CCNA Practice Exam.
Free practice test — 36 verified questions, instant feedback.
Know the exam before you sit it
the facts most prep sites buryEvery free resource for this exam
family overview →Get a free CCNA study plan
A week-by-week plan plus new practice questions, straight to your inbox.
Frequently asked questions
Which CCNA 200-301 domains should I spend the most practice time on?
<p>The official exam topics are organized into 6 content domains, and they are not weighted equally. IP Connectivity is the most heavily weighted domain at 25%, followed by Network Fundamentals at 20% and Network Access at 20% — together those three domains account for 65% of the exam. The remaining weight goes to Security Fundamentals at 15%, IP Services at 10%, and Automation and Programmability at 10%.</p><p>A sensible practice plan mirrors those weights: put the bulk of your question drilling into routing, switching, and fundamentals, but don't skip the smaller domains entirely — a 10% domain can still decide a borderline result.</p>
How long is the CCNA exam, and how should I pace my practice tests?
<p>The CCNA 200-301 is a 120-minute exam. When you sit full-length practice tests, run them against that same two-hour clock so your pacing becomes automatic before exam day.</p><p>Because the time limit is fixed, it pays to practice moving on quickly: if a simulation or long scenario question stalls you, note it, keep going, and bank the easier points first. Timed practice is the only reliable way to find out whether your current speed actually fits inside 120 minutes.</p>
How much does the CCNA exam cost, and why does practicing first matter financially?
<p>The exam fee is 300 USD, paid to Cisco's testing partner Pearson VUE, and it covers a single attempt. That means a failed attempt requires paying the full fee again to retest — so free practice questions are effectively insurance on a 300 USD bet. A reasonable benchmark is to keep drilling until you score consistently well across all six domains before you book a seat.</p><p>Once you pass, the CCNA certification is valid for 3 years, so the preparation effort pays off over a multi-year credential, not just a single test day.</p>
Can I take the CCNA online, or do I have to go to a test center?
<p>Both options exist. The CCNA is delivered through Pearson VUE, Cisco's authorized exam delivery provider. You can sit it in a proctored environment at a Pearson VUE Authorized Test Center, or take it online through the OnVUE online proctored service, where a live proctor monitors you by webcam. Either way, you schedule through the Pearson VUE testing portal by signing in to your Cisco certification account.</p><p>If you choose OnVUE, verify your setup before exam day: Pearson VUE requires a minimum internet speed of 6 Mbps download and 2 Mbps upload. Testing your connection and workspace in advance avoids losing your attempt to a technical failure.</p>
Browse all questions & answers
1. An engineer subnets 192.168.10.0/24 into networks that each support at least 30 hosts. Which subnet mask satisfies this requirement while wasting the fewest addresses?
- A. 255.255.255.192 (/26)
- B. 255.255.255.224 (/27)
- C. 255.255.255.240 (/28)
- D. 255.255.255.128 (/25)
Show answer & explanation
Answer: B
A /27 mask leaves 5 host bits (2^5-2=30 usable hosts), exactly meeting the requirement with minimal waste. A /28 gives only 14 usable hosts (too few), while /26 and /25 provide far more addresses per subnet than needed, wasting IP space.2. Which statement correctly differentiates a Layer 2 switch's collision domain behavior from that of a legacy Ethernet hub?
- A. A switch places every port in its own collision domain, while a hub shares one collision domain across all ports
- B. A hub places every port in its own collision domain, while a switch shares one collision domain
- C. Both switches and hubs place every port in the same broadcast domain and same collision domain
- D. Switches and hubs both eliminate collision domains entirely by default
Show answer & explanation
Answer: A
Switches forward frames based on MAC address tables and provide dedicated bandwidth per port, so each switch port is its own collision domain; a hub is a physical-layer repeater where all ports share one collision domain. Options B-D reverse or misstate this fundamental distinction.3. A network engineer needs a Layer 3 device to fragment a 1500-byte frame that must traverse a link with a smaller MTU. What is the most likely consequence if the Don't Fragment (DF) bit is set in the IP header?
- A. The router fragments the packet anyway and reassembles it at the far end
- B. The router drops the packet and may send an ICMP 'fragmentation needed' message back to the sender
- C. The switch converts the packet to a jumbo frame automatically
- D. The packet is forwarded unchanged regardless of MTU
Show answer & explanation
Answer: B
When DF is set and the outgoing interface MTU is smaller than the packet, the router cannot fragment it and instead drops the packet, typically returning ICMP type 3 code 4 (fragmentation needed) so the sender can perform Path MTU Discovery. Fragmentation despite DF, silent forwarding, or switch-level frame conversion are not valid IP-layer behaviors.4. Which OSI layer is primarily responsible for establishing, managing, and terminating logical connections such as TCP sessions between two hosts?
- A. Layer 2 (Data Link)
- B. Layer 3 (Network)
- C. Layer 4 (Transport)
- D. Layer 7 (Application)
Show answer & explanation
Answer: C
Layer 4 (Transport) handles end-to-end connection establishment, flow control, and reliability via protocols like TCP; Layer 2 handles framing on a single link, Layer 3 handles logical addressing and routing, and Layer 7 handles application-specific services, none of which manage session-level connection state.5. An administrator observes that IPv6 address fe80::1a2b:3c4d:5e6f:7a8b is assigned to a router interface. What is the correct classification and purpose of this address?
- A. A global unicast address used for internet-routable communication
- B. A link-local address used only for communication on the local network segment
- C. A multicast address used to reach all routers on the segment
- D. A unique local address used for site-local routing across the WAN
Show answer & explanation
Answer: B
Addresses beginning with fe80::/10 are link-local, automatically assigned to every IPv6 interface and used only for on-link communication (e.g., neighbor discovery), never routed off the local segment. Global unicast addresses use 2000::/3, multicast uses ff00::/8, and unique local addresses use fc00::/7.6. A switch port configured as an access port receives a frame tagged with 802.1Q VLAN ID 20, but the port is assigned to VLAN 10. What does the switch do with this frame?
- A. It forwards the frame normally into VLAN 20
- B. It drops the frame because access ports do not expect or accept tagged frames
- C. It re-tags the frame with VLAN 10 and forwards it
- D. It floods the frame to all VLANs as an unknown unicast
Show answer & explanation
Answer: B
Access ports are configured for a single untagged VLAN and do not process 802.1Q tags; a tagged frame arriving on an access port is discarded because it does not match the expected untagged format. The switch does not silently accept, re-tag, or flood such frames across VLANs.7. Which EtherChannel negotiation protocol is Cisco proprietary, as opposed to the open-standard alternative?
- A. LACP (Link Aggregation Control Protocol)
- B. PAgP (Port Aggregation Protocol)
- C. STP (Spanning Tree Protocol)
- D. VTP (VLAN Trunking Protocol)
Show answer & explanation
Answer: B
PAgP is a Cisco-proprietary protocol for negotiating EtherChannel bundles, whereas LACP (IEEE 802.3ad) is the open standard supported across vendors. STP prevents loops and is unrelated to channel negotiation, and VTP synchronizes VLAN databases, also unrelated to link aggregation negotiation.8. In Rapid PVST+, a switch port that is neither the root port nor a designated port, but is blocking to prevent a loop, is in which port state and role?
- A. Forwarding, Root port
- B. Discarding, Alternate port
- C. Learning, Designated port
- D. Forwarding, Backup port
Show answer & explanation
Answer: B
In Rapid PVST+, a port that receives a superior BPDU but is not selected as the root or designated port becomes an alternate port in the discarding state, providing a standby path without forwarding traffic. Root and designated ports forward traffic once stable, so the other options misassign both the state and role.9. A wireless engineer is deploying an 802.11 network where multiple lightweight access points must be centrally managed for configuration, RF optimization, and roaming. What component provides this centralized control?
- A. A wireless LAN controller (WLC)
- B. An autonomous access point
- C. A Layer 2 switch acting as a root bridge
- D. A DHCP relay agent
Show answer & explanation
Answer: A
A wireless LAN controller centrally manages lightweight APs using CAPWAP, handling configuration push, RF management, and client roaming across the AP fleet. Autonomous APs manage themselves independently rather than centrally, and switches or DHCP relays play no role in WLAN-specific control functions.10. Two switches connect via a trunk link but have mismatched native VLANs configured on each end. What is the most likely operational impact?
- A. The trunk fails to come up entirely
- B. Traffic for the native VLANs may leak between the mismatched VLANs, and CDP/STP may log a native VLAN mismatch warning
- C. Only voice VLAN traffic is affected, all data VLANs are unaffected
- D. The switches automatically renegotiate a matching native VLAN via DTP
Show answer & explanation
Answer: B
A native VLAN mismatch causes untagged frames from one native VLAN to be interpreted as belonging to the other switch's native VLAN, potentially leaking traffic between VLANs; Cisco switches typically detect this via CDP and log warnings, and STP may also flag it. The trunk link itself typically stays up, DTP negotiates trunking mode not native VLAN matching, and the issue is not limited to voice VLANs.11. Which statement about the differences between static routing and dynamic routing protocols is accurate?
- A. Static routes automatically adjust when a link fails, while dynamic routes require manual reconfiguration
- B. Dynamic routing protocols consume more router CPU and bandwidth for updates, but adapt automatically to topology changes
- C. Static routes cannot be assigned an administrative distance
- D. Dynamic routing protocols are only usable in single-router networks
Show answer & explanation
Answer: B
Dynamic routing protocols like OSPF or EIGRP exchange periodic or triggered updates, consuming CPU and bandwidth, but automatically reconverge after topology changes; static routes require manual updates but have no such overhead. Static routes do have a default administrative distance (typically 1), and dynamic protocols are designed for multi-router networks, not restricted to single routers.12. A router has the following routes to reach 10.0.0.0/24: a static route with administrative distance 1, and an OSPF route with administrative distance 110. Both are in the routing table. Which route is installed and used for forwarding?
- A. The OSPF route, because OSPF is a link-state protocol
- B. The static route, because it has the lower administrative distance
- C. Both routes are installed and traffic is load-balanced
- D. Neither route is installed; the router uses only directly connected routes
Show answer & explanation
Answer: B
When two routing sources learn the same destination, the router prefers the route with the lowest administrative distance, and a static route's default AD of 1 is lower than OSPF's default AD of 110, so the static route wins. Load-balancing across differing AD routes to the same prefix does not occur, and connected routes are irrelevant here since neither route is directly connected.13. An OSPF network has two routers on the same multi-access segment, both configured with the same OSPF priority and no manual DR configuration. What determines which router becomes the Designated Router?
- A. The router with the lowest OSPF process ID
- B. The router with the highest router ID
- C. The router that boots up second
- D. The router with the fewest interfaces
Show answer & explanation
Answer: B
When OSPF priorities are tied, the router with the highest router ID (derived from a configured loopback, or the highest active IP address if none is set) is elected DR. Process ID is locally significant and not used in DR election, boot order alone doesn't decide the election outcome once priorities tie, and interface count plays no role.14. A host with IP 172.16.5.10/22 needs to determine whether 172.16.7.50 is on its local subnet or requires routing through a gateway. What is the correct subnet range for 172.16.5.10/22?
- A. 172.16.4.0 - 172.16.7.255
- B. 172.16.5.0 - 172.16.5.255
- C. 172.16.0.0 - 172.16.255.255
- D. 172.16.4.0 - 172.16.4.255
Show answer & explanation
Answer: A
A /22 mask (255.255.252.0) creates blocks of 4 in the third octet; 172.16.5.10 falls in the block 172.16.4.0-172.16.7.255, so 172.16.7.50 is within the same subnet and reachable locally without routing. The other ranges reflect /24 or /16 boundaries, which do not match the /22 prefix.15. Which routing protocol characteristic best distinguishes EIGRP as an advanced distance-vector protocol from a pure distance-vector protocol like RIP?
- A. EIGRP floods full link-state databases to every router in the area
- B. EIGRP uses the Diffusing Update Algorithm (DUAL) to maintain backup routes and converge rapidly without full periodic broadcasts
- C. EIGRP only supports a hop count metric identical to RIP
- D. EIGRP requires manual configuration of every route with no automatic neighbor discovery
Show answer & explanation
Answer: B
EIGRP's DUAL algorithm computes feasible successors as backup routes and enables fast, loop-free convergence, and it sends only partial/triggered updates rather than RIP's periodic full-table broadcasts. Flooding full link-state databases describes OSPF/IS-IS, EIGRP uses a composite metric (not hop count), and it does perform automatic neighbor discovery via hello packets.16. A router's routing table contains a default route (0.0.0.0/0) and a more specific route to 192.168.1.0/24. A packet destined for 192.168.1.50 arrives. Which route does the router use?
- A. The default route, since it is always checked first
- B. The 192.168.1.0/24 route, because routers use longest prefix match
- C. Both routes are used simultaneously via load balancing
- D. Neither route; the packet is dropped as ambiguous
Show answer & explanation
Answer: B
Routers apply the longest prefix match rule, selecting the most specific matching route regardless of administrative distance or metric, so the /24 route is chosen over the /0 default route. The default route is only used as a last resort when no more specific match exists, and there is no ambiguity requiring the packet to be dropped.17. An engineer configures inter-VLAN routing using a single router interface with subinterfaces, each tagged for a different VLAN via 802.1Q encapsulation. What is this configuration commonly called?
- A. Router-on-a-stick
- B. Switched virtual interface routing
- C. Proxy ARP routing
- D. HSRP routing
Show answer & explanation
Answer: A
Router-on-a-stick describes a single physical router interface divided into VLAN-tagged subinterfaces to route between VLANs over one trunk link to a switch. Switched virtual interfaces (SVIs) are a different approach used on Layer 3 switches, proxy ARP is unrelated to VLAN routing, and HSRP provides gateway redundancy, not inter-VLAN routing itself.18. A client's DHCP lease is about to expire. At what point in the DHCP lease lifecycle does the client first attempt unicast renewal directly with the original DHCP server?
- A. Immediately upon receiving the lease, before any time has elapsed
- B. At approximately 50% of the lease duration (the T1 timer)
- C. Only after the lease has fully expired
- D. At exactly 100% of the lease duration
Show answer & explanation
Answer: B
At the T1 timer, roughly 50% of the lease duration, the client sends a unicast DHCPREQUEST directly to the original server to renew the lease before it expires. If that fails, the client waits until T2 (about 87.5%) to broadcast for any server, and only after full expiration does it restart the full DHCP discovery process from scratch.19. An organization configures NAT overload (PAT) on its edge router so that all internal hosts share a single public IP address. How does the router distinguish return traffic belonging to different internal hosts?
- A. It uses the source MAC address embedded in the IP header
- B. It uses unique source port numbers assigned per translated session, tracked in the NAT translation table
- C. It assigns a different public IP to each session automatically
- D. It relies on the internal hosts' hostnames advertised via DNS
Show answer & explanation
Answer: B
PAT (NAT overload) maps each internal host's session to the single public IP but assigns a unique source port, and the router tracks the IP:port combination in its translation table to correctly demultiplex returning traffic. MAC addresses are not carried in IP headers, PAT specifically avoids needing multiple public IPs, and hostnames/DNS play no role in the translation table lookup.20. A network administrator wants all switches and routers to synchronize their clocks to a common accurate time source for consistent log timestamps. Which protocol accomplishes this?
- A. SNMP
- B. NTP (Network Time Protocol)
- C. CDP
- D. TFTP
Show answer & explanation
Answer: B
NTP synchronizes device clocks against a reference time source (often in a hierarchy of stratum levels), ensuring consistent, correlatable timestamps across logs and security events. SNMP is used for monitoring/management, CDP discovers directly connected Cisco devices, and TFTP is a simple file transfer protocol, none of which perform time synchronization.21. First Hop Redundancy Protocols (FHRPs) like HSRP provide which primary benefit to hosts on a LAN segment?
- A. Faster DNS resolution for internal hosts
- B. A virtual default gateway IP that remains reachable even if the active router fails
- C. Automatic VLAN tagging on access ports
- D. Compression of Layer 2 broadcast traffic
Show answer & explanation
Answer: B
HSRP and similar FHRPs present a shared virtual IP/MAC as the default gateway; if the active router fails, a standby router takes over the virtual address so hosts experience no gateway outage. FHRPs do not perform DNS resolution, VLAN tagging, or broadcast compression—those are unrelated functions handled by other protocols or devices.22. A security team wants to restrict inbound traffic to only allow TCP port 443 to a specific web server, while denying all other inbound traffic to that host. Which tool is most appropriate to implement this on a Cisco router?
- A. A standard ACL matching only source addresses
- B. An extended ACL matching destination IP and destination port 443
- C. Port security limiting MAC addresses per switchport
- D. DHCP snooping trust configuration
Show answer & explanation
Answer: B
Extended ACLs can filter on source/destination IP, protocol, and port number, making them the correct tool to permit only HTTPS (port 443) to a specific destination while denying everything else. Standard ACLs only match source address (not destination or port), port security controls which MAC addresses can use a switchport (unrelated to IP traffic filtering), and DHCP snooping guards against rogue DHCP servers, not general traffic filtering.23. Which statement accurately describes the security purpose of DHCP snooping on a switch?
- A. It encrypts DHCP traffic between clients and servers
- B. It builds a binding table of trusted IP-to-MAC-to-port mappings and blocks DHCP responses from untrusted ports, mitigating rogue DHCP servers
- C. It automatically assigns static IP addresses to prevent DHCP use entirely
- D. It load-balances DHCP requests across multiple servers
Show answer & explanation
Answer: B
DHCP snooping designates ports as trusted or untrusted, only allowing DHCP server responses (OFFER/ACK) from trusted ports, and builds a binding table used by related features like Dynamic ARP Inspection; this prevents rogue or unauthorized DHCP servers from handing out malicious configurations. It does not encrypt traffic, does not eliminate DHCP usage, and is not a load-balancing mechanism.24. An organization wants to enforce that only known, authorized MAC addresses can transmit traffic on specific access ports, and that the switch should disable the port if a violation occurs. Which feature should be configured?
- A. Port security with a violation mode of shutdown
- B. 802.1Q trunking
- C. Root guard
- D. BPDU filtering
Show answer & explanation
Answer: A
Port security allows administrators to define allowed MAC addresses per port and specify a violation action; 'shutdown' mode err-disables the port when an unauthorized MAC is detected. Trunking configures VLAN tagging (unrelated to MAC restriction), root guard protects STP root placement, and BPDU filtering suppresses BPDU exchange, neither of which restricts MAC addresses.25. Which best describes the difference between authentication and authorization in an AAA (Authentication, Authorization, Accounting) framework?
- A. Authentication verifies who a user is; authorization determines what that user is permitted to do
- B. Authentication and authorization are the same process performed twice for redundancy
- C. Authorization verifies identity; authentication determines permitted actions
- D. Authentication only applies to wireless networks, authorization only to wired networks
Show answer & explanation
Answer: A
In AAA, authentication confirms a user's or device's identity (e.g., via credentials), while authorization determines the specific resources, commands, or privileges granted to that authenticated identity. The two are distinct sequential steps, not redundant duplicates, and both apply broadly across wired and wireless network access, not exclusively to one medium.26. A company wants remote employees to securely access internal resources over the public internet as if they were on the local network. Which technology is designed for this purpose?
- A. A VPN (Virtual Private Network) using protocols such as IPsec
- B. VLAN trunking between remote sites
- C. Spanning Tree Protocol
- D. CDP neighbor discovery
Show answer & explanation
Answer: A
A VPN, commonly using IPsec, creates an encrypted tunnel over the public internet so remote users can securely reach internal network resources as though locally connected. VLAN trunking extends VLANs across switches on the same administrative network (not designed for internet-based remote access), STP prevents Layer 2 loops, and CDP simply discovers directly connected Cisco devices—neither provides secure remote access.27. Which wireless security standard is considered insecure and should be avoided due to fundamentally broken encryption key handling?
- A. WPA3-Enterprise
- B. WPA2-AES (CCMP)
- C. WEP (Wired Equivalent Privacy)
- D. WPA2 with 802.1X
Show answer & explanation
Answer: C
WEP uses a static, easily-crackable RC4 key scheme with known cryptographic weaknesses, making it insecure by modern standards and unsuitable for production use. WPA2-AES and WPA2 with 802.1X use much stronger AES-based encryption and dynamic key derivation, and WPA3-Enterprise is the current strongest standard with forward secrecy, so none of these share WEP's vulnerabilities.28. A network automation script needs to retrieve structured configuration data from a router and modify a specific interface's description without manually parsing free-form CLI text output. Which approach is best suited for this task?
- A. Screen-scraping 'show running-config' output with regular expressions over an SSH session
- B. Using a model-driven API such as RESTCONF or NETCONF with structured data formats like YANG/JSON
- C. Manually telnetting into the device and typing commands interactively
- D. Relying solely on SNMP traps for configuration changes
Show answer & explanation
Answer: B
RESTCONF and NETCONF expose structured, model-driven (YANG-based) data that can be reliably queried and modified programmatically without fragile text parsing, making them the modern standard for network automation. Screen-scraping CLI output is fragile and error-prone, manual Telnet sessions aren't automatable and Telnet itself is insecure, and SNMP traps are event notifications, not a mechanism for making configuration changes.29. In network automation, what is the primary advantage of a declarative configuration management approach (e.g., stating desired end-state) over an imperative approach (e.g., a sequence of CLI commands)?
- A. Declarative approaches require the engineer to specify every step needed to reach the end state
- B. Declarative approaches let the engineer define the desired end state, and the tool determines how to achieve and maintain it, improving consistency and idempotency
- C. Declarative approaches only work with proprietary Cisco hardware
- D. Declarative approaches cannot be version controlled
Show answer & explanation
Answer: B
Declarative tools (e.g., Ansible playbooks describing desired state) let the automation engine figure out the necessary steps and reapply them idempotently, whereas imperative scripts require explicitly ordered commands and don't inherently guarantee the same end result if run repeatedly. Declarative tools are not limited to Cisco hardware, and configuration files (declarative or not) are commonly stored in version control systems like Git.30. A DevOps team wants to represent their network topology and VLAN assignments as version-controlled text files that automatically generate device configurations. Which practice does this describe?
- A. Infrastructure as Code (IaC)
- B. Port mirroring
- C. Spanning Tree PortFast
- D. Static NAT translation
Show answer & explanation
Answer: A
Infrastructure as Code treats network and infrastructure definitions as versioned, text-based artifacts (e.g., YAML or JSON) that drive automated configuration generation and deployment, enabling repeatability and change tracking. Port mirroring copies traffic for monitoring, PortFast speeds up STP transition on access ports, and static NAT maps a fixed IP translation—none relate to representing infrastructure as version-controlled code.31. Which data format is most commonly used by modern network automation tools (e.g., Ansible playbooks) due to its human-readable, indentation-based structure?
- A. YAML
- B. Binary ASN.1
- C. BGP MRT format
- D. 802.1Q tag format
Show answer & explanation
Answer: A
YAML's clean, indentation-based syntax makes it highly readable for humans while remaining machine-parsable, which is why tools like Ansible use it extensively for playbooks and variable files. Binary ASN.1 is a compact encoding used in protocols like SNMP (not human-friendly), MRT is a binary format for routing table dumps, and 802.1Q tagging is a Layer 2 frame format unrelated to automation data serialization.32. A candidate is preparing to schedule the CCNA 200-301 exam and wants to know how the exam is typically delivered. Which statement is accurate?
- A. It can only be taken at a Pearson VUE Authorized Test Center and never remotely
- B. It is delivered through Pearson VUE, either at an authorized test center or online via the OnVUE proctored service
- C. It is self-graded with no proctoring required
- D. It is delivered exclusively through a Cisco-owned testing platform unrelated to Pearson VUE
Show answer & explanation
Answer: B
Cisco uses Pearson VUE as its authorized delivery provider, offering the CCNA 200-301 both at physical test centers and remotely through the OnVUE online-proctored option with a live remote proctor. The exam is not self-graded or unproctored, and it is not delivered through a separate Cisco-only platform.33. A candidate wants to take the CCNA 200-301 exam remotely from home using OnVUE. What is the minimum internet connection speed required for this option?
- A. 1 Mbps download and 1 Mbps upload
- B. 6 Mbps download and 2 Mbps upload
- C. 25 Mbps download and 10 Mbps upload
- D. No minimum speed is required, only a stable connection
Show answer & explanation
Answer: B
OnVUE's published requirement is a minimum of 6 Mbps download and 2 Mbps upload speed to reliably support the live video proctoring and screen-sharing needed during the remote exam session. Lower speeds risk connection drops during proctoring, and there is a defined minimum rather than no requirement at all; the other listed speeds do not match the published minimum.34. A candidate is budgeting for CCNA certification and needs to know the current exam fee paid to Cisco's testing partner. Approximately how much does it cost to register for a single attempt at the CCNA 200-301?
- A. 150 USD
- B. 300 USD
- C. 500 USD
- D. 75 USD
Show answer & explanation
Answer: B
The CCNA 200-301 exam fee is 300 USD, paid to Pearson VUE, and this fee covers a single exam attempt; if the candidate fails, they must pay again to retake it (subject to Cisco's retake policy waiting periods). The other amounts do not reflect the published exam fee.35. After passing the CCNA 200-301 exam, how long does the resulting certification remain valid before recertification is required?
- A. 1 year
- B. 2 years
- C. 3 years
- D. 5 years
Show answer & explanation
Answer: C
The CCNA certification is valid for 3 years from the date it is earned, after which the holder must recertify by passing a current exam or meeting Cisco's continuing education requirements to maintain active status. The other durations do not match Cisco's published validity period for this certification.36. A candidate reviewing the CCNA 200-301 exam blueprint wants to prioritize study time toward the domain with the greatest weight on the exam. Which domain should receive the most attention based on official weighting?
- A. Security Fundamentals
- B. Network Access
- C. IP Connectivity
- D. Automation and Programmability
Show answer & explanation
Answer: C
IP Connectivity is weighted 25%, the highest among the six official domains, covering routing concepts, OSPF, and related topics, making it the domain deserving the greatest study emphasis. Security Fundamentals (15%), Network Access (20%), and Automation and Programmability (10%) are all weighted lower and should receive proportionally less study time.