About this course map
Six domains, mapped one-for-one to the Cisco 200-301 CCNA exam topics and taught in the same order, so nothing on the exam is left uncovered.
The version that defines the current exam is CCNA v1.1. Cisco has published the next blueprint, v2.0, and set the changeover: 2 February 2027 is the last day of testing on v1.1, and v2.0 goes live for testing on 3 February 2027. Everything below is mapped to v1.1, which is the exam you will sit if you book before that date. If your exam date falls after the changeover, tell us when you enrol and we will place you on the v2.0 map instead — the two blueprints are structured differently, and studying the wrong one is an expensive mistake.
CCNA is a configuration exam. The questions are rarely satisfied by a definition; they give you output, or a topology, or a half-working config, and ask what is wrong or what comes next. The teaching follows that. Every domain below has lab time attached, on real IOS, with the console open in front of you rather than a slide of commands.
Domain 01 — Network Fundamentals
The vocabulary and the arithmetic that the other five domains assume you already have. 20% of the exam.
•Network components and what each one is actually for: routers, Layer 2 and Layer 3 switches, next-generation firewalls and IPS, access points, controllers, endpoints, servers, Power over Ethernet
•Topology architectures — two-tier, three-tier, spine-leaf, WAN, small office and home office, on-premises against cloud — and the trade-off each one buys
•Physical interfaces and cabling: single-mode fibre, multimode fibre and copper, shared-media against point-to-point Ethernet, and identifying interface and cable faults from the counters
•TCP against UDP, and why an application designer picks one
•IPv4 addressing and subnetting worked by hand until it is fast, plus private address space and where it stops working
•IPv6 addressing and prefixes, the address types — global, unique local, link local, anycast, multicast — and modified EUI-64
•Verifying IP parameters from a client operating system, because that is where most tickets start
•Wireless principles: non-overlapping channels, SSID, radio frequency behaviour and encryption
•Virtualisation fundamentals, and switching concepts — MAC learning and ageing, frame switching, frame flooding, and reading a MAC address table
Domain 02 — Network Access
The access layer: VLANs, trunks, bundles, spanning tree and the wireless edge. 20% of the exam.
•Configuring and verifying VLANs across multiple switches, including data and voice access ports, the default VLAN, and inter-VLAN connectivity
•Interswitch connectivity: trunk ports, 802.1Q tagging and the native VLAN mismatch that will cost you marks
•Layer 2 discovery protocols, and using them to confirm what is plugged into what
•EtherChannel with LACP — building a bundle, and diagnosing the one that will not form
•Rapid PVST+ Spanning Tree Protocol: root bridge and root port, port states and roles, PortFast, and root guard, loop guard, BPDU filter and BPDU guard
•Cisco wireless architectures and access point modes, and choosing between them
•Physical infrastructure connections between WLAN components
•Network device management access, and the options for reaching a device safely
•Reading and interpreting a wireless LAN GUI configuration for client connectivity
Domain 03 — IP Connectivity
The largest domain, and the heart of the exam: getting a packet from one subnet to another and proving it. 25% of the exam.
•Reading a routing table line by line — protocol code, prefix, network mask, next hop, administrative distance, metric, gateway of last resort
•How a router chooses: longest prefix match first, then administrative distance, then metric, in that order
•Static routing for IPv4 and IPv6: default routes, network routes, host routes and floating static routes
•Configuring and verifying single-area OSPFv2, including neighbour adjacencies and router ID selection
•OSPF network types in practice: point-to-point, and broadcast with DR and BDR election
•Diagnosing the adjacency that never comes up, and what the usual causes are
•First hop redundancy protocols and the failure they exist to survive
•End-to-end verification: building a topology, breaking it deliberately, and tracing the fault back from the symptom
Domain 04 — IP Services
The services running alongside routing that keep a network usable and observable. 10% of the exam.
•Inside source NAT: static, pooled and overloaded, and reading the translation table
•NTP in client and server mode, and why correct time underpins every log you will ever read
•The role of DHCP and DNS on a network, and what breaks first when either is wrong
•Configuring and verifying the DHCP client and the DHCP relay agent
•SNMP and its function in network operations
•Syslog features, severity levels, and getting messages somewhere they will be seen
•Quality of service and per-hop behaviour for forwarding
•Remote access to network devices over SSH, configured and verified
•TFTP and FTP capabilities for moving images and configuration files
Domain 05 — Security Fundamentals
Enough security to secure a network properly — and enough to know when to call someone else. 15% of the exam.
•Core security concepts: threats, vulnerabilities, exploits and mitigation techniques
•Security programme elements, including user awareness and training
•Device access control with local passwords, and password policy elements that survive audit
•IPsec remote-access and site-to-site VPNs, described at the level the exam asks for
•Configuring and verifying access control lists, and the ordering mistakes that make them useless
•Layer 2 security features: DHCP snooping, Dynamic ARP Inspection and port security
•Authentication, authorisation and accounting compared, and where each one applies
•Wireless security protocols and their differences
•Configuring a WLAN in the GUI using WPA2 PSK
Domain 06 — Automation and Programmability
The smallest domain, and the one most candidates leave until it is too late. 10% of the exam.
•How automation changes network management, and what it does not change
•Traditional networks compared with controller-based networking
•Controller-based, software-defined architecture: separation of control plane and data plane, northbound and southbound APIs
•Artificial intelligence and machine learning in network operations, and what they realistically do today
•Characteristics of REST-based APIs, including verbs, response codes and authentication
•Configuration management mechanisms and the capabilities each one offers
•Recognising and reading JSON-encoded data, which is where most of the exam marks in this domain actually sit
Who should take this
Network technicians and junior network engineers, help desk and support staff moving into networking, system administrators who have inherited the switches, and anyone entering security or cloud who needs the networking layer to stop being a black box.
Cisco sets no formal prerequisites for CCNA — anyone can book it. In practice you will get far more out of the week if you are comfortable with binary and with basic IP addressing, and have seen a command line before. We send a short pre-course refresher on subnetting when you enrol; work through it, because the class moves quickly past it.
The exam
The 200-301 CCNA is set and awarded by Cisco and delivered at Pearson VUE test centres and online.
•120 minutes
•Version 1.1 until 2 February 2027; version 2.0 from 3 February 2027
•Cisco does not publish a fixed question count, and does not publish a passing score — results are reported as pass or fail
•Question formats include multiple choice, drag and drop, and simulation items where you configure or verify on a live device
•The certification is valid for three years
The exam is purchased separately from Cisco. We arrange it on your behalf and send you the booking details, and you choose your own exam date.
How we deliver it
Five days, classroom or online live, or at your office for a private group. Roughly half the time is at the command line. Every delegate gets their own pod of real devices rather than sharing a demonstration, because the simulation questions are unforgiving of people who have only watched.
Domain checkpoints at the end of each day, a subnetting drill every morning until it is automatic, and a full-length mock under exam conditions on the final afternoon.
Mapped to the Cisco 200-301 CCNA v1.1 exam topics. Taught from Hacky Security's own curriculum and lab estate by instructors who build and run production networks. These are our own preparation courses; they are not official Cisco courseware and we are not a Cisco Learning Partner.
