CCNA 200-301 Cheat Sheet

Exam at a glance

Cisco does not publish a fixed question count or an official passing score for CCNA; treat "know every domain well" as the standard rather than chasing a magic number.

Domains and weightings (v1.1)

IP Connectivity is the single heaviest domain — routing is where the most points live.

1.0 Network Fundamentals

The reference models:

• OSI model (7 layers) — the conceptual map of how data moves, bottom to top: Physical, Data Link, Network, Transport, Session, Presentation, Application (mnemonic: Please Do Not Throw Sausage Pizza Away).
• TCP/IP model — the practical stack the internet actually runs on; its layers map onto OSI as Application (5-7), Transport (4), Internet (3), and Link (1-2).

Transport protocols:

• TCP — connection-oriented and reliable: it sequences data and retransmits what's lost, so it suits web, email, and file transfer.
• UDP — connectionless and low-overhead: no ordering or retransmission, which suits real-time and lookup traffic like DNS, DHCP, VoIP, and streaming.

Addressing:

• IPv4 private ranges — non-internet-routable blocks used inside networks: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
• IPv6 — 128-bit addresses written in hexadecimal to escape IPv4 exhaustion; FE80::/10 is link-local and SLAAC lets a host configure its own address.

Physical connectivity:

• Straight-through vs crossover cabling — straight-through connects unlike devices (PC↔switch), crossover connects like devices (switch↔switch); modern auto-MDIX ports sort this out on their own.

2.0 Network Access

VLANs and trunking:

• VLAN — a logical segment that splits one physical switch into several separate broadcast domains, isolating traffic by group.
• Access port — a switch port assigned to a single VLAN, typically connecting one end device.
• Trunk port (802.1Q) — a port that carries many VLANs between switches by tagging each frame with its VLAN ID.
• Native VLAN — the one untagged VLAN on a trunk; it must match on both ends or frames land in the wrong VLAN.

Loop prevention and link bundling:

• Spanning Tree Protocol (STP) — prevents Layer 2 loops by blocking redundant paths, electing the switch with the lowest bridge ID as root (Rapid PVST+ is the faster common variant).
• EtherChannel — bundles several physical links into one logical link for more bandwidth and redundancy, negotiated with LACP or PAgP.

Wireless:

• Wireless basics — access points (APs) provide Wi-Fi, a wireless LAN controller (WLC) manages many APs centrally, SSIDs name the networks, and WPA2/WPA3 secure them.

3.0 IP Connectivity (heaviest domain)

How a router chooses a path:

• Route selection order — the router prefers the longest prefix match first, then the lowest administrative distance, then the lowest metric.
• Administrative distance (AD) — a trust rating for where a route came from (Connected 0, Static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120); lower is more trusted.

Routing methods:

• Static routes — manually configured paths (ip route <dest> <mask> <next-hop>); a default route (0.0.0.0 0.0.0.0) catches anything not matched elsewhere.
• OSPF — a link-state protocol that picks paths by cost (reference bandwidth ÷ link bandwidth), forms neighbor adjacencies, and groups routers into areas with area 0 as the backbone.

Gateway redundancy:

• First-hop redundancy (HSRP/VRRP) — presents hosts a single virtual gateway IP that keeps working if the active router fails.

4.0 IP Services

• NAT / PAT — Network Address Translation maps private addresses to public ones; PAT (overload) lets many hosts share one public IP by tracking port numbers.
• DHCP — automatically hands hosts their IP settings through the DORA exchange: Discover, Offer, Request, Acknowledge.
• DNS — resolves human-readable names to IP addresses.
• NTP — synchronizes clocks across devices, which matters for accurate logs and valid certificates.
• QoS — classifies and prioritizes traffic so latency-sensitive voice and video beat bulk data.
• SNMP / Syslog — SNMP polls devices for monitoring; Syslog centralizes event messages (severity 0 = emergency … 7 = debug).

5.0 Security Fundamentals

• CIA triad — the three security goals: Confidentiality (keep data private), Integrity (keep it unaltered), Availability (keep it reachable).
• Port security — restricts which and how many MAC addresses a switch port will accept, keeping unauthorized devices off.
• DHCP snooping — blocks rogue DHCP servers by only trusting DHCP replies from approved ports.
• Dynamic ARP Inspection — stops ARP spoofing by validating ARP messages against known-good address bindings.
• ACLs — access control lists that permit or deny traffic; standard ACLs (numbered 1-99) filter by source only, extended ACLs filter by source, destination, port, and protocol. First match wins, with an implicit deny any at the end.
• AAA — Authentication, Authorization, and Accounting, usually centralized with RADIUS or TACACS+.
• Layer 2 threats — switching-layer attacks such as VLAN hopping, MAC flooding, and ARP spoofing.

6.0 Automation and Programmability

• Controller-based networking (SDN) — separates the control plane (decisions) from the data plane (forwarding) and manages the network centrally, e.g., Cisco DNA Center (now Catalyst Center).
• REST APIs — let programs configure and query devices over HTTP using the verbs GET/POST/PUT/DELETE, usually exchanging JSON.
• Data formats — JSON (key/value pairs in curly braces) is the common one; recognize XML and YAML on sight too.
• Configuration management — tools that push consistent config at scale: Ansible (agentless, YAML playbooks), plus Puppet and Chef; know them at a conceptual level.

Subnetting quick reference

The exam rewards fast subnetting. Memorize the mask-to-hosts mapping:

Usable hosts = 2^(host bits) − 2. Block size in the interesting octet = 256 − mask value.

Study tips

• Build it, don't just read it. Packet Tracer or Cisco Modeling Labs turns abstract routing into muscle memory — the simulation questions expect hands-on fluency.
• Subnet until it's reflexive. Being able to subnet in your head under time pressure is worth more raw points than almost anything else.
• Learn the CLI verbs, not just concepts: show ip interface brief, show ip route, show running-config, show cdp neighbors.
• The exam is a single 120-minute sitting — pace yourself; you cannot go back on some item types.

What changes in v2.0 (first testable 3 February 2027)

Cisco's v2.0 blueprint reorganizes into five domains and modernizes the content:

The headline change is a formal AI and network-operations domain — candidates may be asked to evaluate output from agentic AI and digital network assistants. Reporting on the new blueprint also notes a stronger troubleshooting emphasis and the removal of some older topics. If your exam is booked for 3 February 2027 or later, study the v2.0 topics; before then, the v1.1 domains above are what you will be tested on.

---

Go deeper: pair this with the Linux Command Line Essentials tutorial (the servers behind those networks run Linux), and see the Security+ cheat sheet if you are stacking certifications. Everything here was verified against Cisco's official CCNA exam topics on 19 August 2026 — always confirm the current blueprint on Cisco's site before your exam.