CCNA 200-301 Exam Traps: 15 Mistakes That Fail Most Candidates in 2026

Originally published on CertLand.

The CCNA 200-301 is designed to test whether you truly understand networking — not just whether you memorized facts. Cisco writes questions that specifically target common misconceptions, and year after year the same traps catch unprepared candidates. This guide covers 15 of the most dangerous traps across all six exam domains. Read each one carefully: understanding why the wrong answer is wrong is just as important as knowing the right one. In this guide:

1. Layer 2 Traps (STP, VLANs, EtherChannel)
2. Routing Traps (OSPF, EIGRP, ACLs)
3. Services Traps (DHCP, NAT, Wireless)
4. Automation Traps (REST, NETCONF, Ansible)

Layer 2 Traps

Trap 1 — STP Root Bridge: Lowest ID Wins, Not Highest

Many candidates assume the switch with the highest priority becomes the root bridge — the opposite is true. In STP, the switch with the*lowest Bridge ID wins*. The Bridge ID is composed of the priority value (default 32768) combined with the VLAN ID and the MAC address. A switch with priority 4096 beats one with priority 32768. When priorities are equal, the switch with the lowest MAC address wins. On the exam, if a question asks which switch will become root when all have default priority, the answer is the switch with the lowest MAC address.

Trap 2 — CDP vs LLDP: Cisco Proprietary vs Open Standard

Cisco Discovery Protocol (CDP) is Cisco-proprietary and enabled by default on all Cisco devices. Link Layer Discovery Protocol (LLDP) is the IEEE 802.1AB open standard equivalent. LLDP must be enabled manually on Cisco IOS (lldp run). On the exam, if the scenario involves a multi-vendor environment, the answer is LLDP, not CDP. If the scenario is Cisco-only and asks which is enabled by default, the answer is CDP.

Trap 3 — STP Port Roles vs Port States Are Different Things

Port_roles_(Root Port, Designated Port, Alternate Port, Backup Port) describe a port's function in the STP topology. Port_states_(Blocking, Listening, Learning, Forwarding, Disabled) describe what the port does with traffic. A port can be an Alternate Port (role) and in Blocking state simultaneously. Questions sometimes mix these terms to confuse you — read carefully whether the question asks about role or state.

Trap 4 — EtherChannel: All Member Interfaces Must Match

EtherChannel will not form if the member interfaces have different speeds, duplex settings, VLAN assignments, or trunk configurations. A common trap: one interface is access mode, another is trunk mode — no channel forms. Another trap: mixing LACP and PAgP — both ends must use the same protocol. LACP (IEEE 802.3ad) is the standard; PAgP is Cisco proprietary. On exam, when interfaces won't bundle: check that speed, duplex, switchport mode, and allowed VLANs all match.

Routing Traps

Trap 5 — OSPF Cost: GigabitEthernet and FastEthernet Have the Same Default Cost

This is one of the most dangerous OSPF traps. The default OSPF reference bandwidth is 100 Mbps. This means FastEthernet (100 Mbps) has cost 1 and GigabitEthernet (1000 Mbps) also calculates to cost 0.1 — which rounds to 1. Both interfaces end up with cost 1, meaning OSPF treats a GigE link the same as a 100 Mbps link. The fix:auto-cost reference-bandwidth 1000under router ospf. On exam questions asking why OSPF takes an unexpected path, check whether the reference bandwidth has been adjusted.

Trap 6 — OSPF DR/BDR Election: Highest Priority, Not Lowest

Unlike STP root bridge election (lowest wins), OSPF DR/BDR election selects the router with the*highest*OSPF priority (default 1). If priorities are tied, the router with the highest Router ID wins. A priority of 0 means the router will never become DR or BDR. On broadcast segments only — point-to-point links never elect a DR/BDR.

Trap 7 — ACL Processing: First Match Wins

Access Control Lists process entries top-to-bottom and stop at the first match. An implicitdeny anyexists at the end of every ACL. The trap: placing a more specific permit after a broad deny. Example: if you deny 192.168.1.0/24 first and then permit 192.168.1.50/32, the host .50 is already denied by the first line and never reaches the permit. Always put more specific entries before broader ones.

Trap 8 — Administrative Distance: EIGRP Internal vs OSPF

When multiple routing protocols advertise the same destination, the router selects the path with the lower Administrative Distance (AD). EIGRP internal routes have AD 90; OSPF has AD 110; RIP has AD 120. This means EIGRP internal routes are preferred over OSPF routes to the same network. Many candidates memorize only one protocol's AD and get burned on comparison questions. Learn the full table: Connected (0), Static (1), EIGRP internal (90), OSPF (110), RIP (120), External EIGRP (170).

Services Traps

Trap 9 — HSRP Active/Standby: Highest Priority Wins (Opposite of STP)

In HSRP, the router with the*highest priority*becomes the Active gateway (default priority 100). If priorities are equal, the router with the highest IP address on the HSRP-configured interface wins. This is the exact opposite of STP root bridge election. On exam questions with two routers and HSRP, determine active/standby by finding the highest priority first, then use IP address as tiebreaker.

Trap 10 — NAT Inside vs Outside: Direction Matters

NAT must be configured withip nat insideon the interface facing internal hosts andip nat outsideon the interface facing the internet/WAN. Candidates often reverse these. Additionally, the NAT translation table uses inside local (private IP) → inside global (public IP) terminology. On simulation questions, verify which interface faces the internal network and which faces the external — and apply the correct NAT direction to each.

Trap 11 — 802.11 Non-Overlapping Channels (2.4 GHz)

In the 2.4 GHz band, only channels 1, 6, and 11 are non-overlapping. The exam frequently presents options like channels 1, 5, 9 or channels 1, 6, 12 — these are incorrect. Adjacent APs in a wireless deployment should use non-overlapping channels to avoid co-channel interference. The 5 GHz band has many non-overlapping channels (20 MHz width) so this is primarily a 2.4 GHz concern.

Trap 12 — DHCP Snooping Trusted vs Untrusted Ports

DHCP snooping works by designating ports connected to legitimate DHCP servers as_trusted_and all other ports as_untrusted_. Untrusted ports drop DHCP server messages (OFFER and ACK), preventing rogue DHCP servers on end-device ports. The trap: forgetting to mark the uplink to the legitimate DHCP server as trusted — legitimate DHCP responses are then also dropped, breaking client connectivity. Always mark uplinks and known DHCP server ports as trusted.

Automation and Security Traps

Trap 13 — REST vs NETCONF vs RESTCONF: Know the Differences

These three APIs are tested in Domain 6. REST APIs use HTTP/HTTPS and exchange JSON (typically). NETCONF uses TCP port 830, exchanges data as XML using YANG models, and was designed specifically for network device configuration. RESTCONF is a newer HTTP-based protocol that bridges REST and NETCONF — it uses HTTP verbs and YANG models but supports both JSON and XML. On exam: NETCONF = TCP 830 + XML + operational use; RESTCONF = HTTP + YANG + modern; REST = general-purpose HTTP + JSON.

Trap 14 — IPv6 EUI-64 Address Calculation

EUI-64 generates the 64-bit interface identifier from a 48-bit MAC address. Steps: (1) Insert FFFE in the middle of the MAC address. (2) Flip the 7th bit (Universal/Local bit) of the first byte. Example: MAC AA:BB:CC:DD:EE:FF → Insert FFFE: AABB:CCFF:FEDD:EEFF → Flip 7th bit of AA (10101010) → 10101000 = A8 → Result: A8BB:CCFF:FEDD:EEFF. Many candidates forget to flip the U/L bit — this is the most common EUI-64 error on exams.

Trap 15 — Syslog Severity Levels: Lower Number = Higher Severity

Syslog uses levels 0–7 where*0 is the most critical*(Emergency) and 7 is the least critical (Debugging). Candidates frequently assume higher number = higher severity — this is backwards. The mnemonic: "Every Awesome Cisco Engineer Will Need Daily Inspiration" = Emergency (0), Alert (1), Critical (2), Error (3), Warning (4), Notice (5), Informational (6), Debug (7). On exam: if asked which logging level captures the most messages, the answer is Debug (7) — it includes all levels from 0 to 7.

Ready to Practice?

Our 340-question CCNA practice exam is designed to test exactly these traps — with detailed explanations for every wrong answer. Practice CCNA Now →