The short version
CCNA v2.0 has five domains: two at 25%, two at 20%, and one at 10%. The first four are classic networking and make up 90% of the exam. This page follows Cisco’s v2.0 exam topics document (copyright 2026, read October 18, 2026). Cisco says the list is a general guide, that related topics may appear, and that it can change without notice. Check the current document before you sit.
1.0 Network Infrastructure and Connectivity (25%)
What it covers
Diagnosing interface and cable faults on copper and fiber (collisions, errors, duplex and speed mismatch, distance, signal levels, pinouts, cable types). The role of hypervisors, virtual machines, and containers. Troubleshooting IPv4 addressing and subnetting, and IPv6 addressing and prefix sizing, including unicast and modified EUI-64. Wireless principles: band and channel selection, RF characteristics, security protocols, interference. Troubleshooting wired and wireless client connectivity on Windows, macOS, and Linux. Troubleshooting DHCPv4 client, server, and relay on IOS devices.
Typical traps
- A gateway outside the client’s subnet. A DHCP pool can hand out an address with a gateway the client cannot reach.
- Subnet questions that ask for the highest or lowest usable address, not the network or broadcast address.
- Duplex mismatch shows as late collisions and errors on one side, while the link still looks up.
- Modified EUI-64 has two steps: insert FFFE in the middle, and flip the universal/local bit.
- On a relay, the DHCP server needs a pool that matches the relay interface address, not the server’s own subnet.
What to practice
Subnet a /27, /28, and /29 in your head. Read `show interfaces` counters. Configure a DHCP pool, break it, and fix it. Learn what each Wi-Fi band is good and bad at.
2.0 Switching and Network Access (25%)
What it covers
Configuring switch-to-switch and switch-to-router connectivity: Layer 2 and Layer 3 interfaces, 802.1Q trunks, LACP EtherChannel, and SVIs. Configuring edge ports for desktops, printers, IoT, access points, IP phones, virtualized hosts, and network appliances (VLAN, PoE, port channels, LACP). Validating network documentation with CDP and LLDP. Troubleshooting Layer 2 and Layer 3 connectivity with show commands (including logs), ping, extended ping, traceroute, and packet capture output. Rapid PVST+: root port and bridge roles, port states and roles, PortFast, root guard, loop guard, and BPDU guard.
Typical traps
- Voice VLAN lives on an access port with a second VLAN; it is not a trunk.
- BPDU guard reacts to any BPDU. Root guard reacts only to superior BPDUs. Loop guard reacts to BPDUs that stop arriving.
- An EtherChannel needs matching settings on both ends; a mode mismatch leaves it down.
- A Layer 2 switch with a management SVI needs a default gateway to answer other subnets.
- The native VLAN on a trunk must agree on both sides.
What to practice
Build a three-switch lab with two VLANs, a trunk, and an EtherChannel. Break spanning tree on purpose. Read `show spanning-tree`, `show etherchannel summary`, and `show interfaces trunk` until the columns feel familiar.
3.0 IP Routing (20%)
What it covers
Interpreting a routing table to find the next hop: routing protocol, prefix and mask, administrative distance, metric, and default route. Troubleshooting IPv4 and IPv6 static routing: default, network, host, and floating static routes. Configuring single-area OSPFv2 for IPv4 and OSPFv3 for IPv6: neighbor adjacencies (without authentication), point-to-point and broadcast networks, DR and BDR selection, router ID. Interpreting the operational status of HSRP and VRRP.
Typical traps
- The most specific prefix wins first. Administrative distance only compares routes to the same prefix from different sources.
- A floating static route needs an administrative distance higher than the route it backs up.
- OSPF neighbors fail over mismatched hello and dead timers, area IDs, subnet masks, or network types.
- DR and BDR are elected only on broadcast-type networks, not on point-to-point links.
- VRRP and HSRP differ on defaults, for example preemption.
What to practice
Read routing tables line by line: what are the codes, the AD and metric pair, and the next hop? Configure OSPF on three routers and check `show ip ospf neighbor`. Write a floating static and test failover.
4.0 Network Services and Security (20%)
What it covers
Local usernames and AAA client configuration with TACACS+ and RADIUS for device management. Secure file transfer with SFTP and SCP. NAT and PAT on IOS XE routers. Diagnosing DNS records (A, AAAA, CNAME, MX, NS, PTR). Describing IPsec remote access and site-to-site VPNs. Standard, extended, numbered, and named IPv4 ACLs. Layer 2 security: DHCP snooping, dynamic ARP inspection, storm control, RA guard, and port security.
Typical traps
- Every ACL ends with an implicit deny.
- Standard ACLs match source only. Extended ACLs match source, destination, protocol, and ports.
- ACL direction and placement change the result, even when the entries are right.
- In `show ip nat translations`, inside local is the private address and inside global is the translated one.
- Port security violation modes behave differently: protect, restrict, and shutdown.
- RADIUS and TACACS+ use different transports and ports.
What to practice
Write an ACL, apply it, and test it from both sides. Configure PAT and read the translation table. Turn on DHCP snooping and watch it block a rogue server.
5.0 AI, and Network Operations and Management (10%)
What it covers
The role of agentic AI in network operations. Selecting a prompt for a generative AI system, considering data classification, output format, persona, and instructions. Network management approaches: device-based, cloud-based, controller-based, automation-based, and infrastructure as code. The function of SNMP. Configuration management with Ansible. Syslog message content, severity levels, and facilities.
Typical traps
- Syslog severity numbers run backward: 0 is the most severe. A trap level includes all levels with lower numbers.
- Ansible describes what to run; do not confuse that with device-by-device CLI access.
- A good prompt protects sensitive data. Pasting confidential configuration into an AI system is a classification problem.
- An AI recommendation can look plausible and still be wrong for the device. Check it against what you know.
What to practice
Memorize the eight syslog levels. Write a prompt that names the persona, the task, the format, and the data limits. Read a simple Ansible playbook and say what it changes.
Putting the weightings to work
Domains 1 and 2 together are half the exam, so subnetting, trunks, and spanning tree deserve the most hours. Domain 5 is only 10%, but its AI topics (agentic AI, prompt choice) are unlike anything in classic networking study material, so give it a focused weekend. Your study plan divides the weeks along these lines.
More guides for CCNA-200-301-V2
- CCNA 200-301 v2.0 Exam Format and Retakes
- Is CCNA 200-301 v2.0 Hard? An Honest Look
- CCNA 200-301 v2.0 Prerequisites and Skills
- CCNA 200-301 Renewal and Retakes Explained
- Is CCNA 200-301 Worth It? An Honest Look
- CCNA 200-301 v2.0 Cheat Sheet: Key Facts
- CCNA vs CCNA Automation: Which Exam First?
- CCNA vs Network+: Which Exam First?
Next step
Test yourself on a domain with the sample questions, then use the full CCNA 200-301 v2.0 practice tests for a score per domain.
Frequently asked questions
Which domain is the hardest?
It depends on your background. Many people find troubleshooting and show-output reading in domains 1 to 3 demanding, while the AI domain is mostly vocabulary and judgment.
Are the percentages exact?
Cisco publishes them as domain weightings. The number of questions each domain gets in one exam is not published.