Cisco CCNA 200-301 v1.1 Cheat Sheet

Current exam: v1.1 is available through February 2, 2027. Testing later? Use CCNA v2.0 .

Use this CCNA v1.1 cheat sheet for fast recall, then work through the scenario guide when you need to explain a diagnosis. The examples use small lab networks and Cisco IOS/IOS XE conventions. Interface names and supported commands vary by device and release.

Follow one packet before changing configuration

A host first decides whether the destination is on its own subnet. For a remote IPv4 destination, it normally resolves the gateway’s MAC address with ARP and sends the frame to that gateway. The router selects a route, decrements TTL and constructs the next Layer 2 frame. Without translation, the IP source and destination remain the endpoints; Ethernet addresses change at routed boundaries.

    flowchart TD
	    H["Host: 192.0.2.10/26"] --> D{"Is the destination local?"}
	    D -->|Yes| L["ARP for destination; send locally"]
	    D -->|No| G["ARP for gateway 192.0.2.1"]
	    G --> R["Router: longest matching prefix"]
	    R --> N["Resolve next hop; forward in a new frame"]
	    N --> B["Check the return path too"]

A successful gateway ping proves less than successful application access. It does not establish remote routing, DNS, TCP permission or a listening service. Conversely, failed ping alone does not prove an application is unavailable: ICMP may be filtered.

IPv4 subnetting: boundaries before host counts

For prefix length p, an IPv4 block contains 2^(32-p) addresses. An ordinary broadcast subnet has two reserved endpoints, giving 2^(32-p)-2 usable host addresses. Treat /31 point-to-point addressing and /32 host routes separately.

Worked check: 192.0.2.77/27 falls in the block beginning at 64. Its network is 192.0.2.64, broadcast is 192.0.2.95, and usable range is .65–.94. The next network starts at .96. A gateway of 192.0.2.97 would be outside this host’s subnet.

For variable-length subnetting, allocate the largest required block first, align every allocation to its block boundary and check for overlap. A requirement for 50 ordinary hosts needs a /26; a /27 supplies only 30. Count the gateway and other addressed infrastructure in the requirement.

IPv6 distinctions worth recalling

Neighbor Discovery uses ICMPv6 rather than ARP. Router Advertisements support router discovery and can advertise prefix information. DHCPv6 does not replace Router Advertisements as the normal source of default-router information.

A /64 contains 64 prefix bits and 64 interface-identifier bits. Modified EUI-64 inserts ff:fe into the MAC-derived identifier and flips the universal/local bit: MAC 00:11:22:33:44:55 yields interface identifier 0211:22ff:fe33:4455. Do not assume every IPv6 interface uses EUI-64; manually assigned and privacy-oriented identifiers also exist.

Switching: membership, transport and forwarding are separate

A switch learns from the source MAC address. It forwards a known unicast toward its learned port and floods an unknown unicast within the VLAN, subject to forwarding state. A VLAN is a Layer 2 broadcast domain; communication between different IP subnets normally requires routing.

This endpoint-port example creates VLAN 20 and assigns a port to it:

vlan 20
 name USERS
interface GigabitEthernet1/0/12
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
 spanning-tree bpduguard enable

PortFast and BPDU guard here assume a designated end-host edge port. If a switch is connected instead, investigate the topology and policy before re-enabling a port that BPDU guard disabled. The command sequence alone does not supply a gateway or permit VLAN 20 across upstream trunks.

LACP and spanning tree

LACP needs at least one side in active mode; two passive peers do not initiate negotiation. Members also need compatible characteristics. Inspect the bundle and its members, rather than treating two lit links as proof of an operational EtherChannel. A single flow generally hashes to one member; an aggregate does not imply one flow can use the sum of all link rates. See Cisco’s EtherChannel configuration guide .

Rapid PVST+ builds a spanning tree per VLAN. Lowest bridge ID wins root election; a non-root switch chooses its root port using the best path to the root. On each segment, the designated port forwards toward that segment; an alternate port can provide a backup path. Apply cost and tie-break rules to the stated topology, not to switch names such as “Core.”

For feature behavior and configuration details, use Cisco’s spanning-tree protection guide .

Routing: three comparisons, in the correct place

1. Route installation: for competing sources of the same prefix, administrative distance expresses local trust in the source.
2. Protocol path calculation: a routing protocol uses its own metric to choose paths. Metrics from unrelated protocols are not one common scale.
3. Packet forwarding: among installed matching routes, the longest prefix wins.

A floating static route has a higher administrative distance than the preferred route to the same prefix. It becomes useful when that preferred route disappears; a different, more specific prefix is a separate comparison.

ip route 198.51.100.0 255.255.255.0 192.0.2.2
ip route 198.51.100.0 255.255.255.0 192.0.2.6 200
ipv6 route 2001:db8:20::/64 GigabitEthernet0/0 fe80::2

These are illustrative static routes with assumed reachable next hops. A route can be installed without proving the remote service works. Inspect the return route, filtering and endpoint as well.

Single-area OSPFv2

Use show ip ospf neighbor, show ip ospf interface and show ip route ospf together. Check link addressing, area, timers, network type and whether the interface participates actively. A local process ID does not have to equal the neighbor’s process ID. Router IDs identify routers and should be unique.

On broadcast networks, DR/BDR roles reduce adjacency requirements. Two DROTHER routers can correctly remain in 2-Way with each other; “not Full” is not automatically a fault. On a two-router point-to-point adjacency, you normally expect Full after synchronization. Understand DR/BDR election and its non-preemptive behavior before predicting that a newly connected high-priority router immediately takes over.

FHRPs provide a resilient first-hop gateway. For v1.1, focus on their purpose; the upcoming blueprint explicitly adds HSRP/VRRP operational-status interpretation and OSPFv3 configuration.

Services and security: use the matching evidence

For an ACL, write the packet’s source, destination, protocol and relevant ports at the interface where it is evaluated. Entries are considered in order; the first match decides, and unmatched traffic meets an implicit deny. A permit in the wrong direction does not satisfy the requirement. Standard IPv4 ACLs match source addresses; extended ACLs support additional packet fields. See Cisco’s IP ACL guide .

DHCP snooping helps establish trusted DHCP-message paths and bindings; Dynamic ARP Inspection checks ARP against valid information. Port security restricts source MAC usage. AAA separates authentication, authorization and accounting. A VPN addresses protected transport, while a WLAN security setting governs wireless access; choose the control for the actual boundary.

Wireless and automation: retain the conceptual work

For wireless faults, distinguish RF/association, authentication, address assignment and application access. A visible SSID proves none of the later stages. Channel overlap, interference and attenuation are different from incorrect credentials. Know how autonomous and controller-based designs place their management and forwarding functions.

REST questions often ask what an operation means, not how to write a complete application. GET retrieves a representation; POST commonly creates or invokes processing; PUT replaces a resource representation; DELETE requests removal. Judge the response status and payload in context rather than assuming every request succeeds.

{
  "interfaces": [
    {"name": "GigabitEthernet1/0/12", "enabled": true, "vlan": 20}
  ]
}

Here, interfaces is an array containing an object; enabled is a Boolean and vlan is a number. This is illustrative JSON, not a promised Cisco API schema. Recognize configuration-management and infrastructure-as-code purposes, along with generative/predictive AI and machine-learning uses. Validate an AI recommendation against the network facts; persuasive prose is not operational evidence.

Turn this sheet into a final review

Cover the evidence column in each table and supply a useful check from memory. Recalculate the subnet example with a different address. Explain why the route decision changes—or stays the same—when one prefix is removed. Use the study plan to turn any hesitant explanation into a lab, then try mixed practice .

Put the review into practice

Scope checked September 13, 2026 against Cisco’s v1.1 exam topics and Cisco’s version-transition announcement .