CCNA 200-301 Exam Objectives (v1.1): A Domain-by-Domain Guide

The CCNA remains the most respected associate-level networking certification in the industry. This guide walks through the six official domains of the current 200-301 (v1.1) blueprint — what each covers, what to study, and why it matters — plus exam logistics, study tips, and a look at the v2.0 update on the horizon.

Exam Logistics at a Glance

The Six Domains

The blueprint's shape tells a story: routing and switching fundamentals (Domains 1–3) are nearly two-thirds of the exam. Master those and you have a passing foundation; the remaining domains add the security, services, and automation knowledge that make a complete network engineer.

Network Fundamentals 20%

What it covers: the bedrock — how networks are structured, how data moves, and the protocols that make it possible. This domain also introduces the Cisco-specific view: device roles, cabling, and the beginnings of IP addressing.

Key topics to study:

• Network components and their roles: routers, switches, firewalls, access points, controllers
• Network topology architectures: two-tier, three-tier, spine-and-leaf, WAN, small office/home office
• Physical interfaces and cabling types, Ethernet concepts
• TCP vs. UDP — when each is used and why
• IPv4 addressing and subnetting; IPv6 addressing, prefixes, and address types
• Wireless principles: RF basics, 802.11 concepts, and Cisco wireless architectures at a high level

Why it matters: one-fifth of the exam and the language every other domain speaks. Weak subnetting here doesn't just cost Domain 1 points — it undermines your routing and services answers too.

Network Access 20%

What it covers: how devices connect to the network at Layer 2 — switching concepts, VLANs, trunking, and wireless access. This is the "campus network" domain.

Key topics to study:

• VLANs: purpose, configuration concepts, access vs. trunk ports, native VLANs, 802.1Q
• Interswitch connectivity and link aggregation (EtherChannel concepts)
• Spanning Tree Protocol: why loops are dangerous, how STP prevents them, Rapid PVST+ basics
• WLAN deployment: access point modes, WLC concepts, wireless security at the access layer

Why it matters: switching questions are concrete and configuration-flavored — the exam shows you a topology or a snippet of output and asks what happens. Lab practice pays off disproportionately here.

IP Connectivity 25%

What it covers: the single biggest domain — routing. How routers learn paths, how packets get forwarded, and how to interpret routing tables and make first-hop redundancy work.

Key topics to study:

• Routing table interpretation: codes, administrative distance, metric, longest-prefix match
• Static routing vs. dynamic routing; when each is appropriate
• Single-area OSPFv2: neighbor relationships, router IDs, the concepts behind configuration and verification
• First-hop redundancy: HSRP/VRRP concepts and purpose
• NAT concepts and the problems NAT solves

Why it matters: a quarter of your score. Routing questions reward people who can read a routing table the way a musician reads sheet music — practice until the codes and metrics feel obvious.

IP Services 10%

What it covers: the supporting services that make IP networks usable: address assignment, name resolution, time synchronization, remote management, and quality of service concepts.

Key topics to study:

• DHCP: the DORA process, client vs. server vs. relay concepts
• DNS: resolution process and record concepts
• NTP: why synchronized time matters for logging and security
• SNMP, syslog, and device management concepts
• QoS: classification, marking, queuing concepts — and which traffic types need priority
• SSH and secure device access basics

Why it matters: the smallest "traditional" domain, but the questions are usually straightforward if you know each service's job. Good points-per-hour territory.

Security Fundamentals 15%

What it covers: threats, vulnerabilities, and the core defensive techniques every network engineer must know — from VPNs to access control to wireless security.

Key topics to study:

• Threats and vulnerabilities: malware types, phishing, social engineering, common attack vectors
• VPN concepts: site-to-site vs. remote access, IPsec fundamentals
• Access control: ACL concepts, port security, DHCP snooping, dynamic ARP inspection (at a conceptual level)
• Wireless security: WPA2 vs. WPA3, authentication methods
• Security program elements: least privilege, defense in depth, physical security basics

Why it matters: security appears both here and woven through other domains. The exam expects you to think defensively by default — the secure option is very often the right answer.

Automation and Programmability 10%

What it covers: the modern domain — controllers, APIs, and data formats. You won't be asked to write code, but you must understand how automation fits into network operations.

Key topics to study:

• Controller-based networking vs. traditional device-by-device management (SDN concepts)
• Cisco DNA Center concepts and purpose
• REST APIs: what they are, how network devices expose them, basic request/response ideas
• Data formats: JSON — reading it, not writing it
• Configuration management concepts: why automation beats manual CLI at scale

Why it matters: only 10%, but it signals where the industry is going — and v2.0's new AI domain builds directly on these ideas. Learn the concepts now and the future blueprint gets easier.

Study Tips That Actually Work

• Lab everything in Domains 2 and 3. Packet Tracer (free) is enough — configure VLANs, trunks, STP, and single-area OSPF until the commands feel natural and you can predict outputs.
• Learn to read, not just configure. Much of the exam shows you show command output and asks for a diagnosis. Practice interpreting routing tables, MAC tables, and interface status.
• Subnet daily. Ten minutes of subnetting practice a day beats a weekend cram. It underpins Domains 1, 3, and parts of 5.
• Think in topologies. When studying any protocol, sketch the topology it runs on. CCNA questions are deeply topological — the diagram usually holds the answer.
• Don't neglect the 10% domains. Automation and IP services questions are often the easiest points on the exam if you've simply read the material once.

Frequently Asked Questions

How long should I study for CCNA?

Three to six months of consistent study is typical, including lab time. Candidates with networking experience or a fresh Network+ often compress this to two to three months.

Is CCNA harder than Network+?

Yes, meaningfully. Network+ is vendor-neutral and conceptual; CCNA adds Cisco-specific depth, configuration reasoning, and simulations. Many people take Network+ first as a stepping stone.

Do I need real Cisco equipment?

No. Cisco Packet Tracer (free with a Cisco Networking Academy account) covers everything the exam requires. Physical gear is nice but unnecessary.

What is the passing score for CCNA 200-301?

Cisco doesn't publish one — scoring is scaled and varies slightly by exam form. The widely cited estimate is around 825 out of 1000. Aim to answer roughly 80%+ of questions correctly in practice.

Should I wait for CCNA v2.0 in 2027?

Generally no. If you're ready before February 2027, take v1.1 — a CCNA earned now is valid for three years and the core networking knowledge carries straight into v2.0. Only wait if your timeline already lands after the switchover.

Does CCNA expire?

Yes, after three years. You can recertify by passing the current CCNA again, earning continuing-education credits, or passing a higher-level Cisco exam.