8 Integrated CCNA Practice and Review
Connects VLAN switching, routing, network services, security, automation, and layered troubleshooting through a branch-network scenario and practice-question reasoning.
Branch network and exam scope
The integrated branch scenario uses 10 for employees at 192.168.10.0/24, 20 for guests at 192.168.20.0/24, and 99 for network services at 192.168.99.0/24. Two switches are connected by an , a router provides inter- routing, and a DHCP server at 192.168.99.10 serves the client VLANs. The branch router connects over 10.0.12.0/30 to a second router, which advertises the server network 192.168.30.0/24 using area 0.
The material presents original practice questions, not actual certification exam items. Its exam-version note states that, as of November 4, 2026, Cisco lists February 2, 2027, as the last testing date for 200-301 v1.1 and February 3, 2027, as the first date for v2.0. Check Cisco's current exam topics for the version you plan to take.
VLANs and trunk configuration
VLANs divide Layer 2 broadcast domains. Switches learn source MAC addresses and forward frames within VLANs; unknown unicast and broadcast traffic may be flooded within the . Communication between VLANs requires a Layer 3 device, as well as correct addressing, routing, and policy.
Create the required VLANs on both switches, assign end-device ports to access VLANs, and configure both ends of the interswitch link consistently. For example:
The allowed- list must include the VLANs that need to cross the link. A native- mismatch can cause unexpected traffic handling. Check show brief and show interfaces trunk; when troubleshooting, verify that the link is operational and trunking, that 10 is allowed and is not pruned or suspended, and that native settings agree.
Inter- routing and DHCP
uses one router subinterface per . In the branch example, the native designation on the router must agree with the switch trunk. The router configuration is:
A DHCP discover message is a local broadcast and is not routed by default. The ip helper-address setting on the client-facing Layer 3 interface relays the request to the remote DHCP server. If 20 clients receive no lease while 99 clients do, inspect ip helper-address 192.168.99.10 on the 20 router subinterface. Also check that the server has a matching scope and can return traffic to the relay.
Verify the client's address, mask, default gateway, and DNS settings, along with the relay configuration and server scope. When a host can reach its local gateway but not another , check its mask and gateway, both router interfaces or subinterfaces, routing between subnets, and entries and direction. Reaching the local gateway confirms local reachability, not end-to-end reachability.
routing and neighbor checks
An process on the branch router can advertise the connected VLANs and point-to-point link. network statements use wildcard masks, which are the inverse of subnet masks. For example:
The peer must also run on the shared link, use a compatible area and parameters, and advertise its server network. Check show ip neighbor, show ip route , and show ip protocols. Exact command support can vary by platform and software.
If directly connected routers have no neighbor relationship, check interface and link state and IP reachability; whether is enabled on the correct interfaces; matching area and compatible hello and dead timers and network type; and unique, stable router IDs. Also check whether an interface was made passive, and inspect logs or authentication settings if configured. Neighbor state and route presence are different checks.
Route selection
A router first selects the matching route with the longest prefix. For example, if the routing table contains 10.8.0.0/16 and 10.8.4.0/24, traffic to 10.8.4.25 uses 10.8.4.0/24, even if the /16 route has a lower administrative distance. When competing routes have the same prefix, administrative distance helps select the route source; within a routing protocol, its metric helps choose among candidate paths. A default route is used when no more-specific route matches.
order and traffic policy
An extended can allow guest DNS requests to 192.168.30.53, block other guest access to the server subnet, and permit other routed destinations. Its order is important:
entries are processed in order, and the first matching entry applies. An implicit deny follows the listed entries. Therefore, a DNS permit placed after a broader deny does not work: the earlier deny matches first. Put specific permits before broader denies, then verify the and its interface and direction with show access-lists and show ip interface.
and Internet access
translates eligible inside addresses to the outside interface address. In this example, the standard selects inside addresses, the subinterfaces are marked inside, the external interface is marked outside, and overload is enabled:
If translations are absent, check that inside and outside roles are assigned correctly, the NAT matches the source addresses, and traffic actually traverses the router from inside to outside. Also verify routing and that the outside interface is up and has usable addressing. Use show ip nat translations and show ip nat statistics to inspect NAT operation. NAT does not itself provide routing or authorize traffic through an .
Switch and management security
helps prevent unauthorized DHCP servers from answering clients and builds binding information used by related protections. Trust only interfaces leading to legitimate DHCP servers or trusted network infrastructure; ordinary client-facing ports should generally remain untrusted. Validate support and behavior for the specific switch model and software.
SSH is preferred to Telnet for remote CLI access because SSH encrypts the management session, while Telnet does not protect credentials or session contents in transit. services distinguish authentication, which verifies identity; authorization, which determines permitted actions; and accounting, which records activity.
Automation, APIs, and
In a workflow, GET commonly retrieves a resource. is a structured data-encoding format that can represent the response; it is not an HTTP method.
In controller-based networking, the controller communicates with devices through southbound interfaces and with applications through northbound APIs. Automation can improve consistency and scale, but incorrect templates or data can repeat mistakes quickly.
Common actions have distinct roles: classification identifies traffic, marking labels it, queuing schedules it during congestion, policing enforces a rate by dropping or remarking excess traffic, and shaping delays excess traffic to smooth the rate.
Layered troubleshooting
Troubleshoot in layers rather than changing several configurations at once. Start at the endpoint by checking link or Wi-Fi association and address configuration. Then check the access port and , the trunk path, gateway reachability, routes and ACLs, DNS or DHCP as relevant, and finally the destination service.
Form a hypothesis, test it, inspect evidence, change one thing, and verify the result. Use show commands, counters, and logs, with a single test at each stage to narrow the fault. For example, a report that “the network is down” calls for a short sequence of checks from endpoint connectivity through the destination service, not simultaneous configuration changes.
Practice reasoning and review
For at least 50 usable host addresses in one subnet, the smallest prefix described is /26, with mask 255.255.255.192. It provides 64 total addresses and conventionally 62 usable host addresses; /27 provides only 30 usable addresses.
The integrated checks can be applied together: verify trunk state, allowed VLANs, and native agreement; verify router subinterfaces and relay settings; confirm neighbors and routes; apply route selection by longest prefix; inspect order and direction; and confirm interface roles, matching addresses, and routed traffic. For service and security checks, distinguish DHCP from DNS, consider trust boundaries, and use SSH rather than Telnet for remote management. For API questions, identify GET as the common retrieval method and as a response data format.