ITForMe Beta Sign in
Cisco · certification · Guided course

Cisco CCNA

Network access, IP connectivity and services, security, and automation.

200-301 v1.1associateOfficial provider page ↗
Course overview and topics →
Daily study planConsideringInclude new CCNA sections and checks in your daily goal.
Catalog noteCisco has announced CCNA 200-301 v2.0 for February 3, 2027; the last day to take v1.1 is February 2, 2027. This bank remains mapped to v1.1 until its migration is reviewed.Provider catalog checked 2026-10-06.
Your course path

Start with the suggested objective

Open a section when you are ready to begin.

Course pace and remaining work
ApproachBuild in orderLearning; no professional IT experience yet
Core work left4110mRemaining short lesson blocks and checks · outside courses vary in length
Target paceNo deadlineSet a target below to calculate required weekly time
01
Network FundamentalsNot started

1.1 · Explain the role and function of network components.

3 short lesson blocks · next block about 16m

Block 1 · Router · Layer 2 switch · Layer 3 switch · Wireless access point

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Place inspection and control at the right decision point

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Trace a service request and its power dependency

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byNov 3Start section →
Full course map52 other objectivesOpen when you want to review progress or look ahead
02
Network FundamentalsNot started

1.2 · Describe characteristics of network topology architectures.

3 short lesson blocks · next block about 16m

Block 1 · Two-tier architecture · Three-tier architecture · Spine-and-leaf · SOHO topology

○Study lessonRequired provider lesson ○Block check

Block 2 · Draw the ownership boundaries beyond the campus

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish WAN edge, On-premises design

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byNov 6Start section →
03
Network FundamentalsNot started

1.3 · Compare physical interface and cabling types.

3 short lesson blocks · next block about 16m

Block 1 · Copper Ethernet · Point-to-point link

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Single-mode fiber · Multimode fiber

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Fiber connector polish, Transceiver compatibility, Copper distance limit, Shared media

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byNov 9Start section →
06
Network FundamentalsNot started

1.6 · Configure and verify IPv4 addressing and subnetting.

3 short lesson blocks · next block about 18m

Block 1 · Subnet address · Directed broadcast address · IPv4 prefix length · Default gateway

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Configure the IPv4 interface, then test the prediction

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Usable IPv4 host range, IPv4 subnet block size

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byNov 17Start section →
07
Network FundamentalsNot started

1.7 · Describe private IPv4 addressing.

2 short lesson blocks · next block about 16m

Block 1 · 10.0.0.0/8 · 172.16.0.0/12 · 192.168.0.0/16 · Public IPv4 address

○Study lessonRequired provider lesson ○Block check

Block 2 · Distinguish Private address translation need, Overlapping private space, IPv4 address conservation, Special-use IPv4 address

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byNov 19Start section →
08
Network FundamentalsNot started

1.8 · Configure and verify IPv6 addressing and prefix.

3 short lesson blocks · next block about 16m

Block 1 · IPv6 address · IPv6 prefix length · IPv6 default gateway · Link-local next hop

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Verify the IPv6 address in interface and routing context

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish IPv6 zero compression, IPv6 leading-zero omission

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byNov 22Start section →
09
Network FundamentalsNot started

1.9 · Describe IPv6 address types.

3 short lesson blocks · next block about 16m

Block 1 · Global unicast · Link-local · IPv6 multicast · IPv6 anycast

○Study lessonRequired provider lesson ○Block check

Block 2 · Build the IPv6 identifier before classifying its reach

○Study lessonRequired provider lesson ○Block check

Block 3 · Distinguish IPv6 unique local address, Modified EUI-64 interface ID

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byNov 25Start section →
10
Network FundamentalsNot started

1.10 · Verify IP parameters for client operating systems.

6 short lesson blocks · next block about 16m

Block 1 · Understand ipconfig

○Study lessonRequired provider lesson ○Block check

Block 2 · Understand route print

○Study lessonRequired provider lesson ○Block check

Block 3 · Understand ip address

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Understand ifconfig

○Study lessonRequired provider lesson ○Block check

Block 5 · Correlate a Mac interface with its selected path

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Distinguish Ping reachability test, Traceroute path evidence

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byNov 29Start section →
11
Network FundamentalsNot started

1.11 · Describe wireless principles.

3 short lesson blocks · next block about 16m

Block 1 · Wireless interference · Channel overlap · SSID

○Study lessonRequired provider lesson ○Block check

Block 2 · Understand Wireless encryption

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Received signal strength, Signal-to-noise ratio, Wireless channel-width selection, Wireless client roaming

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byDec 2Start section →
12
Network FundamentalsNot started

1.12 · Explain virtualization fundamentals.

4 short lesson blocks · next block about 16m

Block 1 · Virtual machine · Hypervisor

○Study lessonRequired provider lesson ○Block check

Block 2 · Understand Container

○Study lessonRequired provider lesson ○Block check

Block 3 · Understand Virtual routing and forwarding

○Study lessonRequired provider lesson ○Block check

Block 4 · Distinguish Server virtualization, Virtual switch, Container image, Virtual network function

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byDec 6Start section →
14
Network AccessNot started

2.1 · Configure and verify VLANs (normal range) spanning multiple switches.

5 short lesson blocks · next block about 16m

Block 1 · Access port · VLAN database

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Understand Voice VLAN

○Study lessonRequired provider lesson ○Block check

Block 3 · Understand Switched virtual interface

○Study lessonRequired provider lesson ○Block check

Block 4 · Make the default VLAN visible before changing it

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Distinguish Data and voice VLAN pair

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byDec 12Start section →
15
Network AccessNot started

2.2 · Configure and verify interswitch connectivity.

3 short lesson blocks · next block about 18m

Block 1 · Trunk port · IEEE 802.1Q · Native VLAN · Allowed VLAN list

○Study lessonRequired provider lesson ○Block check

Block 2 · Configure the trunk and verify both ends agree

○Study lessonRequired provider lesson ○Block check

Block 3 · Distinguish Native VLAN mismatch

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byDec 15Start section →
16
Network AccessNot started

2.3 · Configure and verify Layer 2 discovery protocols.

4 short lesson blocks · next block about 16m

Block 1 · CDP · Platform identifier

○Study lessonRequired provider lesson ○Block check

Block 2 · LLDP · Port identifier

○Study lessonRequired provider lesson ○Block check

Block 3 · Control discovery advertisements and verify the immediate neighbor

○Study lessonRequired provider lesson ○Block check

Block 4 · Distinguish Neighbor management address, Neighbor capability code

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byDec 18Start section →
17
Network AccessNot started

2.4 · Configure and verify (Layer 2/Layer 3) EtherChannel (LACP).

3 short lesson blocks · next block about 16m

Block 1 · LACP · Port-channel interface · Member consistency · Layer 3 EtherChannel

○Study lessonRequired provider lesson ○Block check

Block 2 · Build the LACP bundle from member evidence

○Study lessonRequired provider lesson ○Block check

Block 3 · Distinguish LACP active mode, LACP passive mode

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byDec 21Start section →
18
Network AccessNot started

2.5 · Interpret basic operations of Rapid PVST+ Spanning Tree Protocol.

5 short lesson blocks · next block about 16m

Block 1 · Root bridge · Root port

○Study lessonRequired provider lesson ○Block check

Block 2 · Understand BPDU Guard

○Study lessonRequired provider lesson ○Block check

Block 3 · Understand Root Guard

○Study lessonRequired provider lesson ○Block check

Block 4 · Predict a Rapid PVST+ port before reading the output

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Choose protection from the BPDU symptom

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byDec 25Start section →
19
Network AccessNot started

2.6 · Describe Cisco wireless architectures and access point modes.

3 short lesson blocks · next block about 16m

Block 1 · Local AP mode · FlexConnect · Monitor AP mode · Sniffer AP mode

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Separate AP management architecture from radio mode

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish FlexConnect local switching

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byDec 28Start section →
20
Network AccessNot started

2.7 · Describe physical infrastructure connections of WLAN components.

4 short lesson blocks · next block about 16m

Block 1 · AP switch link · WLC link aggregation · Client access link

○Study lessonRequired provider lesson ○Block check

Block 2 · Understand Power over Ethernet

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Read the VLAN contract on each WLAN cable

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Distinguish Access point trunk link, Wireless controller service port

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byJan 1Start section →
21
Network AccessNot started

2.8 · Describe network device management access.

5 short lesson blocks · next block about 16m

Block 1 · Understand Console access

○Study lessonRequired provider lesson ○Block check

Block 2 · Understand SSH access

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · HTTPS management · Cloud-managed networking

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Select management access by transport and identity risk

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Distinguish Out-of-band management

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byJan 5Start section →
22
Network AccessNot started

2.9 · Interpret wireless LAN GUI configuration for client connectivity.

3 short lesson blocks · next block about 16m

Block 1 · WLAN profile · WPA2 pre-shared key · Wireless security profile · Wireless client VLAN

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Interpret the WLAN settings beyond the SSID and key

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish SSID-to-VLAN mapping, WLAN AAA server

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byJan 8Start section →
23
IP ConnectivityNot started

3.1 · Interpret the components of a routing table.

4 short lesson blocks · next block about 16m

Block 1 · Route source code · Route prefix · Next hop

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Understand Administrative distance

○Study lessonRequired provider lesson ○Block check

Block 3 · Decode the fields that surround a route

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Distinguish Gateway of last resort

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byJan 11Start section →
24
IP ConnectivityNot started

3.2 · Determine how a router makes a forwarding decision by default.

4 short lesson blocks · next block about 16m

Block 1 · Longest prefix match · Default route

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Administrative distance selection · Routing metric selection

○Study lessonRequired provider lesson ○Block check

Block 3 · Distinguish Recursive route lookup, Equal-cost paths, Route selection order

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Trace the source of a proxied connection

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byJan 15Start section →
25
IP ConnectivityNot started

3.3 · Configure and verify IPv4 and IPv6 static routing.

5 short lesson blocks · next block about 9m

Block 1 · Default static route · Floating static route

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Understand Host route

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Understand IPv6 static route

○Study lessonRequired provider lesson ○Block check

Block 4 · Configure a network route and prove its next hop resolves

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Distinguish Fully specified static route

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byJan 19Start section →
26
IP ConnectivityNot started

3.4 · Configure and verify single area OSPFv2.

3 short lesson blocks · next block about 18m

Block 1 · OSPF router ID · OSPF area ID · OSPF passive interface

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Understand OSPF hello and dead timers

○Study lessonRequired provider lesson ○Block check

Block 3 · Read OSPF neighbor state in the context of its network type

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byJan 22Start section →
27
IP ConnectivityNot started

3.5 · Describe the purpose, functions, and concepts of first-hop redundancy protocols.

3 short lesson blocks · next block about 16m

Block 1 · FHRP virtual IP · Active gateway router

○Study lessonRequired provider lesson ○Block check

Block 2 · FHRP preemption · FHRP object tracking

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish FHRP virtual MAC, FHRP priority, FHRP failover, FHRP load sharing

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byJan 25Start section →
28
IP ServicesNot started

4.1 · Configure and verify inside source NAT using static and pools.

4 short lesson blocks · next block about 18m

Block 1 · Static NAT · Inside local address

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Dynamic NAT pool · Port address translation

○Study lessonRequired provider lesson ○Block check

Block 3 · Build and prove a one-to-one dynamic NAT pool

○Study lessonRequired provider lesson ○Block check

Block 4 · Distinguish NAT translation table

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byJan 29Start section →
29
IP ServicesNot started

4.2 · Configure and verify NTP operating in a client and server mode.

3 short lesson blocks · next block about 16m

Block 1 · NTP client · NTP server · NTP stratum · NTP source interface

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Configure a small NTP hierarchy and read its evidence

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish NTP association

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byJan 31Start section →
30
IP ServicesNot started

4.3 · Explain the role of DHCP and DNS within the network.

4 short lesson blocks · next block about 16m

Block 1 · DNS · Authoritative DNS server

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Understand DHCP

○Study lessonRequired provider lesson ○Block check

Block 3 · Understand DHCP relay

○Study lessonRequired provider lesson ○Block check

Block 4 · Distinguish DHCP discovery, DHCP offer, Recursive DNS query, DNS record cache

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byFeb 4Start section →
32
IP ServicesNot started

4.5 · Describe the use of syslog features including facilities and severity levels.

3 short lesson blocks · next block about 16m

Block 1 · Syslog facility · Syslog severity · Syslog server · Log timestamp

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Filter and verify a centralized syslog path

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Syslog source interface

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byFeb 9Start section →
33
IP ServicesNot started

4.6 · Configure and verify DHCP client and relay.

3 short lesson blocks · next block about 11m

Block 1 · DHCP client · IP helper address · DHCP excluded address · DHCP lease

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Separate an IOS DHCP client from a DHCP relay

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish DHCP binding

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byFeb 12Start section →
34
IP ServicesNot started

4.7 · Explain the forwarding per-hop behavior for QoS.

5 short lesson blocks · next block about 16m

Block 1 · QoS classification · QoS marking

○Study lessonRequired provider lesson ○Block check

Block 2 · Understand QoS queuing

○Study lessonRequired provider lesson ○Block check

Block 3 · Understand Traffic policing

○Study lessonRequired provider lesson ○Block check

Block 4 · Diagnose rate enforcement from QoS counters

○Study lessonRequired provider lesson ○Block check

Block 5 · Distinguish QoS trust boundary

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byFeb 16Start section →
35
IP ServicesNot started

4.8 · Configure network devices for remote access using SSH.

2 short lesson blocks · next block about 18m

Block 1 · RSA host key · IOS domain name · transport input ssh · login local

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Distinguish SSH version 2, VTY access class, SSH local username, SSH session verification

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byFeb 19Start section →
36
IP ServicesNot started

4.9 · Describe the capabilities and function of TFTP and FTP.

3 short lesson blocks · next block about 16m

Block 1 · TFTP · FTP · FTP control connection · FTP data connection

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Choose a file-transfer service from packet evidence

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish FTP active data connection

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byFeb 21Start section →
38
Security FundamentalsNot started

5.2 · Describe security program elements.

3 short lesson blocks · next block about 16m

Block 1 · Security awareness · Security training · Physical access control · Password policy

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Turn a security program into observable controls

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Tailgating prevention

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byFeb 27Start section →
39
Security FundamentalsNot started

5.3 · Configure device access control using local passwords.

3 short lesson blocks · next block about 16m

Block 1 · enable secret · Console password · VTY password · Local user account

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Configure local credentials without locking out management

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Secret hashing

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byMar 1Start section →
40
Security FundamentalsNot started

5.4 · Describe security password policy elements.

3 short lesson blocks · next block about 16m

Block 1 · Password length · Password complexity · Password history · Password expiration

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Choose authentication factors beyond a password

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Password lockout

○Study lessonRequired provider lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byMar 4Start section →
41
Security FundamentalsNot started

5.5 · Describe remote access and site-to-site VPNs.

3 short lesson blocks · next block about 16m

Block 1 · Site-to-site VPN · Remote-access VPN · IPsec tunnel mode · VPN encryption domain

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Choose an IPsec VPN and verify protected scope

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish VPN security-association counter

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byMar 7Start section →
42
Security FundamentalsNot started

5.6 · Configure and verify access control lists.

3 short lesson blocks · next block about 10m

Block 1 · Standard IPv4 ACL · ACL wildcard mask · Implicit deny

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Understand Extended IPv4 ACL

○Study lessonRequired provider lesson ○Block check

Block 3 · Prove an ACL with permitted and forbidden traffic

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byMar 10Start section →
43
Security FundamentalsNot started

5.7 · Configure and verify Layer 2 security features.

5 short lesson blocks · next block about 9m

Block 1 · Understand DHCP snooping

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Understand Dynamic ARP inspection

○Study lessonRequired provider lesson ○Block check

Block 3 · Understand Port security

○Study lessonRequired provider lesson ○Block check

Block 4 · Understand BPDU Guard

○Study lessonRequired provider lesson ○Block check

Block 5 · Configure the Layer 2 trust boundary before enforcing it

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byMar 15Start section →
44
Security FundamentalsNot started

5.8 · Differentiate authentication, authorization, and accounting concepts.

2 short lesson blocks · next block about 16m

Block 1 · Authentication · Authorization · Accounting · TACACS+

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Distinguish AAA method list, TACACS+ command authorization, RADIUS Access-Accept, AAA accounting record

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byMar 17Start section →
47
Automation and ProgrammabilityNot started

6.1 · Explain how automation affects network management.

3 short lesson blocks · next block about 16m

Block 1 · Automation consistency · Automation scale · Automation repeatability

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Understand Configuration drift

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Manual configuration error, Automation validation, Configuration templating, Automation rollback

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byMar 25Start section →
48
Automation and ProgrammabilityNot started

6.2 · Compare traditional networks with controller-based networking.

3 short lesson blocks · next block about 16m

Block 1 · Distributed control plane · Controller-based control · Centralized policy · Southbound interface

○Study lessonRequired provider lesson ○Block check

Block 2 · Compare controller intent with live forwarding

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Controller abstraction

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byMar 27Start section →
50
Automation and ProgrammabilityNot started

6.4 · Explain AI and machine learning in network operations.

3 short lesson blocks · next block about 16m

Block 1 · Machine learning · Training data

○Study lessonRequired provider lesson ○Block check

Block 2 · Generative AI · Predictive AI

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish AI inference, Model bias, AI hallucination, Anomaly detection

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byApr 2Start section →
52
Automation and ProgrammabilityNot started

6.6 · Recognize capabilities of Ansible and Terraform.

3 short lesson blocks · next block about 16m

Block 1 · Ansible · Idempotence · Automation inventory

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Understand Terraform

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Ansible playbook, Terraform state, Automation dry run, Configuration drift

○Study lessonRequired ITForMe lesson ○Block check
○Checkpoint · 70%+ ○Spaced review 0/3
Suggested byApr 7Start section →
★
Course progression checks

Complete these quizzes and labs to finish the guided course. The readiness checklist below has additional requirements. Course completion does not predict your exam result.

○Pass both current-profile 90-question final forms at 85%+ within 180 days○Pass 6 distinct current in-browser scenarios whose mapped content spans 6 exam domains at 70%+ within 180 days
Open practice →
Optional learning resources0 choicesOpen for another teacher, format, or question review
Optional

Another explanation or review

Hosted CCNA study uses ITForMe's objective lessons and in-browser practice. Third-party lab environments are not assigned. These resources do not change course progress or readiness.

Course guide · 200-301 v1.1

CCNA course guide

Lessons, checkpoints, and the full six-stage map for CCNA 200-301.

Current exam: 200-301 v1.1. Internally validated; independent review remains labeled. Cisco v2.0 starts February 3, 2027. Transition details ↗

Course guide and readinessWorkload, checkpoint route, assessment limits, and all six stages
53 objectivesMapped to the detailed exam blueprint
168 short blocks31h 40m of native teaching and browser exercises
68h 30m core estimateInstruction, one block check per block, and one checkpoint per objective
6 stagesAdaptive review and final readiness add time based on your results
How the 68h 30m core estimate is calculated
Native teaching and browser exercises
31h 40m
168 block checks at 10 minutes each
28h
53 objective checkpoints at 10 minutes each
8h 50m

This is a planning estimate for one pass through the required browser route. Retakes, spaced review, and final readiness work vary by learner. The external projects are optional and counted separately.

What progress means: checkpoints and final forms provide study evidence. They do not guarantee an exam result or verify configuration skill on live equipment.

Already have experience? Use the checkpoint route

Open any objective below and choose Already studied this? to go straight to its checkpoint. This records your own prior-study claim; it does not mark videos watched, exercises completed, or a checkpoint passed. The latest checkpoint still needs 70% to advance, and weaker results return to your review plan.

For several objectives studied elsewhere, use the outside-study checklist. You can revisit the full lesson at any time.

How lessons, checks, and final assessments work

Each block contains its own explanation, worked example, and browser exercise. Read the supplied scenario or command output, predict the result, then reveal the reasoning. No download or separate lab is required.

A few words before you start

A local area network (LAN) connects nearby devices. A port or interface is a device's connection to a link. Ethernet carries data in frames on a local link, using MAC addresses to identify interfaces. An IP packet carries source and destination IP addresses across networks; a router puts that packet into a new link-layer frame at each routed hop. A subnet is a range of IP addresses treated as one network. Its prefix length tells you which address bits name the network. You will practise each of these ideas before combining them.

Final assessments use two separate 90-question forms that do not appear in lessons, practice, or flashcards. After both forms have been started, repeats are clearly labeled because familiarity can affect your score. Passing course checks is preparation evidence, not a guarantee of an exam result or proof of configuration skill on live equipment.

Optional videos and external projects are separate from the browser-course estimate and are never required for course progress.

Course map

Browse all six stages

Your recommended objective stays above. Open this map when you want to look ahead or revisit a topic.

1 · Understand a network13 objectives · 20% exam weight · 0 complete

Follow a packet, choose media, calculate subnets, and explain IPv4, IPv6, Ethernet, wireless, and virtualization.

  1. 1.1 Follow a packet through the networkNot started
  2. 1.2 Choose a topology that fits the trafficNot started
  3. 1.3 Match cable and interface to the linkNot started
  4. 1.4 Read interface symptoms before changing settingsNot started
  5. 1.5 Choose TCP or UDP from application needsNot started
  6. 1.6 Build and verify IPv4 subnetsNot started
  7. 1.7 Use private IPv4 space deliberatelyNot started
  8. 1.8 Configure an IPv6 link and prefixNot started
  9. 1.9 Recognize how IPv6 addresses deliver trafficNot started
  10. 1.10 Verify a client's IP viewNot started
  11. 1.11 Predict a Wi-Fi cell before tuning itNot started
  12. 1.12 Separate compute and routing with virtualizationNot started
  13. 1.13 Predict an Ethernet switch decisionNot started
Stage 1 synthesis · Connect a small officeComplete after objective 1.13, before starting Network Access.Plan for stage end · about 60m

Optional, external, and self-checked. This project combines the stage in a simulator or lab, but it does not award browser-course credit or prove the configuration to ITForMe.

Use one switch, two PCs, and one router in an isolated Packet Tracer file. Label every cable and interface.

  1. Allocate 192.0.2.0/26 to the office. Write its network, broadcast, usable range, and mask before assigning addresses.
  2. Connect both PCs to switch access ports. Give the router LAN interface 192.0.2.1/26, PCs .10 and .11, and enable the router interface.
  3. Set both default gateways to 192.0.2.1. Ping the peer and gateway; inspect the switch MAC table and the PCs' ARP tables.
  4. Add 2001:db8:1::/64 to the LAN, verify the client IPv6 parameters, and test the local IPv6 path.
  5. Change one PC to a different subnet, predict what will fail, then restore it. Sketch which addresses a frame and packet carry on the working path.

Verify

  • The subnet has 62 usable host addresses (.1–.62); .0 is the network and .63 is broadcast.
  • Both PCs can reach each other and the gateway over IPv4 and have working local IPv6 connectivity. MAC learning identifies the expected switch ports.
  • Explain why a wrong gateway can leave local connectivity working while remote connectivity fails.

Keep as evidence

  • IPv4 and IPv6 addressing table
  • Successful peer and gateway tests
  • MAC and ARP table observations

Mapped objectives: 1.11.31.41.61.81.101.13

2 · Build the access network9 objectives · 20% exam weight · 0 complete

Separate VLANs, carry them over trunks, prevent loops, aggregate links, and connect wireless clients.

  1. 2.1 Build VLAN boundaries across switchesNot started
  2. 2.2 Carry selected VLANs over an 802.1Q trunkNot started
  3. 2.3 Verify the neighbor before tracing fartherNot started
  4. 2.4 Bundle compatible links with LACPNot started
  5. 2.5 Read Rapid PVST+ as a loop-free treeNot started
  6. 2.6 Place AP functions in a controller architectureNot started
  7. 2.7 Cable the WLAN data pathNot started
  8. 2.8 Choose and protect the management pathNot started
  9. 2.9 Read a WLAN profile from SSID to client VLANNot started
Stage 2 synthesis · Segment the officeComplete after objective 2.9, before starting IP Connectivity.Plan for stage end · about 90m

Optional, external, and self-checked. This project combines the stage in a simulator or lab, but it does not award browser-course credit or prove the configuration to ITForMe.

Extend the office to two switches and four PCs. Save a copy before adding redundant links.

  1. Create staff VLAN 10 and guest VLAN 20 on both switches. Place one PC from each VLAN on each switch.
  2. Assign staff addresses from 192.0.2.0/26 and guests from 192.0.2.64/26. Configure a trunk with matching allowed and native VLANs.
  3. Enable or inspect CDP or LLDP on the infrastructure link and confirm that each switch discovers the intended neighbor and port.
  4. Verify same-VLAN connectivity across switches first. Convert the switch-to-router port to a trunk carrying VLANs 10 and 20. Remove 192.0.2.1/26 from the router physical interface (no ip address) and keep it enabled; move that address to its VLAN 10 subinterface with encapsulation dot1Q 10. Add a VLAN 20 subinterface with encapsulation dot1Q 20 and gateway 192.0.2.65/26. Update client gateways and test inter-VLAN routing.
  5. Add a second switch link and build an LACP bundle with matching member settings. Inspect the port channel and spanning-tree state; disconnect one member and retest.

Verify

  • The VLAN and trunk tables show both VLANs on the intended ports; isolated VLANs need routing to communicate.
  • The bundle remains usable after one member fails. Spanning tree sees the intended logical path.
  • Removing VLAN 20 from the allowed list breaks guest traffic across the trunk; restoring it fixes that fault.

Keep as evidence

  • VLAN, trunk, and discovery-protocol outputs
  • EtherChannel and spanning-tree state
  • Expected-versus-observed failover tests

Mapped objectives: 2.12.22.32.42.5

3 · Route between networks5 objectives · 25% exam weight · 0 complete

Read routing tables, resolve forwarding decisions, and configure static routes and single-area OSPF.

  1. 3.1 Read every field in a routeNot started
  2. 3.2 Make the forwarding decision in the right orderNot started
  3. 3.3 Install precise static routes and safe backupsNot started
  4. 3.4 Form and verify one OSPFv2 areaNot started
  5. 3.5 Keep the first-hop gateway availableNot started
Stage 3 synthesis · Connect a branchComplete after objective 3.5, before starting IP Services.Plan for stage end · about 90m

Optional, external, and self-checked. This project combines the stage in a simulator or lab, but it does not award browser-course credit or prove the configuration to ITForMe.

Add a branch router and LAN. Use 198.51.100.0/26 for its clients and 203.0.113.0/30 for the router transit link.

  1. Address and enable the transit link with .1 and .2. Verify adjacent connectivity before configuring routes.
  2. Before enabling OSPF, configure and verify an IPv4 network route in both directions, a /32 host route for one test host, a default route for otherwise unknown destinations, and a floating route through a separately labeled backup next hop with a higher administrative distance. Remove and restore the primary path to prove when the floating route is installed.
  3. Replace the IPv4 static LAN routes with OSPF area 0 advertisements. Use unique router IDs and passive interfaces toward client LANs.
  4. Inspect neighbors and learned routes. Change one side of the transit to area 1, identify the failed adjacency, and restore area 0.
  5. On a saved variant, add 2001:db8:10::/64 and 2001:db8:20::/64 LANs plus primary and backup transit links. Configure and verify IPv6 network, /128 host, default, and floating static routes; test the primary and failover paths.

Verify

  • IPv4 clients communicate across sites with an OSPF neighbor in the expected state and OSPF-learned LAN routes.
  • Explain longest-prefix match using a host route, a subnet route, and a default route to the same destination.
  • IPv6 works through explicit IPv6 routes; OSPFv2 does not supply those IPv6 routes.

Keep as evidence

  • IPv4 and IPv6 route tables
  • OSPF neighbor and learned-route outputs
  • Client traces before and after the injected area fault

Mapped objectives: 3.13.23.33.4

4 · Operate network services9 objectives · 10% exam weight · 0 complete

Deliver addressing and name resolution, translate addresses, secure administration, and interpret monitoring.

  1. 4.1 Translate inside addresses with NATNot started
  2. 4.2 Keep network clocks synchronizedNot started
  3. 4.3 Connect DHCP addressing to DNS namingNot started
  4. 4.4 Monitor devices with SNMPNot started
  5. 4.5 Make syslog usefulNot started
  6. 4.6 Configure DHCP clients and relaysNot started
  7. 4.7 Reason through QoS per-hop behaviorNot started
  8. 4.8 Secure remote CLI access with SSHNot started
  9. 4.9 Choose between TFTP and FTPNot started
Stage 4 synthesis · Make the branch supportableComplete after objective 4.9, before starting Security Fundamentals.Plan for stage end · about 90m

Optional, external, and self-checked. This project combines the stage in a simulator or lab, but it does not award browser-course credit or prove the configuration to ITForMe.

Use the routed office and branch. Add a server on the office LAN for simulated DNS, DHCP, and logging where supported.

  1. Build a branch DHCP scope with its own subnet, gateway, and DNS address. Relay broadcasts from the branch client-facing interface to the server.
  2. Create an internal DNS name and test an address first, then the name. Compare a DHCP failure with a DNS failure.
  3. Configure SSH on the routers with a local lab-only account and restrict VTY transport to SSH. Verify remote login from the management subnet and verify that Telnet is refused.
  4. Configure time synchronization and a log destination if the selected simulator supports them. Explain severity 3 versus severity 6 messages.
  5. Use a separate outside test segment to configure and verify both a static NAT mapping and a one-to-one dynamic NAT pool selected by an inside-source ACL. Record inside local/global addresses, verify request and reply translations, and prove pool exhaustion does not silently become PAT.

Verify

  • A branch client receives the branch scope and resolves the test hostname; the relay is placed on the client-facing interface.
  • SSH succeeds and Telnet is refused by the VTY transport setting.
  • The NAT translation and packet path agree. Unsupported NTP/logging features are documented as design exercises, not successful executions.

Keep as evidence

  • Client lease and name-resolution results
  • SSH success and Telnet refusal
  • NAT, time, and logging outputs or labeled design-only notes

Mapped objectives: 4.14.24.34.54.64.8

5 · Protect access and traffic10 objectives · 15% exam weight · 0 complete

Apply device, Layer 2, wireless, and traffic controls; distinguish identity, authorization, and accounting.

  1. 5.1 Connect threats, weaknesses, and controlsNot started
  2. 5.2 Build people and physical security into the programNot started
  3. 5.3 Control IOS access with local credentialsNot started
  4. 5.4 Design usable authentication policyNot started
  5. 5.5 Compare IPsec VPN designsNot started
  6. 5.6 Filter traffic with IPv4 ACLsNot started
  7. 5.7 Defend the access layerNot started
  8. 5.8 Separate authentication, authorization, and accountingNot started
  9. 5.9 Evolve wireless protection from WPA to WPA3Not started
  10. 5.10 Build a WPA2-PSK WLAN in the controller GUINot started
Stage 5 synthesis · Prove the access policyComplete after objective 5.10, before starting Automation and Programmability.Plan for stage end · about 90m

Optional, external, and self-checked. This project combines the stage in a simulator or lab, but it does not award browser-course credit or prove the configuration to ITForMe.

Take a copy of the campus lab and retain console access. Staff may reach internal services; guests may not reach staff hosts.

  1. Configure a lab-only local administrator and protected console access. Confirm the credentials work before changing any remote access or traffic policy.
  2. Write an allow/deny matrix for guest-to-staff, staff-to-server, and management-to-router traffic before configuring an extended ACL.
  3. Place the ACL at the chosen interface and direction. Include necessary permitted traffic and account for the implicit deny.
  4. Test both allowed and denied traffic from the actual source VLANs and inspect ACL counters. Restore console access if the management rule was wrong.
  5. On a supported switch, enable DHCP snooping for the client VLANs and trust only the server/uplink path. Enable Dynamic ARP Inspection for those VLANs, retain endpoint ports as untrusted, and add an explicit ARP ACL binding for any static-address endpoint. Configure port security on a one-host access port with sticky learning, a maximum of one address, and shutdown violation mode. Test a legitimate lease and ARP exchange, a rogue DHCP offer, an ARP spoof, and a second source MAC.
  6. Build a separate WPA2-Personal wireless test with AES and a unique lab passphrase. Test a correct and incorrect passphrase, then explain how WPA3-Personal changes authentication.

Verify

  • Guest-to-staff traffic fails while intended staff service access and management continue to work.
  • Each negative test is caused by the intended control, rather than a broken route or disabled interface.
  • DHCP snooping bindings, Dynamic ARP Inspection results, the static ARP ACL, and port-security state agree with the trust policy; a rogue offer, spoofed ARP, and excess source MAC are rejected.
  • Document which Layer 2 and wireless controls the chosen platform supports; review unsupported ones using the lesson's evidence exercise.

Keep as evidence

  • Policy matrix and ACL counter outputs
  • Layer 2 security bindings or labeled design notes
  • Successful and rejected wireless association tests

Mapped objectives: 5.35.65.75.95.10

6 · Describe and automate change7 objectives · 10% exam weight · 0 complete

Reason about controllers, APIs, JSON, configuration tools, and the limits of AI-assisted operations.

  1. 6.1 Use automation as an operating system for changeNot started
  2. 6.2 Compare distributed and controller-based networksNot started
  3. 6.3 Read a software-defined fabricNot started
  4. 6.4 Use AI and machine learning with operational judgmentNot started
  5. 6.5 Reason about REST APIsNot started
  6. 6.6 Recognize Ansible and Terraform workflowsNot started
  7. 6.7 Read and validate JSONNot started
Stage 6 synthesis · Review an automation proposalComplete after objective 6.7, before the final readiness work.Plan for stage end · about 60m

Optional, external, and self-checked. This project combines the stage in a simulator or lab, but it does not award browser-course credit or prove the configuration to ITForMe.

Use a text editor and the inventory from your lab. This is a paper/reading exercise; no live API credentials are required.

  1. Represent two lab interfaces as JSON objects with name, enabled (boolean), and VLAN (number) fields inside an array.
  2. Describe an authenticated REST request to read an interface and a request to update it. Identify the method, URL, headers, and body; follow the hypothetical API contract.
  3. Explain where a controller's northbound interface, southbound interface, control plane, and data plane fit in your diagram.
  4. Compare an Ansible configuration task with a Terraform plan. Describe repeat execution, secret handling, state, review, and rollback.
  5. Review a fictional AI suggestion to disable an ACL to fix connectivity. Identify evidence needed, the lost protection, and a narrower test before accepting any change.

Verify

  • JSON uses quoted keys, valid value types, and no trailing commas or comments.
  • The proposal distinguishes successful HTTP transport from a correct network outcome and includes post-change reachability and policy tests.
  • An authorized reviewer can see the proposed diff, a bounded test, and a recovery plan before execution.

Keep as evidence

  • Validated JSON inventory sample
  • Annotated API request and architecture diagram
  • Reviewed change, test, and recovery proposal

Mapped objectives: 6.16.26.36.46.56.66.7

External lab setup and capstoneStage projects appear beside each stage aboveOptional · self-checked · no course credit

The six stage projects total 8h and the final project is estimated at 4h: 12h of optional external work in all, plus setup. None is required for progression or included in the 68h 30m browser-route estimate. ITForMe does not run or grade external configurations; keep your own test notes.

Optional lab setup and command-line reference

Set up a place to practise

  1. Create a folder for your topology files, address plans, and test notes.
  2. On a Windows, macOS, or Linux computer, use Cisco's Packet Tracer introduction and official downloads. Follow Cisco's account and installation steps. Packet Tracer is a separate desktop application; a phone can be used for these readings and quizzes.
  3. Place two PCs and a switch, connect the PCs with copper links, and save the file. Later lessons explain the addresses and settings. Save a fresh copy before each experiment.

Your first command-line habits

A router or switch prompt tells you its mode. > is user mode; enable enters privileged mode (#); configure terminal enters global configuration. interface selects a particular port, exit goes back one level, and end returns to privileged mode. Use ? for help and show commands to inspect before changing anything.

Interface names and supported features depend on the model. Inspect show ip interface brief before copying a sample interface name. Save successful IOS changes with copy running-config startup-config and save the simulator file too. Keep a console open when changing management access.

External exercises and stage labs are self-checked. ITForMe does not run or grade your Packet Tracer file. Use the expected observations in each exercise, and record unsupported platform features as reading exercises.

Optional final project · Build and troubleshoot a two-site networkAbout 240 minutes · all practical objectives

Setup: Start from a blank isolated simulator file. Keep console access, save a clean baseline before fault injection, and use lab-only credentials and addresses.

  1. Rebuild the office and branch from a blank lab using your addressing table. Configure and verify IPv4 and IPv6, two VLANs, trunks, CDP or LLDP, an LACP bundle, IPv4 and IPv6 default, network, host, and floating static routes, and single-area OSPFv2. Prove each floating route appears only after its primary path is withdrawn.
  2. Add DHCP client/relay, both static NAT and a one-to-one dynamic NAT pool without overload, NTP client/server roles, SSH with local device access control, and DNS where the simulator supports it. Verify translations for each NAT mode and pool exhaustion. Record design-only evidence for an unsupported feature instead of claiming a successful test.
  3. Add an extended ACL, port security, DHCP snooping and Dynamic ARP Inspection where supported. Build a separate WLAN with WPA2 PSK in the GUI. Verify both permitted and denied flows and record the exact source, destination, expected result, and observed result.
  4. Introduce three faults, one at a time: an omitted trunk VLAN, a wrong route or OSPF area, and an ACL rule in the wrong order. Identify each fault with evidence before changing it.
  5. Save the recovered topology, running configurations, address plan, test matrix, and a brief change log. Explain the forwarding path and why each fix was sufficient.
  6. Complete the course's mixed practice and browser labs, then revisit missed objectives. Rebuild the practical lab later without reading the solution notes.

    7. Verify

    • The test matrix includes positive and negative tests from actual endpoint VLANs, not only router-originated pings.
    • Routing, neighbor, translation, security, and access outputs agree with the intended topology and policy.
    • Each injected fault is identified from evidence before a bounded change, then retested after recovery.
    • Unsupported simulator features are named and supported with a configuration review or design explanation, never marked as executed.

    Keep as evidence

    • Addressing and VLAN table with interface ownership
    • Saved topology and sanitized running configurations
    • Expected-versus-observed test matrix including denied flows
    • Fault log with symptom, evidence, change, retest, and recovery note

    Mapped practical objectives: 1.101.61.82.12.22.32.43.33.44.14.24.64.85.105.35.65.7

    External work is self-checked and does not award course credit. Independent subject-matter review remains pending.