Cisco CCNA 200-301 v2.0 Cheat Sheet

Upcoming exam: v2.0 testing starts February 3, 2027. Testing earlier? Use CCNA v1.1 .

Use this CCNA v2.0 cheat sheet to connect symptoms with evidence and safe corrections. For worked cases, open the scenario guide . Examples use Cisco IOS/IOS XE conventions; choose commands supported by your lab image and device. They are illustrative configurations and outputs, not captured results from a production network.

Start at the first failing boundary

    flowchart TD
	    A["Client cannot reach an application"] --> B["Check link, wireless access and host configuration"]
	    B --> C["Check local VLAN and gateway reachability"]
	    C --> D["Check routes, next hops and the return path"]
	    D --> E["Check ACLs, translation and transport"]
	    E --> F["Check DNS and the application service"]
	    F --> G["Retest from the affected client"]

This is a way to organize evidence, not a command to repeat every test during every incident. If the exhibit already proves a boundary works, use that fact. A gateway ping does not prove remote DNS; an IP-based application test does not establish a correct DNS record. A failed ICMP test may reflect filtering rather than application failure.

Addressing calculations and host evidence

For IPv4 prefix p, total addresses are 2^(32-p). On an ordinary broadcast subnet, usable hosts are two fewer. /31 point-to-point links and /32 host routes have different uses.

192.0.2.146/28 belongs to network .144, with usable addresses .145–.158 and broadcast .159. Gateway .145 is on-link; .161 is not. An overly broad mask can make a host ARP locally for a destination that it should send to its gateway. That produces a different symptom from an absent default route on the router.

For IPv6, distinguish global unicast, unique local, link-local, multicast and anycast. There is no broadcast. Neighbor Discovery and Router Advertisements use ICMPv6; a link-local next hop needs an unambiguous outgoing link. A configured global address does not prove router discovery or remote reachability.

A /64 leaves 64 interface-identifier bits. With modified EUI-64, MAC 00:11:22:33:44:55 produces identifier 0211:22ff:fe33:4455: insert ff:fe, then invert the universal/local bit. Other address-generation methods exist; do not reverse-engineer every interface identifier as a MAC address.

On hosts, inspect the actual interface configuration and route: ipconfig /all on Windows, ip addr and ip route on Linux, or ifconfig and route -n get default on macOS. Select the command for the operating system shown in the exhibit.

DHCPv4: client, relay and server

The client broadcasts initially; a router does not simply forward that broadcast into every other subnet. A relay can send DHCP traffic to a remote server. The relay address helps the server select the client subnet’s pool.

This example assumes a Layer 3 switch routes VLAN 20 and can reach a DHCP server at 198.51.100.10:

interface Vlan20
 ip address 192.0.2.1 255.255.255.192
 ip helper-address 198.51.100.10
 no shutdown

Check the VLAN/SVI state, server reachability, matching pool, available leases, return routing and permitted DHCP traffic. Configure the relay where the client broadcast arrives, rather than guessing an upstream interface.

If IOS supplies the addresses directly, the pool must match the client network. This separate example uses the same subnet in an alternative local-server lab:

ip dhcp excluded-address 192.0.2.1 192.0.2.9
ip dhcp pool USERS
 network 192.0.2.0 255.255.255.192
 default-router 192.0.2.1
 dns-server 198.51.100.53

Use show ip dhcp pool and show ip dhcp binding; then renew a test client and inspect its options. A lease with the wrong gateway can be a server configuration fault even though the exchange completed. For relay and server behavior, consult Cisco’s DHCP configuration guide .

Switching, LACP and edge connectivity

A physical link, VLAN membership and forwarding state are separate facts. Check show interfaces status, show vlan brief, show interfaces switchport, show interfaces trunk and show spanning-tree vlan 20 according to the symptom. CDP/LLDP can reveal that a cable terminates on a different port or neighbor than the drawing claims.

An SVI is a Layer 3 interface for a VLAN. Its line protocol depends on platform conditions such as the VLAN being active and having a suitable active forwarding port; merely entering an IP address is insufficient. PoE adds another boundary: a correct VLAN cannot power an endpoint when the switch has insufficient power budget or incompatible power delivery.

For LACP, at least one peer initiates with active; two passive peers do not negotiate a bundle. Check member consistency and show etherchannel summary. This trunk-port-channel excerpt assumes two compatible ports on each switch:

interface range GigabitEthernet1/0/1 - 2
 switchport mode trunk
 switchport trunk allowed vlan 20,30
 channel-group 1 mode active
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 20,30

Verify both ends. The channel number is locally significant; mismatched VLAN carriage still causes faults even when negotiation succeeds. See Cisco’s EtherChannel guide .

Rapid PVST+ and protection boundaries

Know the intended root and inspect the actual root for the affected VLAN. Lowest bridge ID wins; a non-root switch selects its root port using path cost and tie-breakers. A blocked alternate path can be healthy redundancy, not lost capacity requiring STP removal.

Do not confuse an intentional protection action with the original cause. Recover service by correcting the topology or trust assignment, not merely disabling the safeguard.

For feature behavior and configuration details, use Cisco’s spanning-tree protection guide .

Route lookup and resilient gateways

Longest-prefix match chooses among installed routes. Administrative distance compares competing sources for the same prefix; the routing protocol’s metric selects paths within its own calculation. A default route cannot beat an installed matching /24 because it has a lower administrative distance.

For destination 10.60.4.7, a matching 10.60.4.0/24 is preferred to 10.60.0.0/16 and 0.0.0.0/0. A 10.60.4.128/25 does not match. Predict the next hop first, then inspect its resolution and the reverse path. show ip route explains route knowledge; show ip cef can help inspect the IPv4 forwarding information on supported platforms.

A floating static route uses a less preferred administrative distance for a competing prefix. Test failure and restoration of the preferred path. An interface remaining up is not proof that a remote destination remains reachable, so understand exactly what failure your backup design detects.

For HSRP or VRRP, inspect the virtual gateway, local/peer states, priorities and any tracking. The client should normally use the virtual gateway rather than one physical router address. HSRP active/standby and VRRP master/backup are different protocol terms. show standby brief and show vrrp brief answer status questions; ping from the affected VLAN tests the client-facing result.

OSPFv2 and OSPFv3: neighbors and routes

A neighbor relationship and a learned destination route are separate outcomes. Inspect area membership, participating interfaces, timers, link addressing, router IDs and network type. Process IDs are local. OSPFv3 for IPv6 still uses a 32-bit router ID; an IPv6-only device can need an explicit value.

The following uses the IOS XE OSPFv3 address-family syntax. Its peer requires compatible area/network settings, a distinct router ID and an address on the shared link:

ipv6 unicast-routing
router ospfv3 10
 router-id 1.1.1.1
 address-family ipv6 unicast
 exit-address-family
interface GigabitEthernet0/0
 ipv6 address 2001:db8:12::1/64
 ospfv3 10 ipv6 area 0
 no shutdown

Verify using show ospfv3 neighbor, show ospfv3 interface and show ipv6 route. Some images use the earlier ipv6 router ospf / ipv6 ospf syntax instead; follow one documented syntax family consistently. See Cisco’s OSPFv3 address-family guide .

On broadcast networks, two DROTHERs can remain 2-Way with each other while correctly becoming adjacent to the DR/BDR. Do not demand Full between every pair. v2.0 explicitly includes both OSPFv2 and OSPFv3 configuration; the stated neighbor-adjacency objective excludes authentication.

Services and security checkpoints

For an ACL change, test an allowed flow and a prohibited flow. Removing a deny may fix the symptom while violating the requirement. Inspect NAT and ACL processing in the actual platform/direction instead of assuming translated and original addresses are interchangeable.

DNS records

A mail-delivery failure can require inspecting MX and its target’s address records. A PTR change is not a substitute for correcting the forward address used by a web client. Query the resolver actually used by the affected host and account for caching.

AI, Ansible and operational evidence

Treat AI-generated diagnoses as hypotheses. A useful prompt gives the task, sanitized evidence, constraints and requested output. For example:

Act as a network troubleshooting assistant.
Use only the sanitized topology and show output below.
Identify the first unsupported assumption in the proposed diagnosis.
Return: evidence, two plausible causes, one distinguishing read-only check.
Preserve the existing inter-VLAN access restrictions.
Do not include credentials or infer missing configuration as fact.

Ansible command execution should have an explicit inventory, target scope and transport/credentials configured outside public examples. A read-only command task still needs the correct device collection and platform support. Review results and failures per host; “the playbook ran” is not equivalent to “every device returned the expected state.” The scenario guide shows an example.

For syslog, lower numeric severity means greater urgency: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notification, 6 informational, 7 debugging. A configured threshold commonly includes that level and more urgent levels. Read the facility/mnemonic, device, timestamp and message as well as the number. SNMP polling and notifications supply operational evidence; neither replaces verification of the user’s service.

Use the blueprint to check task depth and the study plan to schedule the missing labs. Repeat scenarios with changed addresses and conditions so a familiar answer position does not substitute for reasoning.

Put the review into practice

Scope checked September 13, 2026 against Cisco’s v2.0 exam topics and Cisco’s version-transition announcement .