FREE CCNA Study Guide 2026: Cisco 200-301

This free CCNA study guide walks through every content domain the Cisco CCNA (200-301) exam tests, organized to the current Cisco exam topics (v1.1).^[1]

It’s interactive, not a wall of text: every module has built-in checkpoint quizzes, flashcards, and practice questions, so you learn by doing — not just reading.

The CCNA tests six official domains, and we teach them as six study modules, leading with the heaviest-weighted content (IP Connectivity is 25% of the exam, and the first three domains together are 65%). Read a module, test yourself at each checkpoint, then drill gaps with our free practice test and flashcards. This guide is a high-yield overview that maps the official exam topics — not a replacement for hands-on lab practice, which the simulation questions reward.

CCNA Exam Snapshot

The CCNA covers six domains. The three biggest — IP Connectivity, Network Fundamentals, and Network Access — together make up 65% of the exam, so that is where to invest first.^[1] Study by weight:

Module 1 · Network Fundamentals

One official domain, 20% of the exam. This is the foundation — the models, addressing, protocols, components, and media that everything else builds on. Master the OSI model and subnetting here and the rest of the exam gets dramatically easier.

1.1 The OSI Model & TCP/IP

The OSI model is the single most important framework on the exam — a seven-layer map of how data moves across a network. Each layer does one job and serves the layer above it, and the CCNA uses it as a troubleshooting tool: isolate a problem to a layer, then fix it there.^[13]

As data moves down the stack it undergoes Encapsulation: each layer wraps the data in its own header, producing a different PDU at each level — bits (L1), a frame (L2), a packet (L3), and a segment (L4). The receiving host de-encapsulates in reverse going up. The real internet runs on the leaner four-layer TCP/IP model, which maps directly onto the OSI layers.

At Layer 4, the two transport protocols are the most-tested distinction in the domain. TCP is connection-oriented and reliable — it opens a connection with the Three-way handshake (SYN → SYN-ACK → ACK), acknowledges data, and retransmits losses. UDP is connectionless and best-effort: no handshake, no acknowledgments, just speed.^[5]

1.2 IPv4 Addressing & Subnetting

An IPv4 address is 32 bits written as four octets. A Subnet mask (or its CIDR prefix, like /24) marks which bits are the network and which are the host. A device compares its mask against a destination to decide whether to deliver locally or send it to the Default gateway.

Subnetting breaks a network into smaller pieces. The exam-critical formula: usable hosts = 2ⁿ − 2 (n = host bits; you subtract the network address and the broadcast address). For a /26, there are 6 host bits, so 2⁶ − 2 = 62 usable hosts. VLSM lets you size each subnet to the hosts it needs by using different mask lengths.

Know your special ranges cold. Private IP (RFC 1918) ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are internal-only and reach the internet via NAT.^[3] An APIPA address (169.254.x.x) means a host couldn’t reach a DHCP server — a classic troubleshooting clue. And 127.0.0.1 (loopback) tests the local TCP/IP stack.

1.3 IPv6 Addressing

The CCNA expects real IPv6 fluency. An IPv6 address is 128 bits, written as eight groups of four hex digits. Abbreviate by dropping leading zeros in each group and replacing one run of all-zero groups with :: (only once). IPv6 has no broadcast — it uses multicast instead.

A host can build its 64-bit interface ID from its 48-bit MAC using Modified EUI-64 (insert FFFE in the middle and flip the 7th bit), or get a random/DHCPv6-assigned ID. Every IPv6 interface also has an automatic IPv6 link-local (FE80::) address used for on-link operations.

1.4 Components, Topologies & Cabling

Know what each device does: a Router (Layer 3) connects networks; a Switch (Layer 2) connects devices within one; next-generation firewalls and IPS inspect traffic; access points and a WLC serve wireless; and PoE powers devices over the data cable. Recognize the classic topologies — star, mesh, point-to-point, two-tier (collapsed core), three-tier, and spine-and-leaf.

On the physical side, know your media. Twisted-pair copper (Cat 5e/6/6a/8) is cheap but limited to ~100 m; single-mode fiber spans long distances with a laser, multimode covers shorter, high-speed runs. Watch for interface and cable faults: collisions, CRC errors, and a duplex/speed mismatch that quietly destroys throughput.

Module 2 · Network Access

One official domain, 20% of the exam. This is the Layer 2 switching world — VLANs and trunking, Spanning Tree, EtherChannel, and wireless. Expect configuration and simulation questions here.

2.1 VLANs & Trunking

A VLAN logically splits one switch into multiple broadcast domains — improving security and cutting broadcast traffic. An access port belongs to one VLAN; a Trunk carries many VLANs between switches, tagging frames with 802.1Q.^[10] The Native VLAN carries untagged traffic on a trunk. Devices in different VLANs need a router or Layer 3 switch (inter-VLAN routing) to communicate.

Switches discover neighbors with CDP (Cisco) or the standards-based LLDP. For a voice deployment, an access port can carry a data VLAN for a PC plus a voice VLAN for a daisy-chained IP phone.

2.2 Spanning Tree & EtherChannel

Redundant switch links create loops, so STP elects a Root bridge (lowest bridge ID), picks one root port per switch and one designated port per segment, and blocks the rest.^[11] Cisco’s Rapid PVST+ runs a fast per-VLAN instance, and PortFast plus BPDU Guard protect edge ports.

To use redundant links instead of blocking them, bundle them with EtherChannel — negotiated by the standard LACP (or Cisco’s PAgP). The bundle looks like one logical link to STP, so all the bandwidth is usable.

2.3 Wireless (WLC & APs)

Wireless follows the IEEE 802.11 family.^[12] Know the bands: 2.4 GHz gives longer range but only three non-overlapping channels (1, 6, 11); 5 GHz is faster with many channels; 6 GHz (Wi-Fi 6E/7) adds clean spectrum. An SSID is the network name.

Cisco wireless uses two architectures. Autonomous APs are configured individually; lightweight APs are centrally managed by a WLC over CAPWAP. You manage a WLC via console, SSH, or HTTPS, and create a WLAN in its GUI — setting the SSID, mapping it to a VLAN/interface, and choosing security (WPA2/WPA3) and a QoS profile.

Module 3 · IP Connectivity

One official domain, 25% of the exam — the single heaviest. This is routing: how a router reads its table, how routes are configured, and how OSPF and FHRP work. Master this domain and you have a quarter of the exam locked.

3.1 The Routing Table & Decisions

A router’s Routing table lists known networks with their prefix, mask, next hop, Administrative distance, and metric. When forwarding a packet, the router applies three tie-breakers in order: Longest prefix match (most specific wins), then administrative distance (between protocols), then the metric (within a protocol).^[1]

3.2 Static Routing

A Static route is configured by hand: ip route 10.0.0.0 255.0.0.0 192.168.1.2 (IPv4) or ipv6 route 2001:db8::/32 2001:db8:1::1 (IPv6). A Default route (ip route 0.0.0.0 0.0.0.0 <next-hop>) catches everything not matched more specifically. A Floating static route uses a higher AD so it only activates if the primary route fails.

3.3 OSPFv2 & FHRP

The dynamic protocol the CCNA tests in depth is single-area OSPFv2 — a fast link-state IGP that uses cost (based on bandwidth) as its metric.^[8] Routers form neighbor adjacencies by exchanging Hello packets and must agree on area, subnet, and Hello/Dead timers. Each router needs a unique OSPF router ID.

On broadcast/multiaccess segments OSPF elects a DR / BDR to limit the number of full adjacencies; on point-to-point links it forms an adjacency directly. Separately, an FHRP (HSRP, VRRP, or GLBP) gives hosts a redundant default gateway by sharing a virtual IP — so a router failure is invisible to clients.

Module 4 · IP Services

One official domain, 10% of the exam. These are the network services that make everything work day to day — address translation, time, naming, management, and quality of service.

4.1 NAT & NTP

NAT maps private (RFC 1918) addresses to public ones so internal hosts can reach the internet.^[9] The most common form is PAT (NAT overload), where many hosts share one public IP by tracking unique source ports. NTP keeps device clocks synchronized in a client/server, stratum-based hierarchy — vital so logs and certificates line up.

4.2 DHCP, DNS, SNMP & Syslog

DHCP auto-assigns IP, mask, gateway, and DNS via the DORA exchange (UDP 67/68); a DHCP relay (ip helper-address) forwards requests across subnets.^[6] DNS resolves names to IPs (UDP 53).^[7] SNMP monitors devices (poll UDP 161, traps UDP 162; use v3), and Syslog centralizes event logs (UDP 514) with severity levels 0–7.

4.3 QoS, SSH & File Transfer

QoS prioritizes latency-sensitive traffic. The exam covers per-hop behavior: classification, marking (DSCP), queuing, congestion management, and policing vs. shaping (policing drops/remarks excess; shaping buffers and delays it). For management, configure SSH (encrypted, TCP 22) instead of Telnet, and know TFTP (UDP 69) and FTP (TCP 20/21) for moving files and IOS images.

Module 5 · Security Fundamentals

One official domain, 15% of the exam. Security on the CCNA is about concepts, access control, Layer 2 protections, and wireless security — not deep cryptography.

5.1 Concepts, AAA & VPNs

Everything anchors to the CIA triad — Confidentiality, Integrity, and Availability — and the vocabulary of threats, vulnerabilities, exploits, and mitigations. Access is governed by AAA (Authentication, Authorization, Accounting), enforced by RADIUS or TACACS+, and strengthened by MFA and least privilege. A VPN (IPsec site-to-site or remote-access) protects traffic over untrusted networks.

5.2 ACLs & Layer 2 Security

An ACL is an ordered list of permit/deny rules processed top-down, first match wins, ending in an implicit deny. A standard ACL matches source IP only (place it near the destination); an extended ACL matches source, destination, protocol, and port (place it near the source). ACLs use a wildcard mask (0 = match, 1 = ignore).

Harden the access layer with Layer 2 controls: Port security limits MACs per port (violation actions: protect, restrict, shutdown); DHCP snooping blocks rogue DHCP servers; and Dynamic ARP Inspection stops ARP spoofing. Use WPA3 (or WPA2-AES) for wireless, and disable unused ports.

Module 6 · Automation & Programmability

One official domain, 10% of the exam. Modern networking is increasingly software-driven. The CCNA tests the concepts of automation, controller-based networking, REST APIs, JSON, and config tools — not deep coding.

6.1 SDN & Controller-Based Networking

SDN separates the Control plane (the brain that decides how to forward) from the Data plane (the muscle that forwards). A central controller programs many devices at once — replacing per-device CLI with centralized, policy-driven management.^[1] A software-defined architecture has an underlay (physical transport), an overlay (virtual fabric), and APIs in two directions.

The controller talks to applications through northbound APIs (often REST) and to devices through southbound APIs (e.g., NETCONF). Cisco DNA Center is Cisco’s intent-based controller for campus networks.

6.2 REST APIs, JSON & Config Tools

A REST API exchanges data over HTTP using URLs and verbs — GET (read), POST (create), PUT/PATCH (update), DELETE (remove), mapping to CRUD. REST is typically stateless, and responses are usually encoded in JSON — human-readable key/value pairs in objects {} and arrays [].

Configuration-management tools push consistent, version-controlled config: Ansible is agentless and uses YAML playbooks over SSH (push model), while Puppet and Chef use agents that typically pull config from a central server.

How to Use This CCNA Study Guide

This guide is built to be worked, not just read. The most efficient path to a pass:

• Study by weight. IP Connectivity (25%), Network Fundamentals (20%), and Network Access (20%) are 65% of the exam — master subnetting, the routing decision process, OSPF, VLANs, and STP first.
• Check off as you go. Use the Study Guide Contents to mark each section done; it raises your exam-readiness score.
• Take every checkpoint. The end-of-module quizzes show you exactly which domains need another pass.
• Drill the weak domain. Send your weak area into the flashcards and a practice test until the score climbs.
• Lab the simulations. The CCNA’s sim questions reward hands-on skill — subnet by hand, configure VLANs, static routes, and OSPF in a simulator until it’s automatic.

CCNA Glossary

The high-yield CCNA terms in one place — hover any dotted term in the guide, or flip the whole deck here as a self-grading flashcard set.

802.1Q

The IEEE standard that tags Ethernet frames with a VLAN ID so VLANs span trunk links between switches.

AAA

Authentication, Authorization, and Accounting — enforced by protocols such as RADIUS and TACACS+.

ACL

Access Control List — an ordered set of permit/deny rules filtering traffic by address, port, or protocol; ends with an implicit deny.

Administrative distance

A router's trust ranking of routing sources; lower is preferred when multiple protocols offer a route.

Ansible

An agentless configuration-management tool using YAML playbooks pushed over SSH (push model).

APIPA

Automatic Private IP Addressing — the 169.254.0.0/16 address a host self-assigns when no DHCP server responds; a DHCP-failure clue.

ARP

Address Resolution Protocol — maps a known IPv4 address to its MAC address on the local network.

CDP

Cisco Discovery Protocol — a Cisco proprietary Layer 2 protocol that discovers directly connected Cisco neighbors.

CIA triad

The core security goals: Confidentiality, Integrity, and Availability.

CIDR

Classless Inter-Domain Routing — slash notation (e.g., /24) showing how many leading bits are the network portion.

Cisco DNA Center

Cisco's controller for intent-based campus networking — central provisioning, automation, policy, and assurance.

Control plane

The 'brain' of a network device that decides how traffic should be forwarded (builds routing/switching tables).

Data plane

The 'muscle' of a network device that forwards traffic based on the control plane's decisions.

Default gateway

The router IP a host sends traffic to when the destination is on a different subnet.

Default route

A 'route of last resort' (0.0.0.0/0 for IPv4) used when no more specific route matches.

DHCP

Dynamic Host Configuration Protocol — auto-assigns IP, mask, gateway, and DNS via the DORA exchange; UDP 67/68.

DHCP snooping

Marks switch ports trusted/untrusted and drops rogue DHCP server replies on untrusted ports; builds a binding table.

DNS

Domain Name System — resolves names to IP addresses using a hierarchy of resolvers; mainly UDP 53.

DR / BDR

OSPF's Designated Router and Backup DR, elected on multiaccess links to reduce the number of adjacencies.

Dynamic ARP Inspection

Validates ARP packets against the DHCP snooping binding table, blocking ARP spoofing / on-path attacks.

Encapsulation

Wrapping data with each layer's header as it moves down the stack (segment → packet → frame → bits); reversed (de-encapsulation) going up.

EtherChannel

Bundling multiple physical links into one logical link for more bandwidth and redundancy.

FHRP

First Hop Redundancy Protocol (HSRP/VRRP/GLBP) — provides a redundant default gateway via a shared virtual IP.

Floating static route

A backup static route with a higher administrative distance that activates only if the primary route fails.

IPv4 address

A 32-bit logical address written as four dotted-decimal octets (e.g., 192.168.1.10), split into network and host portions by a subnet mask.

IPv6 address

A 128-bit logical address written as eight groups of four hexadecimal digits, separated by colons.

IPv6 global unicast

A publicly routable IPv6 address, typically in the 2000::/3 range.

IPv6 link-local

An automatically configured FE80::/10 address used only on the local link (e.g., for neighbor discovery).

JSON

JavaScript Object Notation — human-readable data as key/value pairs in objects {} and arrays [].

LACP

Link Aggregation Control Protocol (IEEE 802.1AX/802.3ad) — the standard that negotiates an EtherChannel.

Lightweight AP

An access point that relies on a WLC for configuration and management (split-MAC, via CAPWAP).

LLDP

Link Layer Discovery Protocol — the vendor-neutral (IEEE 802.1AB) equivalent of CDP.

Longest prefix match

A router forwards using the most specific matching route — the one with the longest matching network mask.

MAC address

A 48-bit hardware address burned into a NIC, used for Layer 2 delivery on the local link.

Modified EUI-64

A method that builds the 64-bit IPv6 interface ID from a 48-bit MAC by inserting FFFE and flipping the 7th bit.

NAT

Network Address Translation — maps private addresses to public ones; PAT (overload) shares one public IP across many hosts using ports.

Native VLAN

The one VLAN whose traffic is sent untagged on an 802.1Q trunk (default VLAN 1; change it for security).

NTP

Network Time Protocol — synchronizes device clocks in a client/server, stratum-based hierarchy; UDP 123.

OSI model

A seven-layer conceptual framework (Physical, Data Link, Network, Transport, Session, Presentation, Application) describing how data moves across a network.

OSPF

Open Shortest Path First — a fast, link-state interior gateway protocol that uses cost as its metric within an autonomous system.

OSPF router ID

A 32-bit identifier for an OSPF router — chosen manually, then by highest loopback IP, then highest active interface IP.

PAT

Port Address Translation — NAT overload: many private hosts share one public IP, distinguished by source port numbers.

PDU

Protocol Data Unit — the name for data at a given OSI layer: bits (L1), frame (L2), packet (L3), segment (L4).

Port security

A switch feature limiting the MAC addresses learned on an access port; violation actions are protect, restrict, or shutdown.

PortFast

Puts an access port straight into forwarding, skipping STP listening/learning — for end-device ports only.

Private IP (RFC 1918)

Non-internet-routable ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, used internally and translated by NAT.

QoS

Quality of Service — classifies and marks traffic so latency-sensitive flows (voice, video) get preferential queuing.

RADIUS

An open AAA protocol (UDP) that encrypts only the password and combines authentication and authorization; common for network access.

REST API

An application interface over HTTP using URLs and verbs (GET/POST/PUT/DELETE = CRUD); usually stateless, often JSON-encoded.

Root bridge

The STP switch with the lowest bridge ID (priority + MAC); the reference point of the spanning tree.

Router

A Layer 3 device that forwards packets between different networks using IP addresses and a routing table.

Routing table

The list of known networks a router uses to forward packets: prefix, mask, next hop, AD, and metric.

SDN

Software-Defined Networking — separates the control plane from the data plane, managing the network centrally via a controller.

SNMP

Simple Network Management Protocol — monitors and manages devices; manager polls UDP 161, agents send traps on UDP 162. Use v3 for security.

SSH

Secure Shell — encrypted remote CLI access (TCP 22) that replaces clear-text Telnet for device management.

SSID

Service Set Identifier — the human-readable name of a wireless network.

Static route

A manually configured route; predictable but does not adapt automatically to topology changes.

STP

Spanning Tree Protocol — prevents Layer 2 loops by electing a root bridge and blocking redundant paths; Rapid PVST+ converges faster.

Subnet mask

A value that marks which bits of an IP address are the network portion (1s) and which are the host portion (0s).

Subnetting

Dividing a network into smaller subnetworks; usable hosts = 2ⁿ − 2, where n is the number of host bits.

Switch

A Layer 2 device that forwards frames within a network using MAC addresses and a MAC address table.

Syslog

A protocol for sending log messages to a central server (UDP 514) with facility and severity levels (0 Emergency – 7 Debugging).

TACACS+

A Cisco AAA protocol (TCP 49) that encrypts the whole payload and separates AAA functions; preferred for device administration.

TCP

Transmission Control Protocol — a connection-oriented, reliable Layer 4 protocol using a three-way handshake, acknowledgments, and retransmission.

TCP/IP model

The practical four-layer model (Link, Internet, Transport, Application) that the internet actually runs on; maps onto the OSI layers.

Three-way handshake

TCP's connection setup: SYN, then SYN-ACK, then ACK.

Trunk

A switch link that carries traffic for multiple VLANs (tagged with 802.1Q); the native VLAN carries untagged traffic.

UDP

User Datagram Protocol — a connectionless, best-effort Layer 4 protocol with low overhead; used for DNS, DHCP, VoIP, and TFTP.

VLAN

Virtual LAN — a logical Layer 2 segment that splits one switch into multiple broadcast domains; tagged with 802.1Q.

VLSM

Variable Length Subnet Masking — using different mask lengths within one network so each subnet is sized to its host count.

VPN

Virtual Private Network — an encrypted tunnel (IPsec or SSL/TLS) carrying private traffic over a public network.

WLC

Wireless LAN Controller — centrally manages lightweight access points, pushing configuration, security, and RF settings.

WPA3

The current Wi-Fi security standard; uses SAE to resist offline password guessing and adds forward secrecy. WPA2 (AES) is the older minimum.

CCNA Study Guide FAQ

References

1. 1.Cisco. “CCNA 200-301 Exam Topics (v1.1).” learningnetwork.cisco.com. ↑
2. 2.Cisco. “CCNA Certification overview.” cisco.com. ↑
3. 3.Internet Engineering Task Force. “RFC 1918 — Address Allocation for Private Internets.” rfc-editor.org. ↑
4. 4.Internet Engineering Task Force. “RFC 791 — Internet Protocol.” rfc-editor.org. ↑
5. 5.Internet Engineering Task Force. “RFC 9293 — Transmission Control Protocol.” rfc-editor.org. ↑
6. 6.Internet Engineering Task Force. “RFC 2131 — Dynamic Host Configuration Protocol.” rfc-editor.org. ↑
7. 7.Internet Engineering Task Force. “RFC 1034 — Domain Names: Concepts and Facilities.” rfc-editor.org. ↑
8. 8.Internet Engineering Task Force. “RFC 2328 — OSPF Version 2.” rfc-editor.org. ↑
9. 9.Internet Engineering Task Force. “RFC 3022 — Traditional IP Network Address Translator (NAT).” rfc-editor.org. ↑
10. 10.Institute of Electrical and Electronics Engineers. “IEEE 802.1Q — Bridges and Bridged Networks (VLANs).” standards.ieee.org. ↑
11. 11.Institute of Electrical and Electronics Engineers. “IEEE 802.1D — MAC Bridges (Spanning Tree).” standards.ieee.org. ↑
12. 12.Institute of Electrical and Electronics Engineers. “IEEE 802.11 — Wireless LAN MAC and PHY Specifications.” standards.ieee.org. ↑
13. 13.ISO/IEC. “ISO/IEC 7498-1 — OSI Basic Reference Model.” iso.org. ↑
14. 101.Internet Engineering Task Force (IETF). “RFC 768 — User Datagram Protocol.” rfc-editor.org, accessed 19 June 2026. ↑
15. 102.Institute of Electrical and Electronics Engineers (IEEE). “IEEE 802.1AX — Link Aggregation (LACP).” standards.ieee.org, accessed 19 June 2026. ↑

Career Employer

Career Employer is the ultimate resource to help you get started working the job of your dreams. We cover topics from general career information, career searching, exam preparation with free study materials, career interviewing, and becoming successful in your career of choice.

Follow Us:

All Posts