Cisco 200-301 CCNA Exam Study Guide and Domain Plan

What Does the Cisco 200-301 CCNA Exam Cover?

Cisco 200-301, “Implementing and Administering Cisco Solutions,” is a 120-minute exam of roughly 90 to 110 questions costing $300 USD. It covers six weighted domains: Network Fundamentals (20%), Network Access (20%), IP Connectivity (25%), IP Services (10%), Security Fundamentals (15%), and Automation and Programmability (10%).

How Is the Exam Scored?

Cisco does not publish a fixed passing score. Scores are scaled, typically reported on a 1000-point scale with the threshold generally falling somewhere in the 800s, and the exact cut varies with form difficulty. The practical consequence is that you cannot compute a target – you prepare to be comfortably above the line rather than to clear a known number.

Domain Weightings at a Glance

Read that table before you read a single chapter. IP Connectivity, Network Fundamentals, and Network Access together account for 65 percent of the exam – routing, addressing, and switching remain the heart of the CCNA no matter how much the surrounding technology changes. The full objective list is published on the official CCNA exam topics page, and it is worth reading verbatim rather than through a third-party summary.

Why Does CCNA Still Matter in a Cloud-First Network?

CCNA remains relevant because cloud adoption changed where networks live, not whether they exist. Workloads moved into virtual private clouds that still require subnets, routing tables, access control, and NAT – so the 200-301 fundamentals transfer directly, even for engineers who may never rack a physical switch.

The Vocabulary Transfers to Every Cloud

A cloud engineer configuring a route table, a security group, and a NAT gateway is doing exactly what the CCNA teaches, under different product names. Engineers who skip the fundamentals and learn only one cloud provider’s console tend to hit a wall the moment something does not behave as the documentation promised, because they have no model of what is happening underneath.

“We still need those CCIEs. The experience they bring – understanding the planning, designing, implementing, and optimizing of any Cisco solution, is critical.”

Troubleshooting Is the Scarce Skill

Distributed systems fail in ways that look like application problems and turn out to be MTU, asymmetric routing, or a DNS resolver pointing somewhere unexpected. The ability to reason from the physical layer upward is not obsolete – it is scarcer, which makes it more valuable.

What has genuinely changed is the automation expectation, and Cisco reflected that by giving programmability its own weighted domain. Modern network roles assume you can read structured data and call an API, which is why the exam now includes REST concepts alongside spanning tree. Candidates planning a longer path often look at the CCNP Enterprise certification paths once the associate level is behind them.

Network Fundamentals: What Does the 20% Domain Test?

Network Fundamentals covers network components, topology architectures, physical interfaces and cabling, IPv4 and IPv6 addressing, subnetting, and wireless principles. At 20 percent it is roughly one fifth of the exam, and it is the domain where a weak foundation quietly costs marks across every other domain too.

Subnetting Is the Highest-Leverage Skill

Subnetting appears explicitly here and implicitly throughout IP Connectivity, and under exam time pressure you cannot afford to work it out longhand. The goal is instant recall: given an address and a prefix, state the network address, broadcast address, usable range, and host count without hesitation.

Do Not Treat IPv6 as an Afterthought

IPv6 deserves more respect than most candidates give it. Address types – global unicast, link-local, unique local, multicast – and the rules for abbreviating an address are reliable question material, and link-local behaviour in particular catches people who studied IPv6 late.

The Conceptual Marks Are Free

The rest of the domain is conceptual: what a switch does versus a router versus a firewall, how two-tier and three-tier campus designs differ, when to use single-mode versus multimode fibre. These are quick marks provided you have actually read them rather than assumed you know them from experience.

How Do VLANs and Wireless Fit Into Network Access?

Network Access covers VLANs and trunking, EtherChannel, spanning tree, wireless architectures, and access point configuration. Also worth 20 percent, this domain is where switching is tested – and it rewards candidates who have configured these features rather than only read about them.

VLANs and Trunking Come First

You need to configure access and trunk ports, understand what the native VLAN is and why a mismatch causes problems, and know how VLANs are carried between switches. Trunk negotiation and allowed-VLAN lists are common scenario material.

Spanning Tree Is the Most Underestimated Topic

Understand what problem it solves – a layer 2 loop will saturate a network in seconds because frames have no TTL to expire – and know how root bridge election works, what the port states mean, and how to influence the outcome with priority and cost. Questions frequently show a topology and ask which port blocks.

Wireless Now Tests Architecture

Wireless has grown in the syllabus and now covers architecture as much as configuration: autonomous versus controller-based deployments, AP modes, and the basics of connecting a WLC. You should be able to describe a client’s path from association through authentication onto the wired network.

IP Connectivity Is 25% – What Should You Master First?

IP Connectivity is the largest domain at 25 percent, covering the routing table, static routing, OSPFv2, and first-hop redundancy protocols. Master how a router selects a path before anything else, because that decision logic underpins every question in the domain.

Path Selection Follows a Strict Order

The exam tests this relentlessly. The longest prefix match wins first – a more specific route always beats a less specific one regardless of protocol. Only among routes of equal prefix length does administrative distance decide which source to trust, and only within a single protocol does metric break the remaining tie.

1. Longest prefix match – most specific route wins, always evaluated first
2. Administrative distance – trustworthiness of the source: connected 0, static 1, OSPF 110
3. Metric – used only to choose between routes from the same protocol

Learn OSPF Properly, Not Broadly

OSPF is the only dynamic routing protocol on the exam. Neighbour adjacency requirements, area concepts, router IDs, cost calculation, and the common reasons two routers refuse to form an adjacency – mismatched area, subnet, timers, or authentication – are all reliable question sources. The protocol is specified in RFC 2328, which is worth skimming for the state machine even though the exam will not quote it.

First-Hop Redundancy Rounds It Out

Understand the problem it solves – hosts have one default gateway and no mechanism to fail over – and how a virtual IP shared between routers resolves it.

Which IP Services Appear Most Often on the Exam?

IP Services covers NAT, NTP, DHCP, DNS, SNMP, syslog, QoS concepts, and remote access protocols. At 10 percent it is a smaller domain, but its topics are operationally ubiquitous, so questions tend to be practical rather than theoretical.

NAT Terminology Carries the Most Marks

NAT is the heaviest topic here and the one with the most confusing terminology. Learn the four address categories – inside local, inside global, outside local, outside global – as a matter of vocabulary discipline, because questions often present a translation table and ask you to identify which column is which. Static NAT, dynamic NAT, and PAT should each be distinguishable from a described scenario.

DHCP and DNS Are Tested for Troubleshooting

Know the DHCP message exchange in order, and understand why a relay agent is needed when the server sits on a different subnet – a broadcast will not cross a router unaided.

The Lighter Topics Still Appear

• NTP – correlated logs are useless with unsynchronised clocks
• Syslog – severity levels are worth memorising outright
• QoS – classification, marking, queuing, policing versus shaping, all conceptual

What Security Fundamentals Does CCNA Expect?

Security Fundamentals covers threat concepts, access control lists, device hardening, layer 2 security features, and wireless security. Worth 15 percent, it tests defensive configuration a network engineer would genuinely deploy rather than specialist security analysis.

“You can’t secure something if you don’t understand it. A security pro without a strong foundation in networking is trying to protect a house without knowing where the windows and doors are.”

Access Control Lists Are the Centre of the Domain

Three rules carry most of the marks:

1. Top-down evaluation – the list stops at the first match, so order changes the outcome
2. Implicit deny – every list ends with one, whether you wrote it or not
3. Placement – standard ACLs filter only on source and belong near the destination; extended ACLs match far more and belong near the source so unwanted traffic dies early

Layer 2 Security Is Distinctive CCNA Material

Port security limits which MAC addresses may appear on a port. DHCP snooping distinguishes trusted from untrusted ports so a rogue server cannot hand out addresses. Dynamic ARP Inspection builds on that snooping database to stop ARP spoofing. Understand the dependency: DAI relies on DHCP snooping being in place.

Wireless Security Has Consolidated

WPA2 and WPA3 dominate, and you should be able to distinguish personal from enterprise modes. Personal uses a shared passphrase; enterprise authenticates each user individually against a RADIUS server, which is why it dominates in corporate deployments.

How Much Programmability Does CCNA Actually Require?

Automation and Programmability is worth 10 percent and tests concepts rather than coding ability. You need to explain how automation changes network management, compare traditional and controller-based architectures, interpret JSON encoded data, and describe REST API characteristics – not write working scripts.

Most Candidates Misjudge This Domain

Engineers from a scripting background assume it will be harder than it is; traditional network engineers assume it will be impenetrable. In reality the bar is comprehension.

JSON Is the Concrete Skill

Given a block of JSON, you should be able to read a value out of a nested structure and recognise the difference between an object and an array. Questions typically show data and ask what a particular field contains.

Focus on the Conceptual Contrasts

• Controller-based networking centralises the control plane; traditional networking distributes it
• Configuration management tools push desired state rather than imperative commands
• REST uses HTTP verbs against resource URIs and returns structured data

Knowing why each exists matters more than knowing any product’s syntax.

How Should You Build a CCNA Lab?

A CCNA lab is non-negotiable, and it does not require physical equipment. Cisco Packet Tracer covers the overwhelming majority of 200-301 topics for free, and building configurations by hand is what converts memorised commands into the recall speed the exam demands.

Break Things on Purpose

Configuring a working OSPF adjacency teaches you the commands; deliberately mismatching the area, then the subnet mask, then the hello timer, and watching the adjacency fail each time teaches you what the exam actually tests. Scenario questions describe symptoms, not configurations.

1. Build it working – configure the feature until traffic passes and you understand each command
2. Break it deliberately – introduce one fault at a time and observe the symptom
3. Diagnose from output – use show and debug commands to identify the fault as if you had not caused it
4. Rebuild from memory – reconstruct the topology without notes a few days later

Weight Lab Time by Domain

VLANs and trunking, spanning tree, OSPF, ACLs, and NAT deserve repeated passes; QoS and automation concepts can be handled through reading. Time in the lab should track the weighting table, not your curiosity.

What Roles Does the CCNA Open?

CCNA maps most directly to network administrator, network engineer, NOC technician, and support engineer roles, and it functions as a recognised baseline for infrastructure positions generally. It is one of the few certifications hiring managers outside networking still recognise by name.

Its Strongest Use Is as a Credibility Bridge

Help desk staff moving toward infrastructure, systems administrators inheriting network responsibility, and career changers all benefit disproportionately, because CCNA is concrete evidence of specific knowledge rather than a claim of general aptitude. Candidates weighing the associate options often compare it against the security track first, and the 200-201 versus 200-301 comparison lays out where each one leads.

For Working Engineers, the Value Is Structure

Practical experience tends to be deep in whatever the employer runs and thin everywhere else, and the six domains expose those gaps. It also unlocks the professional-level tracks, where CCNP splits into enterprise, security, collaboration, and data centre specialisations.

Two Practical Notes

The certification is valid for three years and renewable through re-examination or continuing education credits, so treat it as a commitment rather than a one-off. Exams are scheduled through Pearson VUE’s Cisco programme, in a test centre or online with a proctor.

How Should You Structure a CCNA Study Plan?

Ten to twelve weeks at eight to ten hours per week suits most candidates with some IT background, and closer to sixteen weeks for complete beginners. Allocate study time in proportion to the published domain weightings, and spend at least half of every session in the lab rather than reading.

A Twelve-Week Sequence

1. Weeks one to three – fundamentals and addressing. Work through Network Fundamentals and drill subnetting daily until it is instant. Do not progress until IPv4 subnetting is automatic; everything downstream depends on it.
2. Weeks four to six – switching. Build VLANs, trunks, EtherChannel, and spanning tree in the lab. Break each one deliberately and diagnose the symptom.
3. Weeks seven to nine – routing. Static routing, then OSPF in depth, then first-hop redundancy. Practise reading a routing table and predicting which entry wins before checking.
4. Week ten – services and security. NAT, DHCP, DNS, NTP, then ACLs and layer 2 hardening. Write ACLs until placement and ordering are reflexive.
5. Weeks eleven to twelve – automation and review. Cover the programmability concepts, then move to timed full-length practice.

Two Habits That Separate Passes From Retakes

First, take timed practice exams early rather than saving them for the end – they diagnose weak domains far better than self-assessment does. Second, review the questions you answered correctly but guessed at, since those represent knowledge that will not survive a differently worded question. Working through the CCNA 200-301 practice exam under real time pressure reveals whether your pace matches the roughly 75 seconds per question the format allows.

The Cisco Learning Network community is a useful supplement for the topics that resist self-study, particularly spanning tree behaviour and OSPF adjacency troubleshooting.

Frequently Asked Questions

How many questions are on the CCNA 200-301 exam?

The exam contains roughly 90 to 110 questions in 120 minutes. The count varies by form, which works out to approximately 75 seconds per question including simulation items that take considerably longer.

What is the passing score for CCNA?

Cisco does not publish a fixed passing score. Results are scaled on a 1000-point scale with the threshold typically in the 800s, varying with form difficulty. Prepare to be comfortably above the line rather than targeting a specific number.

How much does the 200-301 exam cost?

The exam fee is $300 USD plus applicable taxes. Pricing varies by region, and Cisco periodically offers discounted vouchers through training partners and community programmes.

Are there prerequisites for CCNA?

There are no formal prerequisites. Cisco recommends around one year of experience implementing and administering Cisco solutions, but many candidates pass through structured self-study and lab practice without that background.

Which domain carries the most weight?

IP Connectivity at 25 percent is the largest single domain, covering routing tables, static routing, OSPFv2, and first-hop redundancy. Network Fundamentals and Network Access follow at 20 percent each.

Do I need physical Cisco equipment to prepare?

No. Cisco Packet Tracer is free and covers the overwhelming majority of 200-301 topics. Physical hardware or virtualised alternatives add realism but are not required to pass.

How much programming does the automation domain require?

None. The Automation and Programmability domain is worth 10 percent and tests concepts – interpreting JSON, describing REST API characteristics, and comparing controller-based with traditional architectures. You are not asked to write code.

Is OSPF the only routing protocol on the exam?

OSPFv2 is the only dynamic routing protocol you must configure. Static routing is also tested. EIGRP and BGP are not part of the current 200-301 objectives, so study OSPF in depth rather than routing protocols broadly.

How long is CCNA valid?

The certification is valid for three years. It can be renewed by passing an eligible exam or by earning continuing education credits through Cisco’s recertification programme.

How long does it take to prepare for CCNA?

Ten to twelve weeks at eight to ten hours per week is realistic for candidates with some IT background. Complete beginners should plan for around sixteen weeks, weighting the extra time toward subnetting and hands-on lab work.

Conclusion

Cisco 200-301 remains a demanding exam because it is broad rather than deep, and the published domain weightings are the most useful preparation tool you have. IP Connectivity, Network Fundamentals, and Network Access account for 65 percent between them – routing, addressing, and switching still decide whether you pass.

Build the lab early and use it to break things rather than only to build them. The exam describes symptoms and asks for causes, which is a skill you can only acquire by causing the symptoms yourself and watching what the output looks like.

Plan ten to twelve weeks, drill subnetting until it is reflexive, study OSPF properly rather than broadly, and take timed practice early enough that it can still change how you study. The CCNA has outlasted every technology shift that was supposed to retire it, and it does so because the fundamentals it tests are the ones that keep mattering.