Cisco · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A network team wants centralized logging and also wants log timestamps from different devices to line up accurately. Which combination best supports that goal?
Syslog and NTP
This is correct because Syslog centralizes log collection and NTP aligns timestamps across devices.
DHCP and STP
PAT and EtherChannel
ARP and CDP
Why is NTP especially valuable when a network uses centralized Syslog servers?
Because synchronized clocks make log timestamps easier to correlate across devices
This is correct because NTP improves the usefulness of centralized logs by aligning time.
Because NTP converts Syslog into a routing protocol
Because NTP automatically creates DHCP pools
Because NTP eliminates the need for a Syslog server
Why is NTP especially useful when devices send logs to a centralized Syslog server?
It helps align device clocks so centralized log timestamps can be correlated more accurately.
This is correct because consistent time improves the usefulness of centralized logs.
It assigns the Syslog server an IP address.
It replaces the need for a Syslog server.
It encrypts every Syslog message automatically.
Why is the combination of strong authentication and centralized logging generally better than using either one alone?
Authentication helps prevent unauthorized access, while centralized logging improves visibility and investigation.
This is correct because the two controls complement each other.
They are redundant because both perform exactly the same function.
Centralized logging makes authentication unnecessary.
Strong authentication removes the need for device event records.
Why is centralized logging especially useful when combined with NTP?
Because synchronized clocks make centralized log timelines easier to analyze accurately.
This is correct because NTP improves the usefulness of centralized logs by aligning timestamps.
Because NTP assigns the Syslog server its IP address.
Because Syslog replaces authentication when NTP is present.
Because centralized logging blocks unauthorized traffic automatically.
Why is the combination of strong authentication and centralized logging better than either control by itself?
Authentication improves prevention, while centralized logging improves visibility and investigation.
This is correct because the two controls complement each other.
They are redundant because both perform exactly the same task.
Centralized logging makes authentication unnecessary.
Strong authentication removes the need for any event records.
Want more IP Services practice?
Practice this domain15% of exam · 6 sample questions below
Two switches are connected by an 802.1Q trunk. CDP reports a native VLAN mismatch. Which issue is most likely to appear because of this?
Untagged traffic may be placed into different VLANs on each switch.
That is the classic symptom of a native VLAN mismatch.
All tagged traffic on the trunk is dropped immediately.
STP is disabled on the trunk link.
The trunk automatically converts to an access port.
Match each REST API method to the action it most closely represents in a typical network automation workflow.
R1 has the following routes installed:
O 10.10.10.0/24 via 192.0.2.2 S 10.10.10.128/25 via 198.51.100.2
S* 0.0.0.0/0 via 203.0.113.1
A packet destined for 10.10.10.200 arrives at R1. Which route is used?
The OSPF route to 10.10.10.0/24 via 192.0.2.2
The static route to 10.10.10.128/25 via 198.51.100.2
Longest prefix match makes the /25 win.
The default route via 203.0.113.1
The packet is dropped because OSPF routes cannot overlap with static routes.
A branch router has only one WAN link connected to an Ethernet handoff from the provider. Which static default route is generally the better choice?
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
ip route 0.0.0.0 0.0.0.0 198.51.100.1
A next-hop address is generally preferred on Ethernet provider handoffs.
ip route 255.255.255.255 255.255.255.255 198.51.100.1
No static default route should ever be used on Ethernet.
Match each DHCPv4 message in the DORA process to its role.
An engineer successfully authenticates to a controller and receives a token. What is the usual reason for including that token in later API requests?
To identify and authorize the client without resending full login credentials each time
That is the practical purpose of token-based API access.
To convert HTTP requests into SNMP traps
To elect the active controller in the cluster
To compress JSON payloads before transport
Want more Security Fundamentals practice?
Practice this domain10% of exam · 6 sample questions below
A network engineer sends an HTTP GET request to a controller API and receives status code 401. What does that response indicate?
The API endpoint does not exist
The request was successful but returned an empty body
Authentication is required or the token is invalid
Correct choice.
The server is overloaded and cannot process the request
Match each automation term to the best description.
Which data format is most commonly used in REST APIs because it is lightweight and easy for applications to parse?
YANG
JSON
Correct choice.
STP
TFTP
Which data format uses key-value pairs and is commonly returned by REST APIs?
YANG
JSON
JSON commonly represents API payloads.
Syslog
CDP
Which statement best describes YANG in a network automation context?
It is a transport protocol that replaces HTTPS
It is a data modeling language for configuration and operational data
That is the core purpose of YANG.
It is a Cisco-only scripting language for switch automation
It is a logging format used by telemetry collectors
Match each HTTP method to the action it most commonly performs in a REST API.
Want more Automation and Programmability practice?
Practice this domain20% of exam · 6 sample questions below
An interface is configured with 10.24.7.158/27. What is the broadcast address of that subnet?
10.24.7.159
Correct. It is the last address in the /27 block.
10.24.7.191
10.24.7.127
10.24.7.160
Which two statements accurately compare TCP and UDP? (Choose two.)
TCP provides connection-oriented transport
Correct. TCP is a connection-oriented transport protocol.
UDP guarantees delivery through acknowledgments
UDP has lower overhead than TCP
Correct. UDP generally has lower header and session-management overhead.
TCP does not use port numbers
UDP is always faster because it avoids congestion
Which medium is the most common choice for a 10G uplink between wiring closets on different floors of the same building?
Rollover cable
Fiber optic cable
Correct. Fiber is the standard uplink choice here.
Coaxial cable
Console cable
At which OSI layer do routers make forwarding decisions based on logical addressing?
Layer 1
Layer 2
Layer 3
Correct. Layer 3 is the network layer.
Layer 4
Which command enables IPv6 routing on a Cisco router?
ipv6 unicast-routing
Correct. This is the required global command.
ipv6 enable
ip routing ipv6
ipv6 route enable
A host sends traffic to a web server on another subnet. Which address is used as the destination MAC address in the first Ethernet frame sent by the host?
The MAC address of the remote web server
The MAC address of the local default gateway
Correct. The default gateway is the Layer 2 next hop for remote destinations.
The MAC address of the DNS server
The broadcast MAC address
Want more Network Fundamentals practice?
Practice this domainWhich spanning-tree port state listens for BPDUs and participates in STP, but does not learn MAC addresses yet?
Blocking
Listening
Correct. Listening occurs before learning and forwarding.
Learning
Forwarding
What is the main purpose of a VLAN on a switch?
To create a separate Layer 2 broadcast domain
Correct. VLANs create separate broadcast domains.
To encrypt user traffic on the switch
To increase the physical speed of switch ports
To replace the need for a default gateway
Switch SW1 sends traffic for VLAN 30 across a trunk to SW2, but hosts in VLAN 30 on SW2 cannot communicate with hosts in VLAN 30 on SW1. Other VLANs work across the trunk. Which trunk issue is most likely?
VLAN 30 is pruned or missing from the allowed VLAN list
Native VLAN settings can matter, but they do not best explain why other VLANs still work while VLAN 30 alone fails.
The native VLAN is set to 1 on both switches
The trunk uses 802.1Q encapsulation
SW1 is the STP root bridge
What is a common requirement for interfaces to successfully bundle into an EtherChannel?
All member interfaces must use matching speed, duplex, and trunk/access settings
Correct. Mismatched settings commonly prevent bundling.
Each interface must belong to a different VLAN
Only odd-numbered switch ports can be bundled
Each interface must have a different STP path cost
In a router-on-a-stick design, what is configured on the physical router interface connected to the switch?
One IP address for every VLAN on the physical interface itself only
No subinterfaces; the switch handles all inter-VLAN routing internally
Subinterfaces with 802.1Q encapsulation for each routed VLAN
Correct. Subinterfaces with dot1q encapsulation are the key configuration element.
A serial encapsulation setting for each VLAN
Which two functions are commonly handled by a wireless LAN controller in a controller-based deployment? (Choose two.)
Centralized management of lightweight APs
Correct. Centralized AP management is a core controller role.
Per-host DHCP address assignment on every WLAN
Policy enforcement for SSIDs and WLAN settings
Correct. Policy and WLAN settings are commonly centralized on the controller.
Providing STP root bridge election for the campus
Replacing all Layer 2 switching functions in the access layer
Want more Network Access practice?
Practice this domainA router learns route 198.51.100.0/24 from OSPF with AD 110 and also has a static route to the same prefix configured with AD 150. Which route is installed?
The static route, because static routes always win
The OSPF route, because 110 is lower than 150
Correct. OSPF is preferred here because AD 110 is lower than 150.
Both routes, because administrative distances are different
Neither route, because the static route is floating
A router output shows this neighbor state:
Neighbor ID 10.1.1.1 State FULL/DR Address 192.168.12.1
What does the FULL/DR state indicate?
The local router is the DR and adjacency formation has failed
The neighbor relationship is complete and the neighbor is the DR on that segment
Correct. The adjacency is complete, and that neighbor is acting as the DR.
The routers are exchanging only link-state requests
The neighbor has been learned through BGP redistribution
A router learns 10.10.10.0/24 from OSPF and EIGRP at the same time. OSPF reports a metric of 20, and EIGRP reports a metric of 30720. Which route is installed in the routing table by default?
The OSPF route, because 20 is lower than 30720
The EIGRP route, because its administrative distance is lower
Correct. EIGRP wins because its default administrative distance is lower than OSPF.
Both routes, because they point to the same prefix
Neither route, because the metrics are not comparable
A router shows this output:
R1#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.1.1.2 1 FULL/DR 00:00:34 192.168.12.2 GigabitEthernet0/0 10.1.1.3 1 2WAY/DROTHER 00:00:39 192.168.12.3 GigabitEthernet0/0
Which statement is correct?
R1 has failed to form adjacency with 10.1.1.3
This can be normal on a broadcast segment where DROTHER routers remain in 2-Way
Correct. This is normal DR/DROTHER behavior on many multiaccess networks.
R1 has a duplicate router ID with 10.1.1.3
The interface is passive
Which command correctly configures an IPv6 default route using next-hop address 2001:db8:1::1?
ipv6 route ::/0 2001:db8:1::1
Correct. This is the valid IOS syntax for an IPv6 default route.
ip route :: 2001:db8:1::1
ipv6 default-route 2001:db8:1::1
ip default-gateway 2001:db8:1::1
A routing table entry begins with the code C. What does that code indicate?
A route learned through EIGRP
A connected network
Correct. C means connected.
A candidate default route
A static route to a classful network
Want more IP Connectivity practice?
Practice this domainThe 200-301 exam has up to 1367 questions and must be completed in 120 minutes. The passing score is 825/1000.
The 200-301 exam uses multiple-choice, multiple-select, drag-and-drop, and exhibit-based questions. Exhibit questions show CLI output, network diagrams, or routing tables and ask you to interpret them — exactly the format Courseiva uses.
The exam covers 6 domains: IP Services, Security Fundamentals, Automation and Programmability, Network Fundamentals, Network Access, IP Connectivity. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Cisco 200-301 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.