RoleMath Study Track · free study companion
A free study companion keyed to the officially published exam domains of Cisco Certified Network Associate (200-301): what each domain covers in plain language, clearly labeled free resources, a guided lab outline for every domain, and interactive self-checks from our own question bank. Cisco CCNA 200-301 v1.1 exam topics
A free, source-cited study companion built on Cisco's published 200-301 (v1.1) exam topics — not official training, not a pass guarantee. Verify the current objectives on the official page before your exam.
Not sure which domain to start with? Take the readiness check on the cert page →
Program blueprint under review
A free CCNA program blueprint pinned to Cisco's current 200-301 v1.1 topics, combining official-first and vetted community instruction with configuration, verification, troubleshooting, and automation evidence in authorized Cisco lab environments or clearly labeled written alternatives, without claiming instructional completeness or an exam or employment outcome.
This draft exposes RoleMath’s authored sequence and evidence plan. The current labs are guided outlines, not yet a fully fixture-backed course, and objective-leaf coverage has not passed the gold-standard gate. Completion does not predict an exam result.
Choose an outcome
Choose provisionally. Change routes when the work tells you something new about fit, time, or readiness.
Learners who have chosen CCNA and need one complete practice sequence across all six current 200-301 v1.1 domains.
Completion emphasis: Complete all six modules and labs, the two-site Cisco capstone, a command-and-objective crosswalk, and a final gap review against Cisco's official topics.
Career changers and support technicians who want reviewable Cisco-style configuration, verification, troubleshooting, and documentation artifacts before scheduling an exam.
Completion emphasis: Retain a redacted topology, address and VLAN plan, configuration evidence, show-command baseline, services/security tests, automation artifact, fault records, rollback plan, and technical handoff.
Learners deciding whether command-line network configuration, packet-flow reasoning, troubleshooting, and automation concepts fit how they like to work.
Completion emphasis: Complete the diagnostic, subnetting, VLAN, routing, and JSON labs; record whether building, verifying, and repairing a simulated network is work you want to pursue further.
Start safely
Route learners to foundations and a safe simulator setup before associate-level configuration; this is a practice-readiness diagnostic, not a Cisco prerequisite or pass prediction.
Ready when: Yes, including a willingness to work subnet boundaries by hand before checking them with a tool.
If not yet: Complete a vendor-neutral addressing and subnetting foundation before routing, VLAN, DHCP, NAT, ACL, or OSPF configuration.
Ready when: Yes, inside an authorized Cisco lab environment with the current prompt visible.
If not yet: Use the IOS-mode warm-up and command-transcript alternative before the first switch or router configuration lab.
Ready when: Yes, with the Cisco account, installation permission, hardware capacity, or sandbox reservation required by the selected authorized route.
If not yet: Use the topology, configuration-transcript, expected-output, and troubleshooting-table alternatives; label them observation-only until an authorized execution environment is available.
Ready when: Yes, with no work, school, public, shared, or third-party network in scope.
If not yet: Do not configure real equipment; use an authorized disposable lab or the written alternative and complete the backup, rollback, and authorization checklist first.
Ready when: Yes, or you can complete the short JSON parsing warm-up before the automation phase.
If not yet: Practice reading and repairing a neutral JSON interface record; no programming or live API account is required.
Ready when: Yes, with enough time to explain command evidence and recover from mistakes rather than only follow steps.
If not yet: Choose the steady pace, separate topology build from configuration and verification, and defer exam scheduling until the routine is sustainable.
Plan, then adapt
14 weeks 8-10 hours/week
A planning estimate for learners new to networking: reserve several weeks for addressing, switching, and routing foundations, then separate services, security, automation, troubleshooting, and integration.
10 weeks 10-14 hours/week
A planning estimate that moves through one major configuration phase most weeks and protects the final two weeks for the integrated build, fault recovery, and objective gaps.
6 weeks 16-20 hours/week
For learners with prior Network+, support, addressing, or Cisco CLI experience; slow down when a route, VLAN, service, ACL, or JSON result cannot be predicted before verification.
Evidence-gated sequence
Pin 200-301 v1.1, choose a goal and pace, establish the simulator and evidence workspace, and record the addressing, CLI, safety, and automation baseline.
Build the addressing, device-role, protocol, media, and packet-flow foundation that every switching, routing, service, security, and automation task assumes.
Modules: Network Fundamentals
Configure and verify Layer 2 segmentation, reason about access and trunk behavior, and connect switching and wireless design to the addressing plan.
Modules: Network Access
Build routed reachability, interpret route selection and next hops, compare static and dynamic routes, and verify single-area OSPF behavior.
Modules: IP Connectivity
Configure and verify address assignment, translation, access control, and switch-port protection while preserving secure management and reversible change boundaries.
Modules: IP Services, Security Fundamentals
Read structured network data, distinguish traditional and controller-based management, and explain a safe desired-state workflow without pointing automation at live gear.
Modules: Automation and Programmability
Integrate addressing, access, connectivity, services, security, automation, verification, troubleshooting, rollback, and handoff in one coherent simulator project.
Modules: Network Fundamentals, Network Access, IP Connectivity, IP Services, Security Fundamentals, Automation and Programmability
Before a lab
Show your work
Completing this policy demonstrates 200-301 coverage and simulator practice inside RoleMath; it does not predict a CCNA score, replace Cisco's current guidance, or authorize changes to any real network.
Integrated practice
Design, configure, verify, secure, document, and troubleshoot a fictional headquarters-and-branch network in a simulator, then produce a sanitized handoff spanning all six current CCNA domains.
Safety boundary: Build, automate, break, and repair only fictional devices inside an owned simulator or explicitly authorized disposable lab. Never apply these configurations, credentials, ACLs, port-security settings, routing changes, captures, scans, or automation requests to work, school, public, shared, or third-party gear, and do not redistribute licensed Cisco images or courseware.
Finish honestly
Present the artifacts as self-directed CCNA simulator work demonstrating configuration, verification, troubleshooting, and documentation. Do not call them production administration, employment experience, official Cisco labs, or a RoleMath credential.
Objective source checked 2026-07-10. Recheck objectives every 30 days and resources every 90 days.
The official objective domains and their exam weight — titles & weights only, straight from the vendor’s exam objectives. Cisco CCNA 200-301 v1.1 exam topics
Our default sequencing advice is heaviest-weight-first, because the published weights tell you where the exam spends its questions. For CCNA that mostly works, with one honest dependency wrinkle worth naming up front. By pure weight the order would be IP Connectivity (25%) first, then the two 20% domains Network Fundamentals and Network Access, then Security Fundamentals (15%), then the two 10% domains IP Services and Automation and Programmability. We keep IP Connectivity first because it is both the heaviest domain and the heart of what CCNA tests — routing between networks. The wrinkle is that Network Fundamentals (20%) is the addressing-and-vocabulary foundation the routing domain assumes you already speak: you cannot reason about routes and next hops until you are fluent in IP addressing and subnetting. So if the routing material feels like a foreign language when you start, drop back to Network Fundamentals first and then return — the two are tightly coupled, and many people find it easier to learn a little addressing, then routing, then more addressing. After those come Network Access (switching, VLANs, wireless), then Security Fundamentals, then the lighter IP Services and Automation domains, which build on everything before them. This is sequencing advice based on the published weights and how the topics depend on each other, not a claim about the science of learning — if a different order fits how you think, use it. CCNA is an associate-level exam; it assumes basic familiarity with computers and networking going in, so give yourself extra time on the fundamentals if you are brand new.
Module 1 of 6 · domain 3 · 25% of the exam
First in our suggested order — the single heaviest domain at 25% and the heart of what CCNA tests. This is routing: how traffic gets from one network to another. It leans hard on the addressing from Network Fundamentals, so if it reads like a foreign language, drop back to the fundamentals and then return.
Plain-language explanation in our own words — paraphrased from, and checked against, the official objectives. Cisco CCNA 200-301 v1.1 exam topics
This is the routing domain, the single heaviest slice at 25%, and the heart of what CCNA is about: getting traffic from one network to another. Where the access domain moved traffic within a network, this one is about the decisions a router makes at every hop — look at a destination address, consult a table, forward the packet toward the right next hop. It is also the domain that leans hardest on the addressing fluency from Network Fundamentals, which is exactly why, even though it is our recommended starting point by weight, we tell you to fall back to the fundamentals the moment routing stops making sense.
The foundation is the routing table and how a router chooses a path. You are expected to read a routing table and understand how a router decides between competing routes: the longest-prefix match (the most specific route to a destination wins), administrative distance (how much a router trusts one source of a route over another), and metrics (how a protocol ranks paths once trust is equal). The mental model to build is a decision at every hop: given this destination, which entry in the table is the best match, out which interface does the packet go, and why?
The domain distinguishes the two ways routes get into that table. Static routes are typed in by an administrator — simple, predictable, and fully under your control, but they do not adapt when the network changes. Dynamic routing protocols let routers learn and share routes automatically, adapting to failures and growth at the cost of complexity. You are expected to configure static routes (including a default route, the 'if nothing else matches, send it here' entry) for both IPv4 and IPv6, and to understand where each approach fits.
The dynamic-routing centerpiece at the associate level is OSPF — a link-state protocol that routers use to build a shared map of the network and calculate shortest paths. You are expected to configure single-area OSPF for IPv4: enabling it, advertising networks, understanding neighbor relationships and the router ID, and reading the routes it produces. You do not need to master every OSPF nuance, but you should be able to stand up a small OSPF network, watch two routers become neighbors, and see the routes they learn appear in each other's tables — which is exactly what this domain's lab does.
The domain also covers the supporting realities of connectivity: the difference between IPv4 and IPv6 forwarding, first-hop redundancy at a conceptual level (how two routers can share responsibility for being a gateway so one failing does not strand a network), and the everyday verification commands that tell you whether connectivity is actually working. A recurring exam skill is less about typing a command and more about interpreting its output: what does this routing table entry mean, why did the router pick this path, and what would change if a link went down?
Study this domain by building routes, not just reading about them. The simulator lab below has you connect two routers, address the link between them, and get networks on opposite sides to reach each other — first with a static route, then by letting OSPF learn the path automatically — so 'a router forwards between networks' becomes something you made happen and then watched adapt. Keep narrating the destination, the matching table entry, and the next hop as you go. And read the official 200-301 (v1.1) exam-topics list for the exact topics; this explanation paraphrases the domain's scope in our own words rather than reproducing Cisco's.
Connect two routers, address the link between them, and get a network behind each router to reach the other — first by typing a static route by hand, then by tearing that out and letting single-area OSPF learn the same path automatically. This is the core CCNA skill, routing between networks, built and then made adaptive with your own hands.
A ping between two PCs that fails until a route exists, succeeds once you add a static route (visible as an S in 'show ip route'), fails again when you remove it, and then succeeds once more via an OSPF-learned route (visible as an O) that you never typed by hand — and that disappears and reappears on its own when you disable and re-enable the link. You have built inter-network routing two ways and seen the difference between static and dynamic first-hand.
This lab practices the static-routing, default-route, and single-area OSPF configuration and the routing-table interpretation covered by Domain 3 (IP Connectivity) of the official 200-301 v1.1 exam topics — see the official exam-topics list for the exam's own wording. The IOS commands here are functional configuration, not copied objective prose.
Stay safe & legal: Keep every route and interface change inside CML-Free, a suitable authorized DevNet Sandbox, or an explicitly owned disposable lab. Never configure third-party gear or networks. Do not move CML images into another emulator or distribute images or lab files. Packet Tracer is not required for this RoleMath lab; use it only within Cisco Networking Academy or another purpose Cisco approves in writing.
2RoleMath-original concept checks for this domain — written by us against cited public sources, never taken from any exam. They confirm understanding; they don’t predict a pass.
Module 2 of 6 · domain 1 · 20% of the exam
Second in our suggested order by weight, but the true foundation. This domain is the addressing-and-vocabulary bedrock — IP addressing, subnetting, and how the pieces of a network fit together — that the heavier IP Connectivity domain assumes you already speak. If routing ever reads like a foreign language, the gap is almost always here; drop back to this domain and then return.
Plain-language explanation in our own words — paraphrased from, and checked against, the official objectives. Cisco CCNA 200-301 v1.1 exam topics
This is the foundation domain, and at 20% it is one of the two largest slices on the outline. Before CCNA asks you to route between networks, secure a switch, or automate a device, it establishes the shared language for describing a network at all: the components a network is built from, how devices are addressed, and how data is modeled as it crosses a wire. Almost every scenario elsewhere on the exam is written in the words this domain teaches, so if a later routing or switching question ever reads like a foreign language, the gap is usually right here — which is exactly why, despite the weight order, we treat this as bedrock.
The first area is the physical and logical components of a network: routers, switches, endpoints, servers, access points, and the cabling and interfaces that connect them. Routers move traffic between different networks; switches move traffic within a network; endpoints are the devices people actually use. You are expected to know what each component is for, where it sits, and the common cabling and connection types — copper versus fiber, the roles of different interface and port types, and the honest reality that a surprising share of real network problems are physical. Respecting the physical layer is part of thinking like a network engineer.
The second big idea is layering. Networking is easier to reason about when you slice it into layers, each responsible for one job and talking only to the layers directly above and below it. The classic teaching model is the seven-layer OSI model — from the physical signals on the wire up through addressing, routing, and the application a person uses — alongside the more practical TCP/IP model that real networks run on. You do not need to worship either model; you need to be able to place a technology, a device, or a problem at the right layer. 'Is this a cabling issue or a routing issue?' is a layering question, and layering is the mental filing cabinet the rest of the exam keeps opening.
The third big idea is addressing, and this is where the domain gets concrete and where CCNA is famously demanding. Every device on an IP network needs an address, and you are expected to be fluent in IPv4 (the familiar four-number dotted format), the reasons IPv6 exists and how its longer addresses are written and compressed, and the difference between public and private ranges. The skill that separates people who 'get' networking from people who have only memorized it is subnetting — carving an address block into smaller networks using a prefix length, and being able to say, for any address, which network it belongs to, what its usable host range is, and where its boundaries fall. CCNA expects you to do this quickly and by hand, which is exactly what this domain's lab drills.
The fourth area is the supporting concepts that everything else depends on: the difference between the reliable, connection-oriented transport and the fast, connectionless one; the well-known protocols and their roles; how switching forwards frames using hardware addresses; and the basics of wireless architecture and the everyday principles of virtualization that modern networks assume. These are introduced here as concepts and then put to work in the access, connectivity, and services domains — so time spent making them solid here pays off repeatedly later.
On the job and on the exam, this domain is the difference between memorizing acronyms and reasoning about them. A good way to study is to stop reading and start locating: take any everyday action — loading a web page, sending a message — and narrate which layer, which addresses, and which components it touches, out loud, until the story is automatic. Pair that with the subnetting lab below, which turns the single most testable concept in the domain into something you have worked by hand and then verified in a free simulator. And read the official 200-301 (v1.1) exam-topics list for the exact topics — the wording there is Cisco's own, and this explanation deliberately paraphrases rather than reproduces it.
Carve an address block into subnets with nothing but paper and reasoning — apply a prefix, compute each subnet's network address, broadcast, and usable host range — then assign those addresses to devices in a free network simulator and confirm the boundaries hold. Fast, accurate subnetting by hand is the single most testable hands-on skill in CCNA's fundamentals, and it only sticks once you have done it by hand and then watched it work.
On paper: four /26 subnets at .0, .64, .128, and .192, each with 62 usable hosts and a clean broadcast at .63/.127/.191/.255, plus a binary boundary sitting exactly where the prefix says it should. In the simulator: two hosts in the same subnet ping successfully, and the moment you move one host across a subnet boundary the ping fails — the addressing math you did by hand, confirmed by real behavior.
This lab practices the IPv4/IPv6 addressing and subnetting skills that Domain 1 (Network Fundamentals) of the official 200-301 v1.1 exam topics names among its addressing topics — see the official exam-topics list for the exam's own wording.
Stay safe & legal: The subnetting is a paper exercise using example private-range addresses, and every ping must stay inside CML-Free, a suitable authorized DevNet Sandbox, or an explicitly owned disposable lab. Do not move CML images into another emulator or distribute images or lab files. Packet Tracer is not required for this RoleMath lab; use it only within Cisco Networking Academy or another purpose Cisco approves in writing.
3RoleMath-original concept checks for this domain — written by us against cited public sources, never taken from any exam. They confirm understanding; they don’t predict a pass.
Module 3 of 6 · domain 2 · 20% of the exam
Third in our suggested order — one of the two 20% domains. This is the switching-and-wireless layer: VLANs, trunks, and how traffic moves within a network. It builds directly on the addressing from Network Fundamentals and pairs naturally with the switch-configuration simulator lab.
Plain-language explanation in our own words — paraphrased from, and checked against, the official objectives. Cisco CCNA 200-301 v1.1 exam topics
This is the switching domain, and at 20% it is one of the two heaviest slices. Where Network Fundamentals taught you how networks are described and addressed, this domain is about how traffic moves within a network — the switches that forward it, the way one physical switch is carved into separate logical networks, the links that carry many of those networks between switches, and the wireless access that has become part of nearly every network. It rewards a hands-on mindset: these topics finally click when you have configured a switch, even in a simulator, and watched traffic behave.
The core skill is the virtual LAN, or VLAN. A single physical switch can be logically split into several separate networks, so that devices in one VLAN cannot talk directly to devices in another without passing through a router — which is both an organizational convenience and a security boundary at the same time. You are expected to configure VLANs, assign switch ports to them (access ports, which carry a single VLAN to an endpoint), and understand what problem VLANs solve. The mental model to build is that a VLAN turns one switch into many, and that membership is decided by configuration, not by which physical switch a device is plugged into.
Carrying multiple VLANs between switches requires trunk links. Where an access port carries one VLAN to a device, a trunk port carries many VLANs between switches by tagging each frame with the VLAN it belongs to, so the far switch knows where it goes. You are expected to understand trunking and the tagging standard behind it, the idea of a native VLAN, and how switches can discover and negotiate these links. This is the plumbing that lets a VLAN span an entire building rather than a single switch.
Because redundant switch connections can create loops that flood a network into collapse, the domain covers loop prevention — the mechanism that detects redundant paths and logically blocks them until they are needed, so you can have physical redundancy without a broadcast storm. You are expected to recognize the purpose of this mechanism and its basic operation rather than to master every timer. Alongside it sits link aggregation, which bundles several physical links into one logical link for more bandwidth and resilience, and the discovery protocols that let Cisco devices learn about their directly connected neighbors.
The wireless portion introduces how Wi-Fi networks are built and managed at an associate level: the roles of access points and wireless controllers, the architecture that lets many access points be managed centrally, the common connection and management interfaces, and the basics of securing a wireless network with modern encryption and real authentication rather than by hiding its name. Wireless security threads into the Security Fundamentals domain too, but the architecture is introduced here.
The way to study this domain is to configure, not just read. The simulator lab below has you create a VLAN, assign switch ports to it, and prove that two devices in the same VLAN can talk while a device in a different VLAN cannot — which turns 'a VLAN is a logical network' from a sentence into something you have built and then deliberately broken. As you work, keep narrating the layer and the addresses involved, the habit from the fundamentals domain. And read the official 200-301 (v1.1) exam-topics list for the exact topics; this explanation paraphrases the domain's scope in our own words rather than reproducing Cisco's.
Build a small switched network with your own hands in a free simulator, create a VLAN, assign switch ports to it, and prove the boundary: two devices in the same VLAN can ping each other, while a device left in a different VLAN cannot reach them. This is switching and VLAN segmentation turned from theory into something you configured with real Cisco IOS commands.
A 'show vlan brief' output listing your new VLAN 10 with the ports you assigned; successful pings between two devices in the same VLAN; a failed ping to a device in a different VLAN despite identical addressing; and connectivity that appears the moment you move that device into the same VLAN. You have built and enforced Layer 2 segmentation from scratch.
This lab practices the VLAN configuration and switch-port (access) skills covered by Domain 2 (Network Access) of the official 200-301 v1.1 exam topics — see the official exam-topics list for the exam's own wording. The IOS commands here are functional configuration, not copied objective prose.
Stay safe & legal: Keep every change inside CML-Free, a suitable authorized DevNet Sandbox, or an explicitly owned disposable lab. Never configure third-party gear or networks. Do not move CML images into another emulator or distribute images or lab files. Packet Tracer is not required for this RoleMath lab; use it only within Cisco Networking Academy or another purpose Cisco approves in writing.
2RoleMath-original concept checks for this domain — written by us against cited public sources, never taken from any exam. They confirm understanding; they don’t predict a pass.
Module 4 of 6 · domain 5 · 15% of the exam
Fourth in our suggested order at 15%. This domain applies the earlier building blocks to defense — access control, port security, ACLs, and secure device access. It is also the natural on-ramp to a security path like CyberOps Associate or Security+ afterward.
Plain-language explanation in our own words — paraphrased from, and checked against, the official objectives. Cisco CCNA 200-301 v1.1 exam topics
This is the defense domain, and at 15% it is a middle-weight slice that punches above its size for career direction: it is the natural bridge from CCNA toward a security-focused path afterward. Where the earlier domains taught you to describe, build, connect, and service a network, this one asks how you keep it from being abused — the concepts security rests on, the common threats, and the standard controls a network engineer puts in place. Much of it is the earlier domains applied with an adversary in mind.
The starting point is a small set of security concepts the rest of the domain leans on. The classic statement of what security protects is confidentiality (only the right people can read it), integrity (nobody has silently changed it), and availability (it works when you need it) — and a striking number of scenarios are really asking which of those three is at stake. Around that sit authentication (proving who you are), authorization (what you are allowed to do), accounting (recording what was done), and everyday principles like least privilege and defense in depth. CCNA expects you to reason with these at the network level rather than to master them in depth.
Next comes the threat landscape as it touches networks. The domain expects you to recognize common attacks from a description of their behavior: traffic interception and on-path attacks that sit between two parties, denial-of-service attacks that overwhelm a service, address and name spoofing, and Layer 2 attacks specific to switches — such as flooding a switch's address table or tricking devices onto a rogue VLAN. You are also expected to appreciate the human-facing social-engineering tricks that bypass technology entirely by fooling a person. You are not being asked to launch any of these; you are being asked to name what is happening and know which control addresses it.
The hands-on heart of the domain is the access controls you actually configure. Port security limits which devices can connect to a switch port and can shut the port down if an unexpected device appears — a direct defense against several Layer 2 attacks. Access control lists (ACLs) filter traffic by matching source, destination, and other fields, permitting or denying packets as they cross a router or switch — the everyday tool for deciding what traffic is allowed where. You are expected to configure standard and extended ACLs and to apply them in the right place and direction, which is exactly what this domain's lab practices.
The domain also covers securing device access and the wider defenses. Hardening a device means changing default credentials, using strong and encrypted remote access rather than cleartext, and controlling who can administer it. Broader ideas include the role of VPNs for secure remote connectivity, the basics of wireless security (modern encryption and real authentication, not hiding the network name), and the layered principle that a network is defended in depth — no single control is trusted to be enough. Physical security earns a mention too, because a switch someone can walk up to is a control that has already failed.
A good way to study this domain is to configure the controls and watch them enforce, which is what the lab below does: you set up port security and an ACL in a simulator and then prove they block what they should. As you study, keep asking the defender's questions: which security goal does this protect, what attack does this stop, and what can a compromised device still reach? And read the official 200-301 (v1.1) exam-topics list for the exact topics; this explanation paraphrases the domain's scope in our own words rather than reproducing Cisco's.
Configure two foundational Cisco security controls with your own hands and watch them enforce: port security that shuts a switch port down when an unexpected device appears, and an access control list that permits some traffic while denying the rest. Both are done with real IOS commands inside a free simulator so you see the control actually block something.
A switch port that works normally for its learned device but goes into a shutdown/err-disabled state the moment a different device connects (with a rising violation count), and a router ACL that blocks one specific source from one specific destination while letting all other traffic through — with the access-list counters ticking up as the deny rule fires. You have watched two access controls enforce policy rather than just read about them.
This lab practices the port-security and access-control-list (ACL) configuration covered by Domain 5 (Security Fundamentals) of the official 200-301 v1.1 exam topics — see the official exam-topics list for the exam's own wording. The IOS commands here are functional configuration, not copied objective prose.
Stay safe & legal: Keep every security control and deliberate violation inside CML-Free, a suitable authorized DevNet Sandbox, or an explicitly owned disposable lab. Never configure security controls on third-party gear or networks. Do not move CML images into another emulator or distribute images or lab files. Packet Tracer is not required for this RoleMath lab; use it only within Cisco Networking Academy or another purpose Cisco approves in writing.
2RoleMath-original concept checks for this domain — written by us against cited public sources, never taken from any exam. They confirm understanding; they don’t predict a pass.
Module 5 of 6 · domain 4 · 10% of the exam
Fifth in our suggested order — one of the two lightest domains at 10%. These are the network services that keep everything running: DHCP, NAT, NTP, DNS, and remote-management protocols. They build on the addressing and routing you already know, which is why they come near the end.
Plain-language explanation in our own words — paraphrased from, and checked against, the official objectives. Cisco CCNA 200-301 v1.1 exam topics
This is the services domain, and at 10% it is one of the two lightest slices — but the services it covers are the ones a network quietly depends on every day, and they show up constantly in real work. Where the connectivity domain moved packets between networks, this domain is about the helper services that make a network usable: handing out addresses automatically, letting many private devices share a public address, keeping clocks aligned, resolving names, and managing devices remotely. It builds directly on the addressing and routing you already know, which is why we place it near the end.
The first service is automatic address assignment (DHCP). Rather than typing an address, mask, gateway, and DNS server into every device by hand, a DHCP server hands out that configuration automatically, leasing each address for a fixed time. You are expected to understand the role of DHCP, the difference between a client and a server, and how a Cisco router can act as a DHCP server or relay requests to one elsewhere. When 'the internet is down' turns out to be 'this device never got an address', DHCP is where you look.
The second service is network address translation (NAT), which lets many devices using private addresses share one or a few public addresses to reach the internet. You are expected to understand why NAT exists (the shortage of public IPv4 addresses), the difference between static and dynamic translation, and the very common form where many inside devices share a single public address distinguished by port number. NAT is one of those topics that feels abstract until you watch a private address get rewritten to a public one on the way out.
The third cluster is the smaller-but-important services: time synchronization (NTP), which keeps clocks aligned so that logs, certificates, and security events across many devices can actually be compared; name resolution (DNS) from the client's point of view; and the everyday quality-of-service idea that some traffic (voice, video) is more delay-sensitive than other traffic and can be prioritized. You are expected to recognize what each service does and what its failure looks like, not to become a specialist in any one of them.
The domain also covers how you manage devices remotely and safely: the difference between insecure and secure remote-access protocols (reaching a device over an encrypted session rather than a cleartext one), logging device events to a central place, and the management protocols that let monitoring systems read a device's health. This threads into the security and automation domains, because how you reach and monitor a device is both an operational and a security question.
Study this domain by making its invisible services visible, which is what the lab below does: it has you configure a Cisco router as a DHCP server in a simulator and watch a PC receive its address, gateway, and DNS automatically, then set up basic NAT and see a private address translated. That turns DHCP and NAT from acronyms into things you have configured and observed. And read the official 200-301 (v1.1) exam-topics list for the exact topics; this explanation paraphrases the domain's scope in our own words rather than reproducing Cisco's.
Make two of the network's most important background services visible by configuring them yourself: set up a Cisco router as a DHCP server and watch a PC receive its address automatically, then configure basic address translation (NAT) and see a private address rewritten to a public one. Both are done with real IOS commands inside a free simulator.
PCs that receive their addresses automatically from the router's DHCP pool (confirmed by 'ipconfig' on the PC and 'show ip dhcp binding' on the router), and a 'show ip nat translations' table showing a private inside address translated to the outside address when the PC sends traffic outward. Two invisible services made concrete and watchable.
This lab practices the DHCP and NAT configuration and verification covered by Domain 4 (IP Services) of the official 200-301 v1.1 exam topics — see the official exam-topics list for the exam's own wording. The IOS commands here are functional configuration, not copied objective prose.
Stay safe & legal: Keep every service and interface change inside CML-Free, a suitable authorized DevNet Sandbox, or an explicitly owned disposable lab; the outside range is documentation-only and must not reach the public internet. Never configure third-party gear or networks. Do not move CML images into another emulator or distribute images or lab files. Packet Tracer is not required for this RoleMath lab; use it only within Cisco Networking Academy or another purpose Cisco approves in writing.
2RoleMath-original concept checks for this domain — written by us against cited public sources, never taken from any exam. They confirm understanding; they don’t predict a pass.
Module 6 of 6 · domain 6 · 10% of the exam
Last in our suggested order — one of the two lightest domains at 10%, and the most conceptual. It is about how networks are increasingly managed by software rather than by typing on each device. It builds on everything before it, which is why it comes last, and it points toward where networking careers are heading.
Plain-language explanation in our own words — paraphrased from, and checked against, the official objectives. Cisco CCNA 200-301 v1.1 exam topics
This is the automation domain, and at 10% it is one of the two lightest slices — but it is the one that most clearly signals where networking is heading, and it is why Cisco added it to an associate exam that was once purely hands-on-the-command-line. Where the rest of CCNA is about configuring a network device by device, this domain is about managing networks with software: describing what you want in code, letting controllers push configuration at scale, and letting systems talk to each other through interfaces rather than a human typing on each box. For a career changer, this is the most forward-looking material on the exam.
The first idea is the shift from traditional to controller-based and software-defined networking. In the traditional model, each device makes its own forwarding decisions and you configure each one individually. In a controller-based model, a central controller holds the intelligence and pushes configuration and policy out to many devices, so you manage the network as one system rather than as a pile of individual boxes. You are expected to understand this separation — the idea that the 'control plane' (deciding where traffic goes) can be centralized while the 'data plane' (actually forwarding it) stays on the devices — and the benefits and trade-offs it brings.
The second idea is APIs — the interfaces through which software talks to network systems. Rather than a person typing commands, a program can send a structured request to a controller or device and get a structured answer back. You are expected to recognize the common style of web API used in networking (the kind that uses standard web methods to create, read, update, and delete things), the difference between an interface meant for machines and one meant for humans, and roughly how authentication and requests work at a conceptual level. You are not being asked to write production software — you are being asked to understand what an API is and why network automation depends on it.
The third idea is data formats and how automated systems exchange information. Automation tools pass structured data back and forth, and the common formats for that (a lightweight, widely used data-interchange format chief among them) are readable once you know the shape: names paired with values, nested to describe complex things. You are expected to interpret a small block of this structured data — to look at it and say what it describes — rather than to write it from scratch. Being able to read the shape of the data is most of the skill at this level.
The fourth idea is configuration-management and automation tooling at a conceptual level: the category of tools that apply a described configuration consistently across many devices, the principle of describing infrastructure as code so the same setup can be recreated and reviewed, and the general benefits — consistency, speed, and fewer human errors — that automation brings, alongside the honest trade-off that it adds a layer of tooling to learn and maintain. CCNA keeps this conceptual; you are recognizing what these tools do and why teams adopt them, not mastering any one of them.
Because this domain is conceptual and does not require configuring live gear, the lab below is a read-and-explain exercise: you examine a small block of structured data (the kind an API returns) and a simple description of an automated workflow, and you narrate what each part does — building the interpret-the-data skill the exam actually tests without touching any device or network. And read the official 200-301 (v1.1) exam-topics list for the exact topics; this explanation paraphrases the domain's scope in our own words rather than reproducing Cisco's.
Build the one hands-on skill this conceptual domain actually tests — interpreting the structured data an automation system exchanges — without touching any network device. You will read a small block of JSON like an API might return, name what each field describes, and then narrate how a simple automation workflow uses it, using only free tools and your own reasoning.
A small block of structured data you can read field by field and describe in plain English, a deliberate format error that a free JSON viewer flags and you then fix, and a clear written contrast between configuring one device by hand and pushing configuration to many devices through a controller and an API. You have practiced the interpret-the-data-and-explain-the-workflow skill this domain tests — with no device, account, or live gear involved.
This lab practices interpreting structured data (JSON) and understanding controller-based networking, APIs, and automation concepts covered by Domain 6 (Automation and Programmability) of the official 200-301 v1.1 exam topics — see the official exam-topics list for the exam's own wording.
Stay safe & legal: This lab touches no network device, account, or live gear at all — it is a pure read-and-explain exercise on a neutral example you typed yourself. There is nothing to configure and nothing that could affect any real system; never point automation tooling at gear or networks you do not own.
2RoleMath-original concept checks for this domain — written by us against cited public sources, never taken from any exam. They confirm understanding; they don’t predict a pass.
Studying Cisco Certified Network Associatebuilds transferable skills that carry across employers and platforms, not just toward this one exam. Each has a free, source-cited RoleMath primer — what it is, a step-by-step free learning path, clearly labeled free resources, and a safe hands-on exercise:
Work through the modules above, then get a personalized read on where you stand: the readiness check maps your background against these same published domains and suggests what to study first — no score, no pass prediction.
Check your Cisco Certified Network Associate readiness →Full Cisco Certified Network Associate decision page →
A free, source-cited study companion built on Cisco's published 200-301 (v1.1) exam topics — not official training, not a pass guarantee. Verify the current objectives on the official page before your exam.
Certification and vendor names are used only to identify the program this independent study companion refers to. RoleMath is not affiliated with, endorsed by, or sponsored by Cisco.