855-868-4467 Enroll
Enroll HereSign In
thinQpremium
Enroll
Home
thinQbeyond™
Courses
Financing
Theater
Library
Class Rooms
Campus Wire
Campus Tour
Student Rec Center
Student Forum
Browse the catalog Get thinQpremium — All-Access Enroll HereSign In 855-868-4467

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

thinQmaster — free preview

CCNA (200-301). Set it up and run it.

This is not a sample sheet — it is the application, running. Pick your mode, your length, your domain, the same way you would inside the full title. Study mode marks each answer and tells you why the right one is right and why each wrong one is wrong; Simulation puts a clock on it and chooses each question from whatever you are weakest in. No account, no e-mail address, no card.

Free · nothing to sign up for

thinQmaster — CCNA (200-301)

Built like the exam, not like a flashcard deck. The same question shapes you meet on test day, sat against the published blueprint, with a timed paper at full length.

500 questions in the full guide

Question types

389 multiple choice · 63 choose two · 25 drag and drop · 23 put in order

Domains, and how many questions each

  • Network Infrastructure and Connectivity100
  • Switching and Network Access100
  • IP Routing100
  • Network Services and Security100
  • AI and Network Operations and Management100

A real exam experience

  • Timed simulation — 60 questions in 120 minutes, weighted to the blueprint, no feedback until the end.
  • 5 domain drills — work one weak area at a time.
  • Exhibits — real command output and topology diagrams to read, the way the exam asks them.
  • It adapts — miss a domain and the next questions lean that way; master one and it eases off.
  • Every answer explained — why the right one is right, and why each wrong one is wrong.

And what comes with it

  • Twelve months of access — and of updates. Blueprints change and questions get added; while your year is running you get every one of them at no extra cost.
  • A certified engineer on e-mail. Stuck on why an answer is what it is? thinqmaster@thinqtanklearning.com reaches somebody who holds the certification and works in the field — not a ticket queue.
  • The discussion groups. Post a question to other people sitting the same exam and get it talked through.
  • Not a subscription. You sit the exam once; you pay once, $99. Nothing renews and nothing has to be cancelled.
  • In one of our camps? It is already included in your tuition — you will find it in your classroom.

Below is the engine itself, running on real CCNA (200-301) questions. Free, no account, no card.

thinQmaster engine · preview session

The five questions

1. Refer to the exhibit. Which condition on the device at the far end of this link explains the late collision counter?

  • A. The far-end interface is operating at 10 Mbps.
  • B. The far-end interface has autonegotiation disabled for speed only.
  • C. The far-end interface has an MTU below 1500 bytes.
  • D. The far-end interface is operating in full duplex.

Correct answer: D. This port has settled on half duplex, so it defers and runs CSMA/CD. A full-duplex neighbor transmits whenever it has traffic, and those transmissions collide with frames already in flight past the 64-byte window, which is exactly what the late collision counter records alongside the CRC errors from the aborted frames.

Why the others are wrong. A 10 Mbps far end could not form a 100 Mbps link, so the exhibit rules that out. A smaller far-end MTU causes frames to be dropped or fragmented at Layer 3 rather than producing collisions, and disabling speed negotiation alone does not create a duplex conflict as long as both ends still agree on duplex.

2. Refer to the exhibit. An engineer is updating the inventory record for the neighbor of SW3. Which two facts does the output confirm? (Choose two.)

  • A. The neighbor is running Cisco IOS Software Version 17.3.5
  • B. The neighbor advertises a chassis serial number in the entry
  • C. The neighbor is reachable for management at 203.0.113.9
  • D. The link to the neighbor negotiated 1 Gbps full duplex
  • E. SW3 GigabitEthernet1/0/2 is an access port in VLAN 20

Correct answer: A. The detail form of the command adds the fields the summary omits, including the neighbor's addresses and its full software version string. Here the Version block reads Version 17.3.5 and both the entry address and the management address read 203.0.113.9, so those two values can be written into the record with confidence.

Why the others are wrong. CDP does not carry a serial number, so no serial can be taken from this output. CDP never advertises negotiated interface speed, and this output contains no duplex field either. The access VLAN of the local port is not a CDP field; CDP detail can report a native VLAN on some platforms, but no VLAN line appears here at all.

3. Match each route source code that can appear in show ip route output to the meaning it conveys. Not all terms are used.

Correct answer: A. Cisco IOS prefixes every routing table entry with a code identifying the source. O IA is an OSPF inter-area route, D EX is an EIGRP external route with administrative distance 170, the asterisk on S* marks the entry as a candidate default, and L is the local host route IOS installs for each configured interface address.

Why the others are wrong. B marks a BGP route, which uses administrative distance 20 when learned from an external peer and 200 from an internal peer; no description here refers to BGP. i L2 marks an IS-IS Level 2 route with administrative distance 115, and none of the four descriptions mentions IS-IS levels, so both codes remain unused.

4. Place the steps in the order an engineer follows to upgrade a router with an image pulled from an SCP server.

Correct answer: A. Free space must be confirmed before the copy so the transfer does not abort partway through, and the MD5 digest can only be computed after the file is on the device. The boot system statement must exist and be written to the startup configuration before the reload, or the router loads the old image and the upgrade appears to fail.

Why the others are wrong. Reversing any pair breaks the chain: verify /md5 has nothing to read until the copy finishes, a boot system statement cannot name a file that has not been validated, an unsaved boot system statement is lost at reload, and show version reports the running image only after the router has restarted.

5. Which condition causes the runts counter on a switch interface to increment?

  • A. Frames smaller than 64 bytes are received on the interface.
  • B. Frames are discarded because the input queue is already full.
  • C. Frames larger than 1518 bytes are received on the interface.
  • D. Frames arrive faster than the receive ring can be drained.

Correct answer: A. The Ethernet minimum frame size is 64 bytes, and any received frame shorter than that is counted as a runt. Runts usually come from collisions, aborted transmissions on a half-duplex segment, or a device that truncates frames.

Why the others are wrong. Frames larger than 1518 bytes are counted as giants, not runts. Frames arriving faster than the receive ring can be drained increment overrun, and frames discarded for lack of queue space increment no buffer or ignored; neither counter has anything to do with frame length.

6. An engineer must turn GigabitEthernet1/0/24 on a Layer 3 switch into a point-to-point routed link addressed 192.0.2.1/30. Which configuration does this?

  • A. interface GigabitEthernet1/0/24, switchport mode access, ip address 192.0.2.1 255.255.255.252
  • B. interface GigabitEthernet1/0/24, switchport nonegotiate, ip address 192.0.2.1 255.255.255.252
  • C. interface Vlan24, no shutdown, ip address 192.0.2.1 255.255.255.252
  • D. interface GigabitEthernet1/0/24, no switchport, ip address 192.0.2.1 255.255.255.252

Correct answer: D. Physical ports on a Catalyst switch are Layer 2 by default, so they reject an IP address. The no switchport command removes the port from bridging and turns it into a routed interface that is addressed exactly like a router interface, after which ip routing lets the switch forward through it.

Why the others are wrong. switchport mode access leaves the port in Layer 2 mode, so the ip address command is refused. interface Vlan24 builds an SVI, which is a logical interface for a whole VLAN rather than a dedicated link on port Gi1/0/24. switchport nonegotiate only stops DTP frames from being sent; the port is still a switchport and still cannot take an address.

7. Refer to the exhibit. R1 receives a packet destined for 10.1.4.20. Which next-hop address does R1 use to forward the packet?

  • A. 10.1.1.3
  • B. 10.1.1.4
  • C. 10.1.1.5
  • D. 203.0.113.1

Correct answer: C. Four entries match 10.1.4.20: the EIGRP 10.0.0.0/8, the OSPF 10.1.0.0/16, the RIP 10.1.4.0/24, and the static 10.1.4.0/26, which spans 10.1.4.0 through 10.1.4.63. A router always forwards using the longest matching prefix, and administrative distance is never consulted between entries with different prefix lengths, so the /26 route via 10.1.1.5 is used.

Why the others are wrong. 10.1.1.4 is the RIP /24 next hop, which matches but is four bits shorter than the /26. 10.1.1.3 is the OSPF /16 next hop, chosen only if candidates were ranked by administrative distance instead of prefix length. 203.0.113.1 is the gateway of last resort, which is used only when no other entry matches the destination.

8. An engineer compares AAA protocols before deploying centralized administrator login on a router. Which statement about RADIUS is true?

  • A. It separates authentication, authorization, and accounting into independent exchanges
  • B. It is a Cisco-developed protocol that runs only between Cisco devices
  • C. It encrypts only the password field and leaves the rest of the packet readable
  • D. It uses a reliable connection-oriented transport for every client exchange

Correct answer: C. RADIUS is defined by the IETF and encrypts only the User-Password attribute in the Access-Request; the username, NAS identifiers, and all other attributes travel in clear text. It also merges authentication and authorization into one Access-Request and Access-Accept exchange, which is why per-command control is limited compared with TACACS+.

Why the others are wrong. Separating authentication, authorization, and accounting into independent exchanges is a TACACS+ property, not a RADIUS one. RADIUS is an open standard implemented by many vendors, so it is not Cisco-developed or Cisco-only; that describes TACACS+. RADIUS rides on UDP, a connectionless transport, and relies on client retransmission rather than a reliable connection.