The short version
This sheet is for the final days before the exam. It gives the facts at a glance, then the ideas that cause the most mistakes in each domain. It is a memory aid, not a full syllabus, and it does not cover everything on the exam. Learn the topics first from Cisco’s learning material and a lab; see the domains explained page for the full walk-through.
Exam facts at a glance
| Item | Fact (checked October 22, 2026) |
|---|---|
| Code and name | 200-301 CCNA, Implementing and Administering Cisco Solutions |
| Time | 120 minutes |
| Questions | Number not published on the pages we read |
| Passing score | Not published; pass or fail with a section breakdown |
| Retake after a fail | Five calendar days |
| Validity | Three years |
| v2.0 first testing date | February 3, 2027 (Cisco Press) |
| Domain (v2.0) | Weight |
|---|---|
| 1.0 Network Infrastructure and Connectivity | 25% |
| 2.0 Switching and Network Access | 25% |
| 3.0 IP Routing | 20% |
| 4.0 Network Services and Security | 20% |
| 5.0 AI, and Network Operations and Management | 10% |
Domain 1: Network infrastructure and connectivity
Key ideas
- Subnetting: block size is 256 minus the interesting octet of the mask. A /26 has blocks of 64, a /27 of 32, a /28 of 16.
- Usable hosts in a subnet is two to the power of host bits, minus two.
- Duplex mismatch shows as late collisions and errors on one side while the link stays up.
- Modified EUI-64: split the MAC address, insert FFFE in the middle, flip the seventh bit.
Easily confused pairs
- Network address is the first address in the block; broadcast is the last. Usable hosts sit between them.
- 2.4 GHz reaches farther and has fewer clean channels; 5 GHz has more channels and shorter range.
- A hypervisor runs virtual machines with their own operating systems; a container shares the host kernel.
Decision rules
- If a client has an address that does not match the expected subnet, think DHCP pool, relay, or a static setting first.
- If the gateway is outside the client’s subnet, nothing leaves the subnet.
- If a DHCP server sits on another subnet, think relay (helper address) on the client-side router interface.
Traps: asking for the highest usable address, not the broadcast; mixing up prefix length and mask.
Domain 2: Switching and network access
Key ideas
- A trunk carries many VLANs with 802.1Q tags; the native VLAN is untagged and must agree on both ends.
- LACP builds an EtherChannel; both sides need matching speed, duplex, and VLAN settings.
- A voice VLAN sits on an access port with a second VLAN, not on a trunk.
- Rapid PVST+ has root, designated, alternate, and backup roles.
Easily confused pairs
- PortFast skips the wait on edge ports. BPDU guard shuts a port that receives any BPDU.
- Root guard blocks superior BPDUs. Loop guard acts when BPDUs stop arriving.
- CDP is Cisco-specific; LLDP is the open standard.
Decision rules
- If an access port with PortFast suddenly goes err-disabled, think BPDU guard and a switch plugged in by mistake.
- If an EtherChannel will not come up, compare mode, speed, and allowed VLANs on both ends.
- If one VLAN cannot cross a trunk, check the allowed VLAN list.
Traps: forgetting the management SVI needs a default gateway to answer other subnets.
Domain 3: IP routing
Key ideas
- Longest prefix match wins first. Administrative distance only decides between routes to the same prefix from different sources.
- Lower administrative distance is more trusted. Connected is 0, static is 1, OSPF is 110.
- A floating static route has a higher administrative distance than the route it backs up.
- OSPF neighbors need matching area, hello and dead timers, and subnet; the router ID must be unique.
Easily confused pairs
- Metric compares routes within one protocol; administrative distance compares protocols.
- DR and BDR exist on broadcast networks, not on point-to-point links.
- HSRP and VRRP both give a virtual gateway; read the status output for active or master and standby or backup.
Decision rules
- If two routes cover the same destination, pick the longer mask first.
- If OSPF stays in INIT or EXSTART, check timers, MTU, and subnet masks.
Traps: reading the metric before the prefix length.
Domain 4: Network services and security
Key ideas
- Every ACL ends with an implicit deny. Standard ACLs match source only; extended ACLs add destination, protocol, and ports.
- Place standard ACLs close to the destination and extended ACLs close to the source.
- NAT: inside local is the private address; inside global is the translated one. PAT shares one address using ports.
- DHCP snooping builds a binding table that dynamic ARP inspection uses.
Easily confused pairs
- TACACS+ separates authentication, authorization, and accounting and uses TCP; RADIUS combines authentication and authorization and uses UDP.
- SFTP runs over SSH; plain FTP does not encrypt.
- Port security modes: protect drops silently, restrict drops and logs, shutdown disables the port.
- Site-to-site VPN joins networks; remote access VPN joins one user.
Decision rules
- If traffic works one way only, check ACL direction and placement.
- If a new rogue DHCP server hands out addresses, think DHCP snooping with trusted ports.
Traps: a permit that is correct but placed after a broader deny.
Domain 5: AI, and network operations and management
Key ideas
- Syslog severity runs from 0 (emergency) to 7 (debug). Setting a level includes all lower numbers.
- SNMP lets a manager poll or receive traps from devices; know the difference between a poll and a trap.
- Ansible describes the desired state in a playbook and pushes it to many devices.
- A good prompt for a generative AI tool names the task, the persona, the output format, and the data limits.
Easily confused pairs
- Device-based management is box by box; controller-based management uses a central controller.
- Agentic AI takes steps toward a goal; a plain chatbot answers a question.
Decision rules
- If an AI suggestion would change a device, check it against what you know about that device before accepting it.
- If a prompt would include secrets or customer data, the answer is to remove or classify that data first.
Last-day checklist
- Subnet a /27, /28, and /29 aloud without a calculator.
- Say the eight syslog levels from 0 to 7.
- Write an ACL, say where you would apply it, and say the direction.
- Read one routing table and name the next hop for three destinations.
- Name the three spanning tree guards and what each reacts to.
- Confirm your booking, ID, and the time of day. Our exam day guide has a longer list.
- Stop studying new topics. Sleep.
More guides for CCNA-200-301-V2
- CCNA 200-301 v2.0 Exam Format and Retakes
- Is CCNA 200-301 v2.0 Hard? An Honest Look
- CCNA 200-301 v2.0 Prerequisites and Skills
- CCNA 200-301 Renewal and Retakes Explained
- Is CCNA 200-301 Worth It? An Honest Look
- CCNA vs CCNA Automation: Which Exam First?
- CCNA vs Network+: Which Exam First?
Next step
Use this sheet with the sample questions and the study plan for your final days. For a full timed run with a score per domain, try the CCNA 200-301 v2.0 practice tests. The exam overview is at CCNA 200-301 v2.0 exam guide.