The 200-301 blueprint is split across 6 domains. Weights are the official share of the exam; see the official exam guide for the authoritative breakdown.
What you must be able to do. Identify what each network device does, subnet IPv4 and IPv6 correctly by hand, and explain switching and transport behaviour well enough to predict what a frame or segment does next.
In one sentenceThe foundation the rest of the exam stands on: device roles and topologies, IPv4 and IPv6 addressing and subnetting, how a switch learns and forwards frames, and TCP versus UDP.
Recall check: answer these from memory first
- For 192.168.10.0/27, give the broadcast address, the usable host range, and the number of usable hosts.
- Derive the modified EUI-64 interface identifier from MAC 00:1A:2B:3C:4D:5E, in order, including the bit you flip.
- State what a switch does with a known-unicast frame, an unknown-unicast frame, and a broadcast frame.
What it tests. The building blocks: the role of routers, Layer 2 and Layer 3 switches, next-generation firewalls and IPS, access points, controllers, and PoE, and two-tier, three-tier, and spine-leaf designs. The heaviest part is IPv4 subnetting and VLSM plus IPv6 addressing, prefixes, address types, and modified EUI-64. It also covers how a switch builds its MAC address table, floods unknown-unicast and broadcast frames, and ages entries, and how connection-oriented TCP differs from connectionless UDP.
How to study it. Make subnetting automatic before anything else, because it underpins routing, ACLs, and OSPF. Drill until you can produce the network address, broadcast address, usable range, and host count for any prefix in seconds, and remember that the network and broadcast addresses are never usable hosts. Practise IPv6 compression and modified EUI-64 by hand (split the MAC, insert FFFE, flip the seventh bit of the first byte). Learn the switch forwarding logic as a decision: known unicast goes out one port, unknown unicast and broadcast flood the VLAN.
Easy to confuse
- Usable hosts versus total addresses in a subnet. Total addresses are 2 to the power of the host bits; usable hosts are that minus two, because the network address and the broadcast address cannot be assigned to a device. The exam plants a distractor that forgets to subtract the two, so a /27 shows 32 or 31 instead of 30.
- TCP versus UDP. TCP is connection-oriented with a three-way handshake, sequencing, acknowledgements, and retransmission; UDP is connectionless with none of that and lower overhead. Match the requirement: reliable file transfer or web is TCP, low-latency voice, video, and DNS lookups favour UDP.
- Link-local versus global unicast IPv6. Link-local addresses start fe80::/10 and are never forwarded off the link; global unicast addresses begin 2000::/3 and are routable on the internet. A frame sourced from fe80:: cannot be the answer to a question about routed reachability.
Worked example from the 200-301 bank
lock_openFree sampleNetwork Fundamentalshard
A host is automatically configuring a link-local IPv6 address with no router present on the segment. Which prefix identifies the address it generates, and what is the defining property of that address?
- Afe80::/10, valid only on the local link and never forwarded by a routercheck_circle Correct
- Bfc00::/7, routable within a single organisation but not on the public internet
- C2000::/3, globally routable and reachable across the public internet
- Dff00::/8, delivered to every interface that has joined the group
Identify the fe80::/10 link-local prefix and recognise that link-local traffic is never forwarded beyond the local link. Every IPv6 interface generates a link-local address from fe80::/10 for on-link functions such as neighbour discovery, and routers are required never to forward packets whose source or destination is link-local, so the address scope is exactly one link.
Why A is correct: Link-local addresses always come from the fe80::/10 range and an IPv6 router never forwards them off the link, so they remain confined to the local segment - this is the defining property the question asks for.
Why B is wrong: fc00::/7 is the unique local address (ULA) range, which is site-scoped and can be routed between internal subnets; it is not the prefix a host self-assigns for link-local communication, so it is the wrong classification here.
Why C is wrong: 2000::/3 is the global unicast range used for internet-reachable addresses; a host cannot mint a globally routable address without a router advertisement supplying the prefix, so this does not describe the no-router self-configured address.
Why D is wrong: ff00::/8 is the multicast range used for one-to-many delivery, not a unicast address a single host assigns to its own interface; it is a tempting confusion because both are auto-derived, but it is not link-local.
What you must be able to do. Configure VLANs and 802.1Q trunks across switches, bundle links with EtherChannel, predict spanning-tree elections and port states, and read a controller-based wireless setup.
In one sentenceThe switched access layer: VLANs and trunking, CDP and LLDP, EtherChannel with LACP, Rapid PVST+ spanning tree, and Cisco wireless architectures.
Recall check: answer these from memory first
- Given four switches with stated priorities and MAC addresses, say which becomes the root bridge and why.
- State what travels untagged on an 802.1Q trunk and what breaks if the two ends disagree on it.
- Name the LACP mode combinations that form an EtherChannel and the one combination that never does.
What it tests. Segmenting a network with VLANs, carrying them between switches over an 802.1Q trunk with a native VLAN, and configuring access ports for data and voice. It covers discovering neighbours with CDP and LLDP, bundling links into an EtherChannel with LACP, and the operation of Rapid PVST+: root-bridge and root-port election, port roles and states, and PortFast. It also covers Cisco wireless architectures, AP modes, WLC connections, and reading a WLAN GUI.
How to study it. Treat spanning tree as an election with a fixed tie-break chain and practise it until it is mechanical: the root bridge is the lowest bridge ID (priority then MAC), each non-root switch picks the root port by lowest cumulative path cost, and the rest become designated or blocking. Memorise the short-mode path costs (100 Mbps is 19, 1 Gbps is 4, 10 Gbps is 2). For VLANs, internalise that the native VLAN crosses an 802.1Q trunk untagged and that a native-VLAN mismatch on the two ends breaks connectivity. For EtherChannel, know which LACP mode combinations form a bundle.
Easy to confuse
- Root bridge election versus root port selection. The root bridge is chosen network-wide by the lowest bridge ID (priority, then MAC); the root port is chosen per non-root switch by the lowest cumulative path cost to that root. One is a global election, the other a per-switch decision, and the exam swaps them.
- Access port versus trunk port and the native VLAN. An access port carries one VLAN untagged; a trunk carries many VLANs, tagging all except the native VLAN. The trap is forgetting that the native VLAN is the one untagged VLAN on the trunk, so a native-VLAN mismatch silently merges two VLANs.
- LACP active or passive, and which pairs form a bundle. Active initiates LACP negotiation; passive only responds. Active-active and active-passive form an EtherChannel, but passive-passive never does because neither side initiates. The exam offers passive-passive as the bundle that quietly fails.
Worked example from the 200-301 bank
lock_openFree sampleNetwork Accessmedium
Two switches are joined by an 802.1Q trunk. One switch is configured with native VLAN 1 on the trunk, the other with native VLAN 99. Spanning tree and CDP are running. What is the consequence of this configuration?
- AThe trunk forms normally and all VLANs pass, because the native VLAN only affects which VLAN carries management traffic and never the forwarding of user data.
- BThe trunk is administratively shut down by the switch as soon as the mismatch is detected through CDP, requiring a manual no shutdown to recover.
- CTraffic from the two native VLANs is merged so that frames in VLAN 1 on one side arrive in VLAN 99 on the other, creating a security and reachability problem.check_circle Correct
- DOnly VLAN 99 is permitted across the link, because the higher native VLAN number always takes precedence and prunes the lower-numbered native VLAN.
Understand that an 802.1Q native VLAN mismatch leaks traffic between the two native VLANs rather than disabling the trunk. On an 802.1Q trunk the native VLAN is the one VLAN sent without a tag. A receiving switch assigns any untagged frame to its own configured native VLAN. When the two ends disagree, untagged frames from VLAN 1 on one side are absorbed into VLAN 99 on the other, bridging the two VLANs together; the link stays up while data crosses VLAN boundaries.
Why A is wrong: It is tempting because a native-VLAN mismatch does not bring the physical link down, but the mismatch does affect user data: untagged frames leak between the two different native VLANs.
Why B is wrong: CDP does log a native VLAN mismatch notice, but Cisco switches do not err-disable or shut the trunk for this; the port stays up and continues forwarding, which is what makes the problem subtle.
Why C is correct: Each switch sends its native-VLAN traffic untagged, and the neighbour places received untagged frames into ITS own native VLAN, so VLAN 1 and VLAN 99 traffic is bridged together across the link.
Why D is wrong: There is no rule that a higher native VLAN number wins or prunes another VLAN; native VLAN selection is purely about which VLAN is sent untagged, so this invented precedence is wrong.
What you must be able to do. Read a routing table and predict the chosen route, configure IPv4 and IPv6 static and floating-static routes, bring up single-area OSPFv2, and explain first-hop redundancy.
In one sentenceHow routers choose paths: the routing table and the longest-prefix-match, administrative-distance, metric order; static and floating-static routes; single-area OSPFv2; and HSRP.
Recall check: answer these from memory first
- List the order a router uses to choose between candidate routes, and say which factor wins when a /24 and a /16 both match.
- Give the default administrative distance for connected, static, eBGP, EIGRP internal, OSPF, and RIP.
- State when OSPF elects a DR and BDR, when it does not, and the two-step tie-break that decides the DR.
What it tests. Interpreting a routing table and applying the default forwarding logic in order: longest prefix match first, then administrative distance between sources, then metric within a source. It covers IPv4 and IPv6 static routing including default, host, and floating-static routes, single-area OSPFv2 (neighbor adjacencies, point-to-point versus broadcast network types, DR and BDR election, and the router ID), and the purpose and operation of a first-hop redundancy protocol such as HSRP.
How to study it. Drill the forwarding decision as a strict sequence: a more specific prefix always wins regardless of administrative distance, administrative distance only breaks a tie between sources for the same prefix, and metric only breaks a tie within one protocol. Memorise the administrative-distance defaults. For OSPF, learn that a DR and BDR are elected only on broadcast or multi-access segments, never on point-to-point links, by highest priority then highest router ID, and how the router ID is chosen when not set. For HSRP, learn the active/standby roles, priority, and preemption.
Easy to confuse
- Administrative distance versus metric. Administrative distance ranks the trustworthiness of different route sources for the same prefix; metric ranks routes within a single protocol. A lower administrative distance wins between OSPF and RIP; a lower metric wins between two OSPF paths. The exam swaps the two.
- Longest prefix match versus administrative distance. The most specific matching prefix is selected first, before administrative distance is even considered. A /32 host route via RIP beats a /24 via OSPF for that host, because specificity outranks trust. The trap is letting a lower administrative distance override a longer prefix.
- OSPF DR election versus router-ID selection. The DR is elected per broadcast segment by highest OSPF priority then highest router ID; the router ID itself is chosen once per router (manual, then highest loopback IP, then highest active interface IP). The exam blurs the segment-level election with the device-level ID choice.
- Floating static route versus a normal static route. A floating static route is a static route given a higher administrative distance so it stays out of the table until the preferred route fails. A normal static (AD 1) would take precedence immediately, so the higher AD is the whole point of making it floating.
Worked example from the 200-301 bank
lock_openFree sampleIP Connectivitymedium
A router learns the exact same prefix 192.168.20.0/24 from three sources at once: RIP, OSPF, and internal EIGRP. With default settings and no manual configuration changes, which route is installed in the routing table?
- AThe internal EIGRP route, because its administrative distance of 90 is the lowest of the threecheck_circle Correct
- BThe OSPF route, because OSPF uses cost based on bandwidth and is more accurate than EIGRP
- CThe RIP route, because RIP hop count gives the simplest and most reliable loop-free path
- DAll three routes, because the router load-balances equally across every protocol that offers the prefix
When multiple protocols offer the identical prefix, the router installs the route from the source with the lowest administrative distance. Administrative distance ranks the trustworthiness of route sources. With an identical prefix, the router compares AD before any metric: internal EIGRP 90 is lower than OSPF 110 and RIP 120, so the EIGRP-learned route is chosen and the others are not installed.
Why A is correct: When the prefix is identical, the router trusts the source with the lowest administrative distance; internal EIGRP at 90 beats OSPF at 110 and RIP at 120, so the EIGRP route is installed.
Why B is wrong: Metric quality is irrelevant across different protocols; selection here is by administrative distance, and OSPF at 110 is higher than internal EIGRP at 90, so OSPF is not preferred.
Why C is wrong: RIP carries the highest administrative distance of these three at 120, so it is the least trusted; its hop-count metric is never compared against the other protocols' metrics.
Why D is wrong: Routers do not load-balance across different protocols for one prefix; equal-cost load balancing only happens within a single protocol, so only the lowest-AD source is installed.
What you must be able to do. Configure and verify NAT, NTP, and DHCP, explain SNMP, syslog, and QoS per-hop behaviour, and secure remote management with SSH.
In one sentenceThe services that keep a network usable: NAT, NTP, DHCP and DNS, SNMP and syslog, QoS per-hop behaviour, and SSH, TFTP, and FTP for management.
Recall check: answer these from memory first
- Define inside local, inside global, outside local, and outside global, with an example address for each.
- Order syslog severities from most to least severe, and say which end the smaller number sits at.
- List the configuration steps to enable SSH on the VTY lines, in the order they must happen.
What it tests. Configuring inside source NAT with static entries and pools and PAT overload, NTP in client and server mode, and DHCP client and relay, plus the role of DHCP and DNS. It covers SNMP polling and traps, syslog facilities and severity levels (lower number means more severe), and QoS per-hop behaviour: classification, marking, queuing, and the difference between policing and shaping. It also covers securing remote access with SSH and the roles of TFTP and FTP.
How to study it. Keep the NAT terminology straight with a table: inside local is the private address on the host, inside global is the public address it is translated to, and PAT overloads many inside locals onto one inside global using port numbers. Learn syslog severities by the rule that 0 is most severe and 7 is least, and that policing drops or remarks excess traffic while shaping buffers it. For SSH, know the configuration steps in order: hostname, domain name, generate the RSA key, create a local user, and set transport input ssh on the VTY lines.
Easy to confuse
- Policing versus shaping. Policing enforces a rate by dropping or remarking traffic that exceeds it, which is harsh but adds no delay; shaping buffers excess traffic and releases it later, smoothing bursts at the cost of latency. The exam matches the requirement (drop now versus delay and smooth) to the tool.
- Inside local versus inside global in NAT. Inside local is the private address as seen inside the network; inside global is the public address the same host appears as outside, after translation. The trap mislabels the translated public address as inside local, or vice versa.
- SNMP versus syslog. SNMP lets a manager poll device state and receive traps in a structured MIB; syslog is a one-way stream of event messages classified by facility and severity. The exam offers one when the scenario needs the other; structured metrics and polling point to SNMP, event logging points to syslog.
Worked example from the 200-301 bank
lock_openFree sampleIP Servicesmedium
A router runs inside source NAT so that a workstation in the private LAN can reach a public web server. The workstation holds a private RFC 1918 address, and the router rewrites the source to a registered public address before the packet leaves the WAN interface. Which NAT term describes that registered public address the workstation is translated to?
- AInside local address, because it is the address the router assigns to the inside host before the packet is forwarded to the WAN.
- BOutside global address, because it is the public address that the inside host is given when its traffic crosses to the outside.
- CInside global address, because it is the registered public address that represents the inside host as seen from the outside network.check_circle Correct
- DOutside local address, because it is the public address the inside host presents while communicating with the outside server.
Distinguish inside global as the translated public address of an inside host from the inside local and outside NAT terms. In Cisco NAT terminology the inside local address is the private address used inside, while the inside global address is the registered public address the router maps it to; outside local and outside global describe the far-end host, so only inside global names the translated public address of the inside host.
Why A is wrong: The inside local address is the private address the host actually uses inside the network, not the registered public address it is translated to, so this term is the wrong end of the mapping.
Why B is wrong: The outside global address is the real public address of the destination on the outside network, not the address assigned to the translated inside host, so the label is applied to the wrong host.
Why C is correct: The inside global address is exactly the routable public address the router substitutes for the inside host's private address, so outside devices see the inside host by this address.
Why D is wrong: The outside local address is how an outside host appears to devices inside the network, so it does not describe the inside host's own translated public address.
What you must be able to do. Apply core security concepts and VPN types, harden device access with AAA, write standard and extended ACLs that match and are placed correctly, and configure Layer 2 and wireless security.
In one sentenceSecuring the network: threats versus vulnerabilities, IPsec VPNs, AAA and device access control, standard and extended ACLs, and Layer 2 and wireless security.
Recall check: answer these from memory first
- State where a standard ACL and an extended ACL should each be placed, and why the placement differs.
- Convert the subnet mask 255.255.255.0 to its ACL wildcard mask, and explain the relationship.
- Distinguish authentication, authorization, and accounting in one line each.
What it tests. Defining threats, vulnerabilities, exploits, and mitigations, security program elements, and IPsec remote-access versus site-to-site VPNs. It covers device access control with local accounts and enable secret, password policy and stronger alternatives, and the AAA split of authentication, authorization, and accounting. The heaviest part is standard and extended IPv4 ACLs: what they match, the implicit deny, wildcard masks, and placement. It also covers DHCP snooping, dynamic ARP inspection, port security, and WPA, WPA2, and WPA3.
How to study it. Make ACLs mechanical: standard ACLs match source only and go near the destination, extended ACLs match source, destination, protocol, and port and go near the source, lists are processed top-down with first-match wins, and an implicit deny any ends every list. Practise converting a subnet mask to its wildcard (invert each octet) because the exam tests it directly. For AAA, fix the three words: authentication proves who you are, authorization controls what you may do, accounting records what you did. For wireless, order the generations WPA, WPA2 (AES/CCMP), WPA3 (SAE).
Easy to confuse
- Standard versus extended ACL placement. A standard ACL matches source only, so it is placed near the destination to avoid blocking traffic it should not; an extended ACL matches source and destination, so it is placed near the source to drop unwanted traffic early. The exam reverses the placement as the distractor.
- Wildcard mask versus subnet mask. A subnet mask marks the network bits with ones; a wildcard mask is its inverse, where zero means match exactly and one means ignore. 255.255.255.0 becomes 0.0.0.255. The exam offers the subnet mask where a wildcard is required, especially in ACLs and OSPF network statements.
- Authentication versus authorization. Authentication verifies identity (who you are); authorization decides what an authenticated identity may do. The trap describes a permissions or privilege-level decision and labels it authentication, or vice versa.
- DHCP snooping versus dynamic ARP inspection. DHCP snooping blocks rogue DHCP servers on untrusted ports and builds a binding table; dynamic ARP inspection uses that same binding table to drop spoofed ARP. DAI depends on snooping, so a statically addressed host with no binding entry has its ARP dropped.
Worked example from the 200-301 bank
lock_openFree sampleSecurity Fundamentalsmedium
A security analyst is documenting an incident in which an unpatched web server was compromised. The server software contained a known coding flaw, the attacker used a publicly released piece of code that takes advantage of that flaw, and the result was full remote access. Using standard security terminology, what is the coding flaw itself best classified as?
- AA threat, because it represents the external party who has the intent and capability to cause harm to the server.
- BAn exploit, because it is the mechanism that takes advantage of the weakness to achieve remote access.
- CA vulnerability, because it is a weakness in the system that could be used to compromise it.check_circle Correct
- DA mitigation, because identifying the flaw is the control that reduces the overall risk to the server.
Classify a system weakness or flaw as a vulnerability, distinct from the threat that endangers it and the exploit that leverages it. In security terminology a vulnerability is a weakness in a system such as an unpatched software defect, a threat is the potential danger or actor that could act against it, and an exploit is the specific code or technique that takes advantage of the vulnerability; the coding flaw matches the definition of a vulnerability.
Why A is wrong: A threat is the potential danger or the actor that could cause harm, such as the attacker; the coding flaw is the internal weakness being targeted, not the source of danger, so the term is misapplied.
Why B is wrong: The exploit is the piece of code or technique that leverages the weakness; the flaw is what gets leveraged, so calling the flaw itself the exploit confuses the weakness with the tool used against it.
Why C is correct: A vulnerability is a weakness or flaw in a system, such as an unpatched coding defect, that an attacker can leverage; the scenario describes exactly such a flaw, so this classification is correct.
Why D is wrong: A mitigation is a countermeasure such as patching or filtering that reduces risk; the flaw is the problem, not the control, so labelling the weakness a mitigation inverts the relationship between the risk and its remedy.
What you must be able to do. Explain how automation and controller-based architectures change network management, read REST and JSON, and recognise what Ansible and Terraform do.
In one sentenceThe modern operations layer: automation and controller-based or software-defined networking, REST APIs and JSON, and configuration management with Ansible and Terraform.
Recall check: answer these from memory first
- State which direction northbound and southbound APIs face on a network controller, and what sits at each end.
- Map the four CRUD operations to their HTTP verbs.
- Name the two configuration management tools in the v1.1 outline and the one-line role of each.
What it tests. How automation reduces manual, error-prone CLI work, and how a controller-based or software-defined architecture separates the control plane from the data plane, with an overlay, underlay, and fabric and northbound and southbound APIs. It covers cloud network management and Cisco Catalyst Center, the characteristics of REST APIs (CRUD mapped to HTTP verbs and status codes), reading JSON, and the capabilities of configuration management tools, which in the v1.1 outline means Ansible and Terraform.
How to study it. Anchor the SDN vocabulary to direction: northbound APIs face the applications above the controller, southbound APIs face the devices below it, and the control plane (decisions) is centralised away from the data plane (forwarding). For REST, map CRUD to verbs (create is POST, read is GET, update is PUT or PATCH, delete is DELETE) and learn to read a small JSON object to pull the value of a key. For configuration management, know that this is the v1.1 outline: it is Ansible (agentless, playbooks over SSH) and Terraform (declarative infrastructure as code), not the retired Puppet and Chef.
Easy to confuse
- Northbound versus southbound API. A northbound API faces upward to applications and orchestration tools that consume the controller; a southbound API faces downward to the network devices the controller programs. The exam swaps the two directions.
- Control plane versus data plane. The control plane decides how traffic should be forwarded (routing, topology); the data plane actually forwards the packets. Controller-based networking centralises the control plane and leaves forwarding on the devices, so a question about where decisions are made is about the control plane.
- Ansible versus Terraform. Ansible is agentless configuration management and orchestration that pushes desired state to devices over SSH using playbooks; Terraform is declarative infrastructure as code that provisions and tracks infrastructure state. The v1.1 outline tests these two, not the retired Puppet or Chef.
Worked example from the 200-301 bank
lock_openFree sampleAutomation and Programmabilitymedium
An enterprise replaces its on-premises wireless controllers with a cloud-based management platform whose dashboard is hosted by the vendor and reached through a browser, while the access points and switches stay on site. The operations team wants to know which characteristics genuinely follow from adopting this cloud-managed model rather than traditional on-site management. Which three statements correctly describe the cloud-based approach? Select THREE.
- AConfiguration and monitoring happen through a vendor-hosted dashboard reached over the internet, with no management software run in the local data centre.check_circle Correct
- BUser data frames between on-site endpoints must travel up to the cloud dashboard and back before they can be forwarded to their destination.
- CSoftware updates and new features for the management plane are delivered by the provider, reducing the upgrade burden carried by the in-house team.check_circle Correct
- DOn-site devices keep no local management connectivity of any kind, so a brief internet outage immediately erases their running configuration.
- EMultiple distributed sites can be administered together from one hosted console instead of managing each location's appliances separately.check_circle Correct
Recognise that cloud-based network management hosts the management plane as an internet-reached service while production data continues to be forwarded locally on site. Cloud-based management moves the management plane to a vendor-hosted dashboard reached over the internet, so the provider handles updates and the team administers many sites from one console; the on-site devices still switch user data locally and retain their pushed configuration during a dashboard outage, which is why management reachability and data forwarding are separate concerns.
Why A is correct: A defining trait of cloud management is that the controller or dashboard runs as a hosted service the customer reaches over the internet, so no local management appliance is operated.
Why B is wrong: It sounds plausible that a cloud platform handles everything, but the cloud carries management and telemetry while production data is still switched locally on site.
Why C is correct: Because the provider operates the hosted management plane, it rolls out platform updates and features centrally, sparing the customer from patching local management servers.
Why D is wrong: An outage blocks dashboard changes, but devices retain their pushed configuration and keep forwarding, so the claim that an outage erases configuration is false.
Why E is correct: A central hosted console gives single-pane oversight across many sites, which is a direct benefit cloud management offers over per-site on-premises controllers.