Cisco CCNA 200-301 2025 Part 1 — Network Foundations &
Switching 45 Q&A Verified
Series:
CrashCourses Professional Study Series
Author:
Dr Z. Moomba, MBChB, MRCPsych | BethelWellness Ltd
Exam Target:
Cisco CCNA 200-301
Year:
2025/2026
Format:
45 Questions with Verified Answers and Rationales
>
Author's Note:
This document is an original work produced for the CrashCourses Professional Study Series.
Clinical questions and professional scenarios were composed by Dr Z. Moomba based on current
exam objectives, published guidelines, and evidence-based sources (2024–2025). All patient
names, ages, and case details are fictional. Any resemblance to existing published Q&A banks is
coincidental. For personal study use only — not for reproduction or redistribution.
SECTION A — FOUNDATIONS
1.
A junior network engineer at St. Jude’s Hospital is troubleshooting a communication failure
between a workstation and a local PACS (Picture Archiving and Communication System) server.
Packet captures reveal that the workstation is encapsulating the IP packet into a frame. At which
OSI layer does this encapsulation occur?
A. Layer 2
B. Layer 3
C. Layer 4
D. Layer 7
,Answer: A
Rationale:
a) Encapsulation of IP packets into frames (adding MAC addresses and FCS) occurs at the Data
Link layer (Layer 2) of the OSI model.
b) The specific mention of creating a "frame" from an "IP packet" seals the Data Link layer as the
correct answer.
c) Layer 3 is tempting as it deals with IP packets, but encapsulation into a frame happens at Layer
2.
d)
Pearl:
Switches operate primarily at Layer 2, making forwarding decisions based on destination MAC
addresses. [Cisco CCNA OCG Vol 1, 2024]
2.
The Chief Information Officer of a multi-site clinic mandates a transition to the TCP/IP model for all
internal documentation. When mapping the OSI model to the TCP/IP suite, which OSI layers
correspond directly to the TCP/IP Application layer?
A. Application, Presentation, Session
B. Application, Transport, Network
C. Application only
D. Session, Transport, Network
Answer: A
Rationale:
a) The TCP/IP Application layer combines the functions of the OSI Application (Layer 7),
Presentation (Layer 6), and Session (Layer 5) layers.
b) The TCP/IP model simplifies the upper layers into a single Application layer handling protocol
formatting, encryption, and dialogue control.
c) Option B incorrectly includes Transport and Network, which map to their own distinct TCP/IP
layers (Transport and Internet).
d)
Pearl:
,Modern network troubleshooting often ignores the Session and Presentation layers, lumping them
into general "Application" issues. [RFC 1122]
3.
A biomedical device in the ICU sends an Ethernet frame to the hospital's central monitoring
station. Which field in the Ethernet frame provides error detection to ensure the frame was not
corrupted during transmission?
A. Preamble
B. Type
C. Frame Check Sequence (FCS)
D. Source MAC Address
Answer: C
Rationale:
a) The Frame Check Sequence (FCS) field, located at the end of an Ethernet frame, contains a
Cyclic Redundancy Check (CRC) value used to detect transmission errors.
b) "Error detection" without correction is the specific function of the 4-byte FCS trailer.
c) The Preamble is tempting as it relates to physical transmission, but it is solely for clock
synchronization, not error checking.
d)
Pearl:
If a switch calculates a different FCS than the one received, it silently discards the frame (runts or
giants). [IEEE 802.3]
4.
An IT administrator is configuring a new Cisco switch for the maternity ward. When the switch
receives a frame with an unknown unicast destination MAC address, what is the default behavior?
A. It drops the frame.
B. It floods the frame out all ports except the receiving port.
C. It sends an ARP request out all ports.
D. It returns an ICMP Destination Unreachable message.
Answer: B
, Rationale:
a) When a switch lacks a MAC address table entry for a destination, it performs unknown unicast
flooding, sending the frame out all active interfaces in the VLAN except the ingress interface.
b) The switch must ensure delivery; without knowing the exact port, flooding is the only Layer 2
mechanism to reach the unknown host.
c) Switches do not generate ARP requests for transient frame forwarding (that is a Layer 3
host/router function).
d)
Pearl:
Excessive unknown unicast flooding can degrade network performance; port security can mitigate
related MAC flooding attacks. [Cisco IOS Switching Guide]
5.
A network technician must assign an IPv4 address to a new ultrasound machine. The network is
192.168.10.0/26. Which of the following is a valid assignable host IP address on this subnet?
A. 192.168.10.0
B. 192.168.10.63
C. 192.168.10.32
D. 192.168.10.64
Answer: C
Rationale:
a) A /26 subnet mask gives a block size of 64. Subnets are .0, .64, .128, .192. The first subnet
range is 192.168.10.0 to 192.168.10.63.
b) .0 is the network address, and .63 is the broadcast address. 192.168.10.32 falls within the valid
host range (.1 - .62).
c) 192.168.10.63 is tempting if one forgets to subtract the broadcast address from the assignable
range.
d)
Pearl:
Always remember the formula 2^H - 2 for calculating valid hosts, where H is the number of host
bits (32 - 26 = 6 bits; 64 - 2 = 62 hosts). [Cisco Subnetting Rules]
Switching 45 Q&A Verified
Series:
CrashCourses Professional Study Series
Author:
Dr Z. Moomba, MBChB, MRCPsych | BethelWellness Ltd
Exam Target:
Cisco CCNA 200-301
Year:
2025/2026
Format:
45 Questions with Verified Answers and Rationales
>
Author's Note:
This document is an original work produced for the CrashCourses Professional Study Series.
Clinical questions and professional scenarios were composed by Dr Z. Moomba based on current
exam objectives, published guidelines, and evidence-based sources (2024–2025). All patient
names, ages, and case details are fictional. Any resemblance to existing published Q&A banks is
coincidental. For personal study use only — not for reproduction or redistribution.
SECTION A — FOUNDATIONS
1.
A junior network engineer at St. Jude’s Hospital is troubleshooting a communication failure
between a workstation and a local PACS (Picture Archiving and Communication System) server.
Packet captures reveal that the workstation is encapsulating the IP packet into a frame. At which
OSI layer does this encapsulation occur?
A. Layer 2
B. Layer 3
C. Layer 4
D. Layer 7
,Answer: A
Rationale:
a) Encapsulation of IP packets into frames (adding MAC addresses and FCS) occurs at the Data
Link layer (Layer 2) of the OSI model.
b) The specific mention of creating a "frame" from an "IP packet" seals the Data Link layer as the
correct answer.
c) Layer 3 is tempting as it deals with IP packets, but encapsulation into a frame happens at Layer
2.
d)
Pearl:
Switches operate primarily at Layer 2, making forwarding decisions based on destination MAC
addresses. [Cisco CCNA OCG Vol 1, 2024]
2.
The Chief Information Officer of a multi-site clinic mandates a transition to the TCP/IP model for all
internal documentation. When mapping the OSI model to the TCP/IP suite, which OSI layers
correspond directly to the TCP/IP Application layer?
A. Application, Presentation, Session
B. Application, Transport, Network
C. Application only
D. Session, Transport, Network
Answer: A
Rationale:
a) The TCP/IP Application layer combines the functions of the OSI Application (Layer 7),
Presentation (Layer 6), and Session (Layer 5) layers.
b) The TCP/IP model simplifies the upper layers into a single Application layer handling protocol
formatting, encryption, and dialogue control.
c) Option B incorrectly includes Transport and Network, which map to their own distinct TCP/IP
layers (Transport and Internet).
d)
Pearl:
,Modern network troubleshooting often ignores the Session and Presentation layers, lumping them
into general "Application" issues. [RFC 1122]
3.
A biomedical device in the ICU sends an Ethernet frame to the hospital's central monitoring
station. Which field in the Ethernet frame provides error detection to ensure the frame was not
corrupted during transmission?
A. Preamble
B. Type
C. Frame Check Sequence (FCS)
D. Source MAC Address
Answer: C
Rationale:
a) The Frame Check Sequence (FCS) field, located at the end of an Ethernet frame, contains a
Cyclic Redundancy Check (CRC) value used to detect transmission errors.
b) "Error detection" without correction is the specific function of the 4-byte FCS trailer.
c) The Preamble is tempting as it relates to physical transmission, but it is solely for clock
synchronization, not error checking.
d)
Pearl:
If a switch calculates a different FCS than the one received, it silently discards the frame (runts or
giants). [IEEE 802.3]
4.
An IT administrator is configuring a new Cisco switch for the maternity ward. When the switch
receives a frame with an unknown unicast destination MAC address, what is the default behavior?
A. It drops the frame.
B. It floods the frame out all ports except the receiving port.
C. It sends an ARP request out all ports.
D. It returns an ICMP Destination Unreachable message.
Answer: B
, Rationale:
a) When a switch lacks a MAC address table entry for a destination, it performs unknown unicast
flooding, sending the frame out all active interfaces in the VLAN except the ingress interface.
b) The switch must ensure delivery; without knowing the exact port, flooding is the only Layer 2
mechanism to reach the unknown host.
c) Switches do not generate ARP requests for transient frame forwarding (that is a Layer 3
host/router function).
d)
Pearl:
Excessive unknown unicast flooding can degrade network performance; port security can mitigate
related MAC flooding attacks. [Cisco IOS Switching Guide]
5.
A network technician must assign an IPv4 address to a new ultrasound machine. The network is
192.168.10.0/26. Which of the following is a valid assignable host IP address on this subnet?
A. 192.168.10.0
B. 192.168.10.63
C. 192.168.10.32
D. 192.168.10.64
Answer: C
Rationale:
a) A /26 subnet mask gives a block size of 64. Subnets are .0, .64, .128, .192. The first subnet
range is 192.168.10.0 to 192.168.10.63.
b) .0 is the network address, and .63 is the broadcast address. 192.168.10.32 falls within the valid
host range (.1 - .62).
c) 192.168.10.63 is tempting if one forgets to subtract the broadcast address from the assignable
range.
d)
Pearl:
Always remember the formula 2^H - 2 for calculating valid hosts, where H is the number of host
bits (32 - 26 = 6 bits; 64 - 2 = 62 hosts). [Cisco Subnetting Rules]
