CCNA Master Guide 2026

What CCNA covers

CCNA validates foundational networking knowledge across Network Fundamentals, Network Access, IP Connectivity, IP Services, Security Fundamentals, and Automation and Programmability. It is a broad associate-level credential for people who configure, operate, and troubleshoot networks. It is not a guarantee of a job title or a substitute for practical experience with a particular employer's equipment and procedures.

The Cisco exam page identifies the current exam as 200-301 CCNA v1.1 and gives a 120-minute duration. Cisco does not publish a fixed question count on the reviewed page. It also does not publish a universal fixed passing score. Do not rely on an old blog that asserts a fixed number of questions or a score such as 825 unless Cisco itself publishes that rule for the version you take.

The current v1.1 domain weights

IP Connectivity is the largest domain, but the other areas combine in real questions. A VLAN problem can require understanding trunks and spanning tree; a host that cannot reach a remote subnet may involve addressing, gateway configuration, routing, and an access list. Study the weights as an allocation guide, not as a promise of exact item counts. Cisco does not publish an item quota for each form.

What the exam asks you to understand

Network Fundamentals

You should be able to distinguish common network roles and architectures, interpret physical interfaces and media, and reason about traffic at a foundational level. Learn the purpose of access, distribution, and core layers; compare two-tier, three-tier, spine-leaf, WAN, SOHO, on-premises, and cloud-connected designs at the level required by the outline. Understand copper and fiber characteristics, speed and duplex, and basic wireless properties. For protocols, distinguish TCP's connection-oriented delivery and recovery features from UDP's lower-overhead datagram behavior.

Addressing deserves repeated practice. Given an IPv4 prefix, determine network, usable range, broadcast address, and whether two hosts share a subnet. Understand private IPv4 ranges, IPv6 address forms, link-local and global unicast concepts, and the role of a default gateway. Switching basics include how a switch learns source MAC addresses, forwards known unicast frames, and floods unknown unicast or broadcast traffic within a VLAN.

Network Access

Know how VLANs segment a switched network and how access ports differ from trunks. A voice VLAN and data VLAN may share an access edge but remain logically distinct. Trunks carry tagged VLAN traffic between switches; an allowed VLAN list and native VLAN mismatch can create reachability or security problems. Inter-VLAN communication requires a Layer 3 function such as a router or multilayer switch.

EtherChannel groups multiple physical links into a logical link, often using LACP. Spanning Tree Protocol prevents Layer 2 loops by selecting a root bridge and placing redundant paths into appropriate states. Be able to reason about root selection and common edge safeguards such as PortFast and BPDU Guard. Wireless tasks include basic WLAN architecture, access points and controllers, authentication and encryption choices, and interpreting a simple WLAN configuration.

IP Connectivity

Routing is the largest domain because a network must choose a next hop that reaches the destination. Read a routing table by looking for the destination prefix, route source, administrative distance or metric where shown, and outgoing interface or next hop. Longest-prefix match selects the most specific matching route. Connected and local routes describe directly configured interfaces; static routes are explicitly configured; a routing protocol can learn routes dynamically.

Practice IPv4 and IPv6 static routing, including default routes and host routes, and understand how a route can be present but unusable if its next hop cannot resolve. The CCNA scope includes single-area OSPF concepts. Focus on neighbor formation, router IDs, network reachability, and the role of the protocol in sharing routes rather than memorizing complex enterprise designs outside the associate outline.

IP Services

Services make a network manageable and useful. DHCP assigns host configuration; DNS resolves names; NAT translates addresses; NTP synchronizes clocks. SNMP supports monitoring, syslog centralizes device messages, and QoS prioritizes selected traffic under congestion. Secure management uses SSH rather than an unprotected remote terminal protocol. Know the purpose and common failure symptoms of these services: wrong DHCP scope, bad DNS response, missing NAT translation, clock drift, or a syslog target that never receives events.

Security Fundamentals

Security includes threat awareness, device access controls, password protection, access control lists, Layer 2 security, WLAN protection, VPN concepts, and AAA. Apply least privilege to administrative access and protect management interfaces. An ACL is evaluated by ordered rules and an implicit deny at the end; placement and direction matter. Port security or DHCP snooping concepts help protect access-layer behavior. Be able to select a control for a stated risk rather than simply naming a security feature.

Automation and Programmability

Modern networks use controllers, APIs, and structured data to manage more devices consistently. Understand the difference between traditional device-by-device management and controller-based approaches, as well as underlay and overlay ideas. JSON represents structured key-value data; REST APIs commonly use HTTP methods and responses. Tools such as Ansible and Terraform automate configuration or infrastructure workflows, but the exam expects foundational recognition and interpretation, not advanced software engineering.

Exam format, score, and fees

The official duration is 120 minutes. Cisco's reviewed exam detail page does not disclose a fixed question count or confirm which exact interactive item formats candidates will see. The topics require interpreting and carrying out networking configurations, but do not promise a particular simulation or performance-based question interface unless Cisco publishes it. Practice the concepts and configuration reasoning without assuming a study tool can reproduce a secure live exam simulation.

Cisco reports pass or fail and does not publish a fixed passing-score number on the reviewed official pages. A candidate should not equate a practice-bank percentage with Cisco's result. Cisco's statistical standard can change, and the public policy does not support a permanent raw cutoff. Treat practice metrics as evidence of your own progress within that resource, not an official score prediction.

Cisco lists US$300 for the exam. The amount can differ by region, currency, tax, or voucher terms. A failed attempt requires a five-calendar-day wait beginning the day after failure and a new paid exam registration. The exam is valid for three years. Cisco's certification program provides renewal options through eligible exams and continuing education; renewal is separate from the initial exam fee.

The 2027 version change

Cisco lists February 2, 2027 as the last date to test 200-301 v1.1 and February 3, 2027 as the first date for v2.0. These dates define a clear transition. Candidates scheduling before the final v1.1 date should use the v1.1 topic list and materials. Candidates booking from February 3 onward should use v2.0 objectives. Do not mix an older study guide's task list with a future exam simply because both use the CCNA name.

A candidate preparing near the transition should consider the 5-day failed-retake wait, available appointment dates, and the time needed to revise to a new blueprint. If a first attempt is close to February 2, there may not be enough time for a retake on v1.1 after a failure. Once Cisco publishes detailed v2.0 topics, compare them line by line with current materials and add or remove areas accordingly.

A practical study approach

Start with a baseline across all six domains. Test subnetting, VLAN and trunk interpretation, route selection, common services, device security, and API or automation concepts. Mark each gap by whether it is conceptual, procedural, or a reading error. A candidate who knows a command but cannot predict its effect needs scenario practice; one who does not understand a prefix needs a fundamentals lesson and repeated calculation work.

1. Learn the current official topic list and note the version of the exam you will book.
2. Build foundations in addressing, Ethernet, switching, routing, and common services before memorizing command syntax.
3. Use a simulator or lab to configure small topologies and observe the result. Verify that each lab maps to an official topic.
4. Mix configuration practice with interpretation: inspect a route table, VLAN config, ACL, or wireless setting and predict behavior before checking.
5. Take timed mixed practice, review errors by concept, and revisit weak domains using new examples.
6. Near test day, verify appointment instructions and the version shown in the booking account.

A compact lab is better than a large topology you cannot explain. For example, configure two VLANs, a trunk, and a router-on-a-stick gateway; verify which hosts can communicate, then introduce a native VLAN or allowed-list error and observe the symptom. For routing, create a directly connected network and a static route, then inspect the table and test reachability. Record both the intended configuration and how you would troubleshoot an unexpected result.

Who should take CCNA

CCNA can suit learners beginning a networking career, IT support staff expanding into network operations, and administrators who want a structured baseline across routing, switching, security, and automation. It can also help experienced engineers validate breadth, although hands-on practice remains valuable. There is no Cisco experience requirement listed for registration. Familiarity with basic computer systems and willingness to work through IP addressing makes preparation more efficient.

The certification does not guarantee a job, promotion, or salary. It signals that the holder passed Cisco's associate-level exam. Employers may separately assess troubleshooting, customer communication, scripting, cloud networking, vendor-specific equipment, and production experience. Present the credential accurately alongside labs and work examples.

Consider a troubleshooting case from host to application. A workstation can reach another host in its VLAN but cannot reach a remote service by name. First verify the workstation address, mask, and gateway. If it can reach the gateway, inspect the route from the gateway to the destination. If reachability by IP works but the name fails, investigate DNS. If only one VLAN fails, check access-port membership and whether the trunk carries that VLAN. Security rules may also filter the path. This sequence keeps a candidate from changing routing before confirming the local layer.

The exam's six domains are connected in practice. A DHCP scope can give a host a bad mask, which makes it send remote traffic incorrectly. A trunk that omits a VLAN can make a gateway appear down to one group of users. An ACL applied in the wrong direction can block a flow whose routes are correct. A wireless client can authenticate but remain isolated by a policy. Study each domain on its own first, then practice mixed cases that require choosing which evidence to gather next.

Use Cisco's published weights as an initial allocation, not a rigid schedule. If you have 40 hours, proportional time starts around eight hours each for Network Fundamentals and Network Access, ten for IP Connectivity, four for IP Services, six for Security Fundamentals, and four for Automation. A learner who already routes networks may move those hours toward wireless, services, and automation. Someone new to subnetting may need extra time on Fundamentals. A diagnostic should change the original plan when it shows repeated errors.

The public exam page does not publish a fixed question count or a fixed passing-score number. Do not treat old exam blogs, practice-test percentages, or exam forum recollections as current Cisco policy. A practice platform can help you find errors and build pacing, but it cannot state how many live questions Cisco will present or convert its own score into Cisco's pass decision. The official exam result is pass or fail under Cisco's standard; preparation should target skill breadth, not an unsourced numerical cutoff.

Version timing should appear in a candidate's study plan. Cisco lists February 2, 2027 as the last test date for v1.1 and February 3 as the first date for v2.0. If you sit v1.1, use its objectives and aligned resources. If you book v2.0, wait for its official topic list and map each objective to preparation. The five-calendar-day failed retake wait is a minimum and does not ensure a slot before the old version closes. Build a buffer around both policy and appointment availability.

The most productive study materials pair concepts with verification. A chapter can explain what a trunk is, but a lab can show how traffic disappears when the allowed list excludes a VLAN. A route-selection lesson can be verified by comparing candidate prefixes. A security lesson can be tested by walking packets through ordered ACL entries. Build a feedback loop: learn, predict, test, explain, and revisit. This rhythm prepares candidates to answer a new question rather than reproduce a memorized demonstration.

Candidates should set expectations about what the certification does not prove. Passing CCNA is a meaningful milestone in network fundamentals, but it does not establish years of production ownership, mastery of every vendor platform, or competence in every security and cloud specialty. Job requirements vary. Pair the credential with accurate examples of labs, troubleshooting work, customer support, or network changes. Avoid promises of salary or employment outcomes in study advice.

Before paying for a course or simulator, make a list of your gaps and the official objectives they map to. If you cannot subnet, a route simulator will not teach that arithmetic unless it includes targeted lessons. If you know switching but not automation, use a resource with JSON and API exercises. This evidence-based purchase process reduces duplicated materials and helps candidates preserve time for practice.

The most useful final review is not a last-minute attempt to read every networking page. Revisit objectives that remain uncertain, solve fresh examples, and stop when you can explain the result reliably. Confirm the current outline, appointment version, and check-in details. The 120-minute duration requires attention, but sound preparation begins with a clear mental model of how addresses, switches, routes, services, and controls interact.

For a candidate balancing work and study, one focused hour spent tracing a real packet path is often better than passively watching several unrelated videos.