The CCNA syllabus for exam 200-301 covers six weighted domains: IP Connectivity (25%), Network Fundamentals (20%), Network Access (20%), Security Fundamentals (15%), IP Services (10%), and Automation and Programmability (10%). Each domain has specific objectives ranging from basic concepts to configuration and verification tasks.
The Six Domains of the CCNA Exam
The 200-301 exam covers networking across six distinct domains, each weighted according to its importance in entry-level network design and operations. Knowing which topics carry the most weight helps you allocate study time effectively.
| Domain | Weight | Focus |
|---|---|---|
| IP Connectivity | 25% | Routing tables, forwarding decisions, static routing, OSPF, redundancy |
| Network Fundamentals | 20% | Network components, topologies, cabling, TCP/UDP, IPv4/IPv6, wireless, virtualization |
| Network Access | 20% | VLANs, trunking, Layer 2 protocols, EtherChannel, Spanning Tree, wireless architecture |
| Security Fundamentals | 15% | Threats and mitigations, access control, ACLs, Layer 2 security, wireless security |
| IP Services | 10% | NAT, NTP, DHCP, DNS, SNMP, syslog, QoS, SSH, TFTP/FTP |
| Automation and Programmability | 10% | Automation impact, controller-based architecture, REST APIs, JSON, infrastructure-as-code tools |
IP Connectivity (25%)
IP Connectivity is the largest domain. You must interpret routing table components (routing protocol code, prefix, mask, next hop, administrative distance, metric, and gateway of last resort) and understand how routers make forwarding decisions using longest prefix match, administrative distance, and metric. Static routing for default routes, network routes, host routes, and floating statics is a core skill.
Single-area OSPFv2 configuration and verification includes neighbor adjacencies, point-to-point networks, broadcast networks with DR/BDR selection, and Router ID assignment. You also need to describe first-hop redundancy protocols such as HSRP, which keep traffic flowing when a router fails.
Network Fundamentals (20%)
This domain covers the building blocks of networks. You must explain the role of routers, Layer 2 and Layer 3 switches, next-generation firewalls, IPS, access points, controllers, endpoints, servers, and PoE. Network topology architectures include two-tier, three-tier, spine-leaf, WAN, SOHO, and on-premises versus cloud deployments.
Physical interfaces and cabling types—single-mode fiber, multimode fiber, and copper—are compared alongside connection types. Interface and cable issues such as collisions, errors, duplex mismatches, and speed mismatches must be identified. TCP versus UDP characteristics, IPv4 addressing and subnetting, IPv6 addressing and prefixes, IPv6 address types (unicast, anycast, multicast, modified EUI-64), and wireless principles (nonoverlapping channels, SSID, RF, encryption) are all tested. You also verify IP parameters for Windows, Mac OS, and Linux client operating systems and explain virtualization fundamentals including server virtualization, containers, and VRFs.
Network Access (20%)
Network Access covers switched networks. Configure and verify VLANs across multiple switches, including access ports for data and voice, default VLAN settings, and inter-VLAN connectivity. Interswitch connectivity uses trunk ports, 802.1Q tagging, and native VLAN configuration. Layer 2 discovery protocols (Cisco Discovery Protocol and LLDP) help you map network topology.
EtherChannel aggregates multiple links into a single logical link for bandwidth and redundancy; the LACP protocol is commonly used. Rapid PVST+ Spanning Tree Protocol prevents loops by designating a root bridge, root ports, designated ports, and blocking ports. Port states (disabled, blocking, listening, learning, forwarding) and roles (root port, designated port, non-designated port) must be understood, along with PortFast, root guard, loop guard, and BPDU filtering/guarding.
WLAN topics include Cisco wireless architectures and AP modes, physical infrastructure connections between APs, WLCs, access/trunk ports, and LAGs. Network device management access (Telnet, SSH, HTTP, HTTPS, console, TACACS+/RADIUS, cloud-managed) and wireless LAN GUI configuration for client connectivity (WLAN creation, security settings, QoS profiles, advanced settings) are tested.
Security Fundamentals (15%)
Security content starts with defining key concepts: threats, vulnerabilities, exploits, and mitigation techniques. Security programs include user awareness, training, and physical access control. Configure and verify device access control using local passwords and describe password policy elements (management, complexity, and alternatives such as multifactor authentication, certificates, and biometrics).
IPsec remote access and site-to-site VPNs are described, and you must configure and verify access control lists (ACLs). Layer 2 security features include DHCP snooping, dynamic ARP inspection, and port security. Authentication, authorization, and accounting (AAA) concepts are compared, and wireless security protocols (WPA, WPA2, WPA3) are covered. WLAN GUI configuration with WPA2 pre-shared key is practiced.
IP Services (10%)
IP Services covers operational technologies. Configure and verify inside source NAT using static and pools. Configure and verify NTP in client and server modes. Understand the role of DHCP and DNS in networks, the function of SNMP in network operations, and the use of syslog facilities and severity levels.
Configure DHCP client and relay, and configure network devices for remote access using SSH. Describe the capabilities of TFTP/FTP in the network. Finally, explain forwarding per-hop behavior (PHB) for QoS, including classification, marking, queuing, congestion, policing, and shaping.
Automation and Programmability (10%)
Automation is the smallest domain but increasingly important. Explain how automation impacts network management and compare traditional networks with controller-based networking. Describe controller-based, software-defined architecture, including the separation of control plane and data plane, northbound and southbound APIs, and overlay and underlay fabrics.
Explain AI (generative and predictive) and machine learning in network operations. Describe characteristics of REST-based APIs including authentication types, CRUD operations, HTTP verbs, and data encoding. Recognize the capabilities of configuration management mechanisms such as Ansible and Terraform, and recognize components of JSON-encoded data.
Preparing by Domain Weight
Allocation of study time roughly mirrors domain weights. If you have 12 weeks to prepare, dedicate three weeks to IP Connectivity, two to Network Fundamentals, two to Network Access, two to Security, one to IP Services, and one to Automation. Adjust based on your current knowledge: if routing is already strong, spend less time there and more on weaker areas.
Each objective statement in the brief is testable. Use the objectives to create flashcards, practice labs, and self-quizzes. The sample questions in this hub are drawn from all six domains at the same weight distribution as the real exam.
Related Resources
Once you know the objectives, explore the exam format & scoring, study plan, and sample questions pages. You can also review the cost & booking and exam-day guide.
Exam facts on this page come from Cisco’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.