF's cost is irrelevant against a static route.
4. Both routes are installed and the router load-balances traffic across them

   Load balancing needs equal AD and equal metric; a static route at AD 1 and an OSPF route at AD 110 have different ADs, so only the lower-AD static route is installed.

All 97 IP Connectivity questions →

The frame is sent without an 802.1Q tag: When a frame from VLAN 10 is sent across this trunk, how is the frame

1. The frame is sent without an 802.1Q tag ✓

   The native VLAN on an 802.1Q trunk carries traffic without a VLAN tag. Frames belonging to the native VLAN are transmitted untagged; the receiving switch assumes untagged frames belong to its configured native VLAN.
2. The frame is tagged with VLAN ID 10

   The native VLAN is specifically the VLAN whose traffic travels untagged across a trunk — VLAN 10 frames are NOT tagged when VLAN 10 is the native VLAN.
3. The frame is dropped because native VLAN traffic cannot cross trunks

   Native VLAN traffic absolutely crosses trunks — it just travels untagged. Native VLAN traffic is forwarded; it is never dropped for being native.
4. The frame is tagged with VLAN 1 (the default native VLAN)

   The native VLAN was explicitly configured to VLAN 10, overriding the default of VLAN 1. The behavior is determined by the configured native VLAN, not the default.

All 96 Network Access questions →

securepass — because enable secret always takes precedence: Which password will be required to enter privilege

1. cisco123 — because the enable password entry overrides the enable secret

   This is reversed. Enable secret overrides enable password, not the other way around, regardless of which command was entered first.
2. Either password works — because the router accepts whichever of the two values you type

   Only the enable secret password is accepted when both are configured. The enable password is effectively ignored while an enable secret exists.
3. Neither — because both configured passwords must both match before login is allowed

   There is no dual-password requirement. Enable secret takes sole precedence over enable password when both are present.
4. securepass — because enable secret always takes precedence over enable password ✓

   When both commands are configured, 'enable secret' always overrides 'enable password'. Enable secret uses a hashed value, while enable password is reversible, so secret is preferred and takes precedence.

All 68 Security Fundamentals questions →

Inside local, the private address the internal host uses: Using NAT terminology, what is 192.168.1.10 called?

1. Inside global, the public address that represents the internal host to servers on the internet after the router translates it

   Inside global is the translated public IP representing the host on the internet, which here is 203.0.113.5, not the host's private 192.168.1.10.
2. Inside local, the private address the internal host uses on the LAN before the router performs any NAT translation on it ✓

   The inside local address is the private IP assigned to the internal host - the address the host uses inside the network before NAT translates it.
3. Outside local, the address of an external host as it appears to devices inside the private network after any inbound NAT

   Outside local describes an external host as seen from inside, usually equal to outside global; it does not describe the internal host 192.168.1.10.
4. Outside global, the real public address of the remote external server as it appears to hosts outside the network

   Outside global is the real public address of the external server, not the internal host, so it does not apply to 192.168.1.10.

All 66 IP Services questions →

Control plane: Which network plane does OSPF operate in?

1. Data plane, which forwards packets using the tables the device has already built

   The data plane (forwarding plane) performs the actual packet-by-packet forwarding based on tables already populated by the control plane. OSPF populates those tables but does not perform the forwarding itself.
2. Management plane, which handles administrative access such as SSH and SNMP

   The management plane handles administrative access to the device — SSH, SNMP, Syslog, Telnet. OSPF is not a management protocol.
3. Control plane, which builds the routing and switching decisions on the device ✓

   The control plane handles routing decisions and protocol logic — OSPF, STP, ARP, and other protocols that determine HOW traffic should be forwarded operate in the control plane. The routing table is a product of control plane activity.
4. Application plane, a layer described above the controller in SDN models

   'Application plane' is not a standard network plane in the context of traditional network devices — routing protocols like OSPF do not operate there.

All 51 Automation and Programmability questions →

Network 172.16.45.192 and broadcast 172.16.45.255: What is the network address and broadcast address for this

1. Network 172.16.45.128 and broadcast 172.16.45.191, placing .200 within the third 64-address block

   The 172.16.45.128/26 block covers 128-191. Host address .200 is above .191, so it belongs to the next block (.192-.255), not this one.
2. Network 172.16.45.192 and broadcast 172.16.45.255, since .200 falls inside the fourth 64-address block ✓

   A /26 uses 64-address blocks: .0, .64, .128, .192. Address .200 lies in the .192 block (192-255), so the network is 172.16.45.192 and the broadcast is 172.16.45.255.
3. Network 172.16.45.0 and broadcast 172.16.45.63, treating .200 as part of the very first 64-address block

   The 172.16.45.0/26 block covers 0-63. Host address .200 is far outside this range and cannot belong to the first block.
4. Network 172.16.45.192 and broadcast 172.16.45.223, using a 32-address /27 boundary for the block size

   Broadcast .223 would be correct for a 32-address /27, not a /26. A /26 spans 64 addresses, so the .192 block broadcasts at .255.

All 116 Network Fundamentals questions →

10.10.10.0/24 via 192.168.1.3: Which route is used?

1. 10.0.0.0/8 via 192.168.1.1

   10.0.0.0/8 does match 10.10.10.5 but is a /8 prefix, less specific than the /16 and /24 routes. Longest prefix match always selects the most specific (longest prefix length) route.
2. 10.10.10.0/24 via 192.168.1.3 ✓

   Longest prefix match: the router selects the most specific route that matches the destination. 10.10.10.5 matches all four routes, but 10.10.10.0/24 (prefix length /24) is the longest, most specific match and is selected.
3. 0.0.0.0/0 via 192.168.1.4

   The default route (0.0.0.0/0) matches all destinations but is a /0, the least specific possible match. It is only used when no more specific route exists.
4. 10.10.0.0/16 via 192.168.1.2

   10.10.0.0/16 matches 10.10.10.5 and is more specific than /8 and /0, but /24 is even more specific. Longest prefix match selects /24 over /16.

All 97 IP Connectivity questions →

CCNA exam: the facts

How many questions are on the CCNA exam?

Around 100. The vendor does not publish a fixed count for CCNA, so this is the figure it indicates rather than a guaranteed number.

How long is the CCNA exam?

120 minutes. Across 100 questions that is about 72 seconds per question.

What topics does the CCNA exam cover?

6 domains: IP Connectivity, Network Fundamentals, Network Access, Security Fundamentals, IP Services, Automation and Programmability. Weights: IP Connectivity 0.25%, Network Fundamentals 0.2%, Network Access 0.2%, Security Fundamentals 0.15%, IP Services 0.1%, Automation and Programmability 0.1%.

How many CCNA practice test questions does Certsqill have?

494, spread across 6 exam domains. Every one shows all options, which is correct, and why each of the others is not.