The CCNA (200-301) is not a memorisation exam, even though it has facts to learn. It is a test of whether you can build, read and fix a small network from a command line, and a chunk of it is delivered as hands-on simulations where you type real Cisco commands. That is why the whole shape of effective study is different from a purely multiple-choice cert: you do not just read about a VLAN, you configure one, break it, and fix it, until the syntax is muscle memory. This guide is a full self-study course. It walks through all six exam topic areas in the order that builds understanding, explains the concepts behind the configuration rather than listing commands, and turns the lot into a week-by-week plan with a lab at its centre. It is original teaching material and study guidance only. It contains no real or simulated exam questions, and you should always confirm the current exam topics on Cisco’s own CCNA page before you book.
Chapter 1: Exam overview and how to use this guide
What the CCNA actually measures
The CCNA measures whether you can operate the core of an enterprise network: address it, switch it, route it, secure it, keep its services running, and increasingly automate it. Cisco organises the 200-301 exam into six topic areas with published weights, and those weights are the single most important planning fact in this course because they tell you where your hours belong. They are Network Fundamentals at 20%, Network Access at 20%, IP Connectivity at 25%, IP Services at 10%, Security Fundamentals at 15%, and Automation and Programmability at 10%. IP Connectivity is the largest single slice, with the two switching-and-fundamentals areas just behind, so routing and switching together dominate the exam. Automation is the smallest but the fastest-growing area and the one beginners most often skip.
The exam runs about 120 minutes with roughly 100 to 120 questions, and it mixes multiple-choice, drag-and-drop, and hands-on simulations. Cisco does not publish the exact passing score and notes that questions and scores can change without notice; the score is scaled and has historically been discussed as roughly 800 to 850 out of 1000, but treat any specific figure as unofficial. One quirk shapes how you must practise: on the CCNA you cannot return to a previous question once you move on. There is no flag-and-revisit, so you have to be willing to commit to an answer and continue, and you cannot let a slow simulation strand you.
Why a lab is non-negotiable
Most of the value in this exam, and the part that separates people who pass from people who memorise, is the configuration. You will be asked to set up VLANs and trunks, bring up OSPF, apply an access list, and troubleshoot something that is broken, on simulated devices, under time. Reading a command is nothing like having typed it, watched it fail because of one missing word, and corrected it. The free Cisco Packet Tracer simulator, available through the Cisco Networking Academy, lets you build every topology this exam expects, and a lab habit from week one is the highest-return decision you can make. This course will repeatedly tell you to stop reading and go configure, because that is genuinely how the CCNA is passed.
How to use this course
Read the chapters in order at least once, because they are sequenced to build understanding rather than to match the exam’s weighting exactly. Fundamentals and addressing come first because subnetting threads through everything after them; switching comes before routing because you build the local network before you connect networks together; services, security and automation come last because they sit on top of a working network. Treat the bold terms as a checklist you should be able to explain in a sentence and configure in a lab. Short worked illustrations appear where a concept is easy to misread, but none are exam questions: they are teaching examples to make an idea concrete.
Chapter 2: Network Fundamentals (20%)
Network Fundamentals is the foundation the rest of the exam stands on, and the single skill inside it that pays off most is subnetting. Get this chapter genuinely solid before you move on, because weak addressing quietly sabotages the routing, services and simulation questions later.
The models, and why they are still worth knowing
Two reference models organise everything: the seven-layer OSI model (Application, Presentation, Session, Transport, Network, Data Link, Physical) and the more practical four-layer TCP/IP model. You are not learning these to recite them. You are learning them as a shared language for reasoning about where a problem lives. When something does not work, a good engineer asks which layer is failing: is the cable or interface down (Physical and Data Link), is the device unreachable by IP (Network), is a port blocked (Transport), or is the application itself misbehaving? This layered habit of thought is exactly what the troubleshooting and simulation questions reward, so treat the models as a diagnostic tool rather than trivia.
Addressing and the skill that underpins everything
An IPv4 address is 32 bits, written as four octets, and a subnet mask (or its shorthand, the CIDR prefix such as /24) defines which part of the address identifies the network and which part identifies the host. Subnetting is the art of dividing an address block into smaller networks, and it is the most important mechanical skill on the CCNA because it appears directly, underpins the routing questions, and shows up in the time-consuming simulations. You need to move quickly from a prefix to three things: the subnet mask, the number of usable hosts, and the range of addresses in each subnet. A small reference grid is worth internalising, for example: /24 gives 254 usable hosts, /25 gives 126, /26 gives 62, /27 gives 30, /28 gives 14, and /30 gives 2, which is the classic size for a point-to-point link between two routers. The way to learn this is little and often: a handful of subnetting problems every single day until you can do them in your head, not a single cram session. On exam day, slow subnetting eats the time you need for the simulations.
IPv6 is also in scope and worth genuine attention rather than a nervous skim. It uses 128-bit addresses written in hexadecimal, and you should be comfortable with address types (global unicast, link-local, unique local), shortening rules (dropping leading zeros and using the double-colon once), and the idea that IPv6 was designed to remove the address scarcity that forced workarounds like NAT in IPv4.
Components, cabling and interfaces
Finally, know the physical and logical building blocks: the difference between a switch (which forwards frames within a LAN using MAC addresses) and a router (which forwards packets between networks using IP addresses), the role of endpoints, access points and firewalls, and the basics of cabling and interfaces, including copper versus fibre and the speeds and connectors you would choose for a given run. As a teaching example to anchor the switch-versus-router distinction: traffic between two PCs on the same VLAN never needs a router and is handled by a switch, while traffic from that VLAN to a different network must pass through a router or a Layer-3 switch, and recognising which case you are in is the start of most routing and troubleshooting reasoning.
Chapter 3: Network Access (20%)
Network Access is the switching half of the exam: how you build and segment the local network, carry multiple networks over single links, prevent loops, and connect wireless clients. This is heavily hands-on, so every concept here should be something you have configured in Packet Tracer, not just read.
VLANs and trunking
A VLAN (virtual LAN) is a logical segment of a switched network: it lets you split one physical switch into several independent broadcast domains, so that, for example, finance and engineering devices are separated even though they share hardware. An access port belongs to a single VLAN and connects an end device; a trunk port carries traffic for many VLANs between switches, tagging each frame with its VLAN ID using the 802.1Q standard so the receiving switch knows where it belongs. You should be able to create VLANs, assign access ports, configure a trunk, and verify all of it with the show commands, because this is among the most likely things to appear as a simulation. As a teaching example of why trunking matters: without a trunk, two switches would each need a separate cable per VLAN, whereas one 802.1Q trunk carries every VLAN over a single link, which is why trunk configuration and tagging recur so often.
Spanning Tree Protocol
Redundant links between switches are good for resilience but create a danger: a Layer-2 loop, where frames circulate endlessly and bring the network down. Spanning Tree Protocol (STP) prevents this by automatically blocking redundant paths so that only one active path exists between any two points, while keeping the blocked links ready as backups. For the exam you should understand root bridge election (the switch with the lowest bridge ID becomes the root, and all path calculations are relative to it), the port states a port moves through, and the idea that modern Rapid STP converges faster than the original. You do not need to engineer a large STP design, but you must understand why STP exists and how to read which switch is root and which ports are blocking.
EtherChannel and wireless
EtherChannel bundles several physical links into one logical link, increasing bandwidth and providing redundancy without STP blocking the extra cables, since the bundle is treated as a single connection. Know what it is for and that it can be negotiated or configured statically. The wireless content is lighter and more conceptual at the associate level: understand the components of a wireless LAN (access points, wireless LAN controllers, the difference between autonomous and controller-based APs), the basic management workflow, and wireless security standards at a high level. You are not expected to design enterprise Wi-Fi, but you should be able to describe how the pieces fit and how a client associates.
How to study this chapter
Build a two- or three-switch topology in Packet Tracer and live in it. Create VLANs, assign ports, bring up a trunk and confirm tagging, then deliberately introduce a redundant link and watch STP block a port. Bundle two links into an EtherChannel. The aim is that the switch configuration commands and their verification become automatic, because Network Access is where simulations are common and where typing speed quietly decides whether you finish in time.
Chapter 4: IP Connectivity (25%)
IP Connectivity is the largest single topic area and the routing heart of the exam: how routers learn about networks, choose the best path, and forward packets between segments. Give it the most lab time, because configuring and verifying routing is exactly what the simulations test.
The routing table and how routers decide
A router’s job is to move a packet toward its destination network, and it does so by consulting its routing table, the list of known networks and how to reach each one. Two ideas govern how that table is built. The longest prefix match rule means a router always prefers the most specific route that matches a destination, so a /30 route wins over a /24 that also covers the address. Administrative distance ranks the trustworthiness of different route sources when more than one offers a path to the same network, so a directly connected network is trusted above a static route, which is trusted above a routing protocol like OSPF. Understanding these two rules lets you predict which route a router will actually use, which is the core of many connectivity questions.
Static routing
A static route is a path you configure by hand, telling the router explicitly how to reach a network. Static routing is simple, predictable and has no protocol overhead, which makes it ideal for small or stub networks and for a default route (the catch-all 0.0.0.0/0 path a router uses when nothing more specific matches, typically pointing toward the internet or a core router). You should be able to configure a static route to a specific network, configure a default route, and reason about when static beats dynamic: small, stable topologies favour static, while larger or changing networks favour a dynamic protocol that adapts on its own.
OSPF, the dynamic protocol you must configure
The dynamic routing protocol the CCNA expects you to actually configure is OSPF (Open Shortest Path First), a link-state protocol. Rather than being told routes, OSPF routers discover their neighbours, exchange information about the links they each see, build a complete map of the area, and independently calculate the shortest path to every network using a cost metric based on link bandwidth. For the exam, focus on single-area OSPF: forming neighbour relationships, advertising networks, and verifying the result. You should be able to enable OSPF, advertise the right networks, check that neighbours have formed, and read the routing table to confirm OSPF-learned routes appear. As a teaching example of why dynamic routing earns its keep: if a link fails in a statically routed network, an administrator must manually reconfigure around it, whereas OSPF detects the failure and recalculates a new path on its own, which is precisely the resilience the protocol exists to provide.
Inter-VLAN routing
Because VLANs are separate networks, devices in different VLANs cannot talk without a router. Inter-VLAN routing bridges them, classically using a “router-on-a-stick” (a single router interface carrying all VLANs over a trunk, with a subinterface per VLAN) or, more commonly in modern networks, a Layer-3 switch with switched virtual interfaces. This connects Chapter 3’s switching to this chapter’s routing, and it is a frequent simulation topic, so configure it both ways in your lab until the relationship between the trunk, the subinterfaces or SVIs, and the VLANs is obvious.
How to study this chapter
Routing rewards repetition in the lab above all else. Build a topology with two or three routers, configure static routes and a default route, then replace them with single-area OSPF and confirm the neighbours form and the routes populate. Add inter-VLAN routing so traffic crosses between segments. Throughout, lean on the verification commands, show ip route, show ip ospf neighbor, ping and traceroute, because reading the state of a network is as examinable as configuring it.
Chapter 5: IP Services (10%)
IP Services is a smaller area, but it is full of clear, memorable facts and a few protocols you will configure, so it is efficient marks if you do not neglect it. These are the services that make a network usable rather than merely connected.
NAT, DHCP and DNS
Network Address Translation (NAT) lets many devices using private IP addresses share one or a few public addresses, which is how home and enterprise networks reach the internet despite IPv4 address scarcity. The common form, PAT (Port Address Translation), maps many private addresses to a single public address by tracking port numbers, so you should understand the difference between translating addresses one-to-one and overloading many onto one. DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses, masks, gateways and DNS servers to clients, sparing you from configuring every device by hand, and you should be able to configure a basic DHCP pool on a router and understand the request-and-offer exchange. DNS (Domain Name System) resolves human-readable names into IP addresses, the lookup that quietly precedes almost every connection.
NTP, SNMP, syslog and QoS
NTP (Network Time Protocol) synchronises clocks across devices, which matters more than it sounds: without consistent time, logs from different devices cannot be correlated during an incident. SNMP (Simple Network Management Protocol) lets a management system monitor and collect data from network devices, and syslog centralises log messages with severity levels so you can see what devices are reporting. Quality of Service (QoS) is the set of mechanisms for prioritising important traffic, such as voice and video, over less time-sensitive traffic when a link is congested; at the associate level you need the concepts (classification, marking, queuing and why latency-sensitive traffic needs priority) rather than deep configuration. As a teaching example tying NTP to the bigger picture: when you are troubleshooting an outage by comparing logs from a switch and a router, mismatched clocks make the sequence of events impossible to reconstruct, which is exactly why time synchronisation is treated as a service worth configuring.
Chapter 6: Security Fundamentals (15%)
Security Fundamentals brings the defensive layer: understanding the threats a network faces and applying the basic controls that harden devices, filter traffic, and protect access. It is a moderate slice of the exam and pairs naturally with the next step into security-focused certifications.
Threats, and the vocabulary of defence
Start with the landscape: common threat types (malware, denial-of-service, spoofing, on-path attacks where an attacker intercepts traffic) and the core security goals of confidentiality, integrity and availability. You also need the building blocks of access control, the difference between authentication (proving who you are), authorization (what you are allowed to do), and accounting (recording what you did), often delivered through AAA with a central server. This vocabulary frames every specific control that follows.
Access control lists
An access control list (ACL) is a set of rules that permits or denies traffic based on criteria like source and destination address and port, and it is the most configuration-heavy security topic on the exam. You should understand the difference between a standard ACL (filtering on source address only) and an extended ACL (filtering on source, destination, protocol and port), the fact that rules are processed top-down and stop at the first match, and the crucial detail that there is an implicit deny at the end of every ACL, so anything not explicitly permitted is blocked. You should be able to write an ACL to allow or block specific traffic and apply it to the correct interface and direction, because this is a likely simulation. As a teaching example of why order and the implicit deny matter: if a permit rule for general traffic sits above a deny rule for a specific host, the host is never blocked because the earlier permit matches first, and recognising that ordering trap is exactly the reasoning the exam wants.
Device hardening and Layer-2 security
Beyond filtering, you harden the devices themselves. Port security restricts which devices (by MAC address) may use a switch port and can shut the port down if a violation occurs, defending against someone plugging in an unauthorised device. Other Layer-2 protections defend against attacks that abuse switching features, such as DHCP snooping and dynamic ARP inspection at a conceptual level. Device hardening also covers the basics that are easy marks: using SSH rather than Telnet for management because SSH is encrypted, setting strong passwords and enabling them in encrypted form, and limiting management access. Finally, understand at a high level what a VPN is (a secure, encrypted tunnel across an untrusted network) and the role of wireless security standards in protecting Wi-Fi.
Chapter 7: Automation and Programmability (10%)
Automation and Programmability is the smallest topic area and the one candidates most often skip, which is a mistake, because it is growing in importance and the marks are gettable once you grasp a handful of concepts. This area reflects how modern networks are increasingly managed by software rather than device by device.
Why networks are becoming programmable
Traditionally, an engineer configures each device individually through its command line. As networks grow, that becomes slow and error-prone, so the industry is shifting toward automation: defining the network’s desired state in code and letting tools apply it consistently across many devices. You should understand the benefits this brings, fewer manual errors, faster and repeatable changes, and consistency at scale, and the contrast between the traditional, device-by-device model and an automated, software-driven one. This is the conceptual frame for everything else in the chapter.
Controller-based networking and the data and management planes
Modern architectures often separate the control plane (the decisions about how traffic should flow) from the data plane (the actual forwarding of packets), and centralise the control logic in a controller that manages many devices through a single point. Software-defined networking (SDN) is the umbrella term for this approach, and Cisco’s controller platforms are the concrete example. For the exam, understand the idea of a central controller pushing configuration and policy to devices, and how that differs from configuring each box by hand.
APIs, data formats and configuration management
The glue of network automation is the API (application programming interface), and specifically the REST API, a web-based interface that lets software read from and configure network devices over HTTP using standard methods. Closely related are the data formats that carry this information: JSON above all, a human-readable, structured format of key-value pairs, plus XML and YAML. You should be able to recognise well-formed JSON and understand that it is how automation tools and APIs exchange data. Finally, know the purpose of configuration management tools (such as Ansible, Puppet and Chef at a conceptual level) that automate the deployment and enforcement of configuration. As a teaching example to make REST and JSON concrete: instead of logging into fifty switches to read their status, an automation script can send one REST request and receive the answer as JSON it can parse, which is precisely the efficiency this topic area is testing your awareness of.
Chapter 8: Study plan, the lab habit, and exam day
With the six areas understood, the remaining work is pacing them around a lab so that nothing, least of all routing practice and the automation content, gets squeezed out at the end. Three things drive the plan: the topic weights, the central role of subnetting, and the fact that this exam is configured, not just read.
Set up your lab and your subnetting habit first
Before anything else, install Cisco Packet Tracer (free via the Cisco Networking Academy) and commit to two daily habits from week one: configure something in the lab most days, and do a few subnetting problems every day. These two habits, sustained over the whole plan, are worth more than any single resource, because they target the two things that most often decide the result, command-line fluency and addressing speed. Pair the lab with Cisco’s official exam topics so the syllabus, not a random course, defines your scope.
Choose a timeline and weight it by the exam
A balanced self-study plan runs about twelve weeks at eight to ten hours a week, and the chapter order in this guide maps onto it: weeks one to three on fundamentals, addressing and subnetting; weeks four to six on switching, VLANs, trunking, spanning tree and wireless; weeks seven to nine on routing concepts, static routing and OSPF; and weeks ten to twelve on IP services, security, automation, and then timed reviews. If you already work in IT, an eight-week intensive at around fifteen hours a week compresses the same sequence with heavy lab work throughout. If you are new to networking, a gentler sixteen-week plan at five to six hours a week spends longer on fundamentals and addressing before routing and automation. Whichever you pick, weight your hours toward IP Connectivity and Network Access, the largest areas, while keeping the smaller services, security and automation areas genuinely covered rather than skimmed. To turn a timeline into dated weeks for your own start date, use the free study-plan generator.
Practise the simulations, and practise committing to answers
The simulations are what set the CCNA apart, so the only real preparation for them is doing them: recreate each topic in Packet Tracer and type the commands yourself, configuring VLANs and trunks, bringing up OSPF, applying an ACL, and troubleshooting a broken link, until both the configuration and the verification commands (show, ping, traceroute) are automatic. Just as important, practise the exam’s no-going-back constraint. Because you cannot return to a previous question, rehearse giving each question your best answer and moving on, and never let a single time-consuming simulation strand you with the clock running. If you are weighing the CCNA against the vendor-neutral alternative before committing, the CCNA vs Network+ comparison covers depth, recognition and which to take first.
Exam day and format
On the day, the exam is roughly 100 to 120 questions in about 120 minutes, delivered at a Pearson VUE test centre or via online proctoring, with a mix of multiple-choice, drag-and-drop and hands-on simulations, and you will need government-issued identification. Manage the clock deliberately: the simulations are the most time-consuming items, so do not let one consume minutes you need elsewhere, and remember you cannot revisit anything once you move on. Bring the same layered, evidence-based reasoning you practised in the lab, identify which layer or device a problem sits at, configure or answer decisively, verify when you can, and keep moving. Having configured these topologies many times over the weeks, the simulations will feel like familiar work rather than a surprise, which is exactly the advantage the lab habit was built to give you.