Cisco CCNA 200-301 Study Guide: Exam Format, Domains, Cost, and a Study Plan

The Cisco Certified Network Associate (CCNA) is earned by passing one exam, 200-301, currently at version 1.1. You get 120 minutes, and Cisco does not publish a question count; candidates typically report somewhere between 100 and 120 items, mixing multiple choice with drag-and-drop and live simulation questions on a real Cisco IOS command line. The exam costs USD 300 at time of writing, is booked through Pearson VUE, and has no formal prerequisites. Passing it comes down to two skills that reading cannot give you: subnetting fast enough to do it in your head, and enough IOS command fluency that a simulation question does not turn into a guessing exercise.

This guide covers what the certification is, exactly how the exam is delivered and scored, all six domains with their official v1.1 weightings, what registration costs and how recertification works, what changed in version 1.1, and a phased study plan with what to cover in each phase.

Scope and audience

CCNA is Cisco’s associate-level certification for enterprise networking. Unlike a vendor-neutral certification, it is written against Cisco’s own implementations. A large share of the exam is Cisco-proprietary material with no equivalent standards document behind it: Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), Port Aggregation Protocol (PAgP), Rapid Per-VLAN Spanning Tree Plus (Rapid PVST+), Hot Standby Router Protocol (HSRP), Gateway Load Balancing Protocol (GLBP), and Cisco’s administrative distance values. You cannot study those from an RFC because none exists. You study them from how Cisco built them.

The certification maps to network technician, network administrator, network support engineer, NOC (network operations center) analyst, and help desk roles at organizations running Cisco gear. It is also the standard on-ramp to Cisco’s professional track, since CCNP Enterprise assumes CCNA-level routing and switching as a starting point.

CCNA covers more ground than its associate label suggests. A single exam blueprint spans IPv4 and IPv6 addressing, switching, Spanning Tree Protocol, wireless LAN controllers, OSPF, network address translation, access control lists, device hardening, REST APIs, JSON, and configuration management tooling. Depth in any one area is moderate. Breadth is the difficulty.

Exam format

Detail	200-301 v1.1
Exams required	One (200-301)
Time limit	120 minutes
Number of questions	Not published by Cisco; typically reported as 100 to 120
Question types	Multiple choice single answer, multiple choice multiple answer, drag and drop, simulation, simlet, testlet
Score scale	Scaled score reported on a 1000-point scale
Passing score	Not published by Cisco; commonly reported around 825
Exam cost	USD 300 at time of writing, plus applicable taxes
Delivery	Pearson VUE test center or online proctored
Prerequisites	None; Cisco recommends about one year of experience
Certification validity	3 years

Four format facts change how you should prepare.

You cannot go back. Cisco exams are linear. Once you submit an answer and advance, there is no review screen, no flagging, and no returning to a previous item. This is the single largest procedural difference from CompTIA exams, and it removes the skip-and-return strategy that works on Security+ or Network+. Every question has to be answered when you see it. If you are stuck, you make your best decision and move on permanently.

Simulation items are a real command line. A simulation drops you into an emulated topology with working IOS devices. You enter configuration mode, type commands, and the grader evaluates the resulting configuration. Context-sensitive help works: ? lists valid keywords and Tab completes them. What the emulator will not do is tell you which mode you need to be in or which command family solves the problem. A candidate who has typed switchport mode access and switchport access vlan 10 a hundred times finishes a VLAN simulation in ninety seconds. A candidate who has only read about VLANs spends eight minutes and may still submit a broken configuration.

Simlets and testlets are multi-question scenarios. A simlet gives you a topology you can inspect with show commands and then asks several multiple choice questions about it. A testlet groups several questions around a single scenario. Both reward the ability to read IOS output quickly, which is a trainable skill in its own right.

120 minutes is the entire budget. If your exam has 110 items and three simulations, and each simulation takes six to eight minutes, you have roughly one minute per remaining question. There is no time to reason a subnetting problem out from binary.

Scoring

Cisco reports a scaled score on a 1000-point scale, and Cisco does not publish the cut score for 200-301. The figure candidates most often quote is 825 out of 1000, which appears widely in community reports and in score-report screenshots, but it is not an official published number and Cisco reserves the right to adjust it. Treat any specific passing score you see, including 825, as an estimate rather than a fact.

Two consequences follow from that.

First, do not calculate how many questions you can afford to miss. The scale is not a percentage of items, question difficulty is weighted, and the mapping is not published. The workable readiness standard is a practice score with margin: consistently 85% or better on full-length timed practice, with no domain sitting below 80%.

Second, answer everything. There is no penalty for a wrong answer beyond not getting credit, so a blank is strictly worse than a guess. On a linear exam this matters more than usual, because you cannot come back and fill blanks at the end.

Your result appears on screen at the end of the exam, and the score report breaks performance down by domain.

The six domains and their weights

Version 1.1 of the 200-301 blueprint organizes the objectives into six domains. The weights are official and they are the correct guide to how you allocate study hours.

#	Domain	Weight
1	Network Fundamentals	20%
2	Network Access	20%
3	IP Connectivity	25%
4	IP Services	10%
5	Security Fundamentals	15%
6	Automation and Programmability	10%

Network Fundamentals (20%)

The base layer: the role of routers, Layer 2 and Layer 3 switches, next-generation firewalls, access points, wireless LAN controllers, endpoints, and servers, plus how they fit together. Campus design concepts appear here, including two-tier, three-tier, and spine-leaf architectures and the distinction between what a router does and what a Layer 3 switch does. Physical infrastructure is tested: copper versus fiber, single-mode versus multimode, and the transceiver form factors you plug into a switch.

Addressing lives here too: IPv4 subnetting and address types, IPv6 addressing including the address types and the abbreviation rules, and TCP versus UDP. So does interface verification, which means reading the counters in show interfaces output and recognizing the error patterns that point at a physical problem, including the specific counter fingerprint of a duplex mismatch.

Network Access (20%)

Everything that happens on a switch. VLANs across multiple switches, access port configuration, 802.1Q trunking with its native VLAN and allowed VLAN list, and how DTP modes combine to form or not form a trunk. Spanning Tree Protocol is a heavy sub-topic: root bridge election and its tiebreakers, port roles and states under Rapid PVST+, and the edge-port protections including PortFast and BPDU Guard. Link aggregation appears as EtherChannel with LACP, PAgP, and static on modes.

Discovery protocols are explicitly in scope, and the CDP versus LLDP comparison with their respective timers is a recurring exam target. Wireless sits in this domain as well: access point modes, the CAPWAP relationship between an AP and a controller, the port and interface types on a wireless LAN controller, and configuring a WLAN with WPA2 PSK through the controller GUI.

IP Connectivity (25%)

The largest domain. It starts with the routing table itself: the code letters, the metric and administrative distance brackets, and how to read them, which is the substance of interpreting show ip route output. Route selection is tested directly, both the longest prefix match rule and the administrative distance values Cisco assigns to each route source. Those defaults are memorization work: connected 0, static 1, eBGP 20, EIGRP internal 90, OSPF 110, IS-IS 115, RIP 120, EIGRP external 170, iBGP 200.

Configuration objectives cover IPv4 and IPv6 static routing in its next-hop and exit-interface forms, floating static routes for backup paths, and single-area OSPFv2 including neighbor adjacencies, the router ID, and point-to-point network types. First hop redundancy is here too, with HSRP as the Cisco-proprietary option alongside VRRP and GLBP.

IP Services (10%)

A small domain with a lot of distinct items. Inside source NAT and PAT on a router, NTP in client and server modes, DHCP server pools and relay with ip helper-address, DNS at the client level, SNMP versions, syslog severity levels, and quality of service concepts including classification, marking, queuing, and policing versus shaping. Device management tasks fall here too, including file transfer to and from flash with TFTP and FTP and SSH access.

Security Fundamentals (15%)

Security concepts (threats, vulnerabilities, exploits, mitigation), the CIA triad, and authentication, authorization, and accounting. Device hardening is the practical core: the IOS CLI modes and how privilege boundaries work across them, enable secret versus enable password and securing the VTY lines, and the IOS password encryption types 0, 7, 5, 8, and 9 with which of them are actually reversible.

Also here: access control lists (standard and extended, numbered and named), Layer 2 security features such as port security, DHCP snooping, and dynamic ARP inspection, wireless security with WPA2 and WPA3, and VPN concepts at a descriptive level.

Automation and Programmability (10%)

Impact of automation on network management, controller-based and software-defined architectures, and the underlay, overlay, and fabric model that controller-based networks are built on. Northbound and southbound APIs, REST API characteristics including the common verbs and response codes, and interpreting JSON encoded data. Configuration management tooling appears at a recognition level rather than a hands-on level, and the practical case for automating network changes is itself an exam topic.

This is the domain most candidates underprepare, on the assumption that 10% is negligible. Ten percent of a 110-question exam is roughly eleven questions, and they are among the easiest points on the test because the material is descriptive rather than computational.

Registration and cost

The exam costs USD 300 at time of writing, before applicable taxes, and Cisco adjusts pricing periodically, so confirm the current figure when you book.

Registration goes through Pearson VUE. You create a Cisco account, which generates a Cisco ID, link it to Pearson VUE, and schedule from there. Two delivery options exist and both are proctored.

Test center. Arrive early with two forms of identification, the primary being a government-issued photo ID with a signature, and with a name that matches your registration exactly. Personal items go in a locker. You are given an erasable note board, which is where your subnetting scratch work happens. No calculator is provided and none is permitted.

Online proctored. You run a system check in advance, show identification to a remote proctor over webcam, and pan the camera around your workspace. The rules are strict: a private room, a cleared desk, one monitor, nobody entering, no talking, and no leaving the frame. A wired connection is worth arranging, because a dropped connection mid-exam is a genuinely bad experience. Online delivery also means no physical note board, so you work with the on-screen whiteboard tool, which is slower for subnetting than a marker and a board.

If you fail, Cisco requires a five calendar day wait before you may retake the same exam. Once you pass, you cannot retake that exam for 180 days.

Prerequisites

There are no formal prerequisites. You can book 200-301 as your first certification exam of any kind.

Cisco recommends roughly one year of experience implementing and administering Cisco solutions, along with basic IP addressing knowledge and a working understanding of network fundamentals. That recommendation is meaningful rather than decorative. Candidates coming in with no hands-on exposure are not blocked, but they will have to manufacture that exposure through labs, because the exam tests configuration behavior that reading does not transmit.

Practical substitutes for the recommended experience include a network simulator, a virtualized lab, or a small stack of used Cisco switches and routers. What matters is that you have typed the commands and seen what happens when they are wrong, not the specific method.

Recertification

CCNA is valid for three years from the date you pass. Cisco offers two renewal paths, and you can combine them.

The exam path renews the certification by passing a qualifying exam before expiry, which can be the CCNA again, another associate-level exam, or any professional or expert-level exam. Passing a higher-level exam renews everything at or below that level.

The Continuing Education path renews CCNA by earning 30 Continuing Education credits through Cisco-approved training, authorized instructor activities, or authoring work, submitted through Cisco’s Continuing Education portal. Credits must be earned and submitted within your three-year window.

Changes in v1.1

Version 1.1 of the 200-301 blueprint took effect on 2024-08-20. It is a revision rather than a rewrite: the six domains and their weightings are unchanged, and the great majority of objectives carry over intact. Two additions matter for study planning.

Artificial intelligence and machine learning in network operations. The blueprint now includes an objective covering AI and ML in the context of running networks. It is conceptual, not technical: the difference between predictive and generative approaches, what AI-driven analytics does with telemetry, and where machine learning fits into anomaly detection and operational tooling. There is no math and no model building.

Terraform in configuration management. The configuration management objective was updated so that Terraform now appears alongside Ansible, and the older Puppet and Chef references were dropped. Coverage is at a recognition level, meaning you should be able to identify what each tool is for and how declarative infrastructure definition differs from procedural scripting, not write Terraform.

If you are studying from material published before August 2024, it is written to v1.0 and will not cover either addition. The rest of it remains usable.

Difficulty

CCNA is harder than the vendor-neutral associate certifications, and the reasons are specific rather than general.

Subnetting under time pressure is the first failure point. The exam does not ask you whether you understand subnetting. It embeds subnetting inside other questions: an access list scenario where you must recognize the correct wildcard mask, an OSPF configuration where the network statement needs the right wildcard, a design question asking which subnet a given host address falls in, a troubleshooting item where the gateway is outside the host’s subnet. Each of those is one question in your 120 minutes. If finding the network address, broadcast address, and usable host range for a /26 takes you two minutes with binary conversion on the note board, you will not finish the exam. The standard to train toward is under thirty seconds for any prefix length, done by recognizing the block size rather than converting to binary. That standard is reachable by almost anyone with ten focused minutes of drilling per day over several weeks, and it is not reachable by reading about subnetting.

IOS command fluency is the second. Simulation and simlet items assume you can navigate the CLI without hesitation. That means knowing which mode a command lives in, so that you type interface GigabitEthernet0/1 from R1(config)# and switchport access vlan 10 from R1(config-if)# without stopping to think about it. It also means reading output at speed. Given this:

R1# show ip route
Codes: L - local, C - connected, S - static, O - OSPF, IA - OSPF inter area

Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.1
      10.0.0.0/8 is variably subnetted, 3 subnets, 3 masks
O        10.1.1.0/24 [110/3] via 10.10.12.2, 00:04:31, GigabitEthernet0/1
C        10.10.12.0/30 is directly connected, GigabitEthernet0/1
L        10.10.12.1/32 is directly connected, GigabitEthernet0/1

you should be able to say instantly that the default route is static with administrative distance 1, that the 10.1.1.0/24 route came from OSPF with an administrative distance of 110 and a cost of 3, and that 10.10.12.1/32 is the router’s own interface address rather than a learned route. Candidates who have never sat in front of IOS read that output slowly and get the bracket values backwards.

The no-going-back format punishes hesitation. On an exam where you cannot revisit anything, dwelling on a hard question costs you the questions at the end that you would have answered correctly. The discipline you need is deciding within roughly ninety seconds and moving on for good.

Breadth catches people at the edges. Most candidates over-study routing and switching, because that is what CCNA is known for, and under-study wireless, automation, and IP services. Together those three account for 40% of the blueprint if you include the wireless portion of Network Access. Domain 6 in particular is descriptive material that yields points cheaply.

Cisco-proprietary defaults have to be memorized. There is no derivation and no standards document behind them. Administrative distance values, STP default priority of 32768 in increments of 4096, CDP timers of 60 seconds hello and 180 seconds hold versus LLDP’s 30 and 120, port security defaulting to a maximum of one MAC address with a violation action of shutdown, HSRP’s preempt disabled by default while VRRP’s is enabled. These are pure recall items and the exam tests them directly.

Study plan

The plan below runs eight to twelve weeks at roughly an hour a day from a cold start, or four to six weeks if you already administer Cisco networks. The structure matters more than the calendar: each phase adds hands-on work and question practice rather than deferring both until the end.

Phase 1: Baseline, addressing, and the CLI

Take a full-length diagnostic before studying anything. The total score is not useful; the per-domain breakdown is, and it usually reveals that the weak spots are not where you assumed.

Then build two foundations in parallel. The first is addressing: IPv4 structure, subnet masks and prefix notation, the block-size method for finding network and broadcast addresses, VLSM, and IPv6 address types and abbreviation. Start the ten-minutes-daily subnetting drill here and do not stop it until exam day.

The second foundation is the CLI itself: the IOS configuration modes and their prompts, navigating between them, context-sensitive help, and the verification commands you will use constantly, including show running-config, show ip interface brief, show interfaces status, and show version. Get a lab environment working during this phase, whichever kind you choose. Every later phase assumes you have one.

Phase 2: Switching

Work through VLANs end to end: creating them, assigning access ports, verifying with show vlan brief, and trunking between switches. Configure trunks explicitly rather than relying on negotiation, then deliberately break them to see what a native VLAN mismatch and an allowed-list mistake look like. Cover inter-VLAN routing in both the router-on-a-stick and SVI forms.

Then Spanning Tree: how the root bridge is elected, what the port roles and states are under Rapid PVST+, how to influence the election with priority, and what PortFast and BPDU Guard do at the network edge. Finish with EtherChannel, including which parameters must match for the bundle to come up.

Lab everything in this phase. Switching is the material where reading and doing diverge most sharply.

Phase 3: Routing

Start with the routing table and route selection: longest prefix match first, then administrative distance, then metric. Memorize the administrative distance table now, not later.

Configure static routing in all its forms, including default routes, IPv6 static routes, and floating statics for backup paths. Then take on OSPFv2 in a single area: the router ospf process, network statements with wildcard masks, router ID selection, adjacency requirements, and the cost calculation from the 100 Mbps reference bandwidth. Build a three-router lab and break the adjacency on purpose by mismatching hello and dead timers, area numbers, and subnet masks, so that you recognize each symptom.

Close the phase with first hop redundancy, where the details that get tested are the virtual MAC address formats and the default preempt behavior of each protocol.

Phase 4: Services, security, wireless, and automation

These four blocks together are 35% of the exam plus the wireless share of Network Access, and they are commonly rushed.

For IP services, configure NAT overload and read the translation table, set up a DHCP pool and a relay with ip helper-address, and learn the SNMP versions and syslog severity levels as recall items. For security, write and apply standard and extended ACLs until wildcard masks are automatic, harden a device with enable secret, SSH on the VTY lines, and port security, and learn the password type numbers and which are reversible.

For wireless, focus on the controller: port and interface types, WLAN creation with WPA2 PSK, AP modes, and the CAPWAP tunnel relationship. For automation, learn the concepts cleanly rather than deeply, including REST verbs and response codes, JSON structure, controller-based architecture, underlay and overlay, and the v1.1 additions on AI/ML and Terraform.

Phase 5: Timed simulation

Shift almost entirely to full-length timed practice under real conditions: 120 minutes, no pausing, no lookups, and no going back to change an answer, since the real exam will not let you. Review every question afterward, including the ones you got right, because a correct guess is a gap you have not found yet.

Keep drilling simulations in your lab in parallel. Set yourself a task with a time limit, such as configuring a trunk with a specific native VLAN and allowed list in under three minutes, and repeat until it is mechanical.

You are ready when timed practice sits consistently at 85% or better with no domain below 80%, and when you can subnet any prefix in under thirty seconds without writing binary.

Quick reference

• Exam: one exam, Cisco 200-301 v1.1, 120 minutes, roughly 100 to 120 questions, USD 300 at time of writing, booked through Pearson VUE at a test center or online proctored.
• Scoring: scaled to 1000 points. Cisco does not publish the cut score; the commonly reported figure is around 825, which is an estimate and not official.
• Format rule that changes strategy: Cisco exams are linear. There is no going back, no flagging, and no review screen, so every question is answered when it appears and blanks are never worth leaving.
• Domain weights: IP Connectivity 25%, Network Fundamentals 20%, Network Access 20%, Security Fundamentals 15%, IP Services 10%, Automation and Programmability 10%.
• v1.1, effective 2024-08-20: added AI and machine learning in network operations, and added Terraform to configuration management alongside Ansible, dropping Puppet and Chef.
• Prerequisites and validity: none required, about one year of experience recommended; valid three years, renewed by a qualifying exam or 30 Continuing Education credits.
• The two skills that decide the outcome: subnetting any prefix in under thirty seconds without binary conversion, and enough IOS fluency to configure and read output without hesitating.
• Memorize the Cisco defaults cold: administrative distances, STP priority 32768 in 4096 increments, CDP 60/180 versus LLDP 30/120, port security maximum 1 with violation shutdown, HSRP preempt off and VRRP preempt on.
• Readiness bar: 85% or better on full-length timed practice with no domain below 80%.