zNetLaB › Courses
Free certification and skills courses
16 courses, 183 topics and 1,716 written practice questions, all open to read and practise. Every topic has a lesson, every question has an explanation of why the right answer is right and the others are not, and 152 of the 183 topics link to guided labs where you configure the thing yourself.
How a course works
- Read the lesson for a topic. Lessons need no account.
- Answer the practice questions for it. Each one explains the answer. Your progress is kept in your browser, and on your account if you sign in.
- Do the lab. Most topics list the guided labs that practise them. Labs run in the browser simulator, which is free to try for 7 days, and every task is checked against the running configuration.
- Sit a practice exam when you are ready: a timed set in the shape shown for each course below.
The courses
Weights show how much of a practice exam each area carries. They are modelled on the published exam outlines and may differ from the current official ones, so check the vendor's page before you book an exam. The practice-exam sizes are zNetLaB's own settings, not the vendor's rules.
CCNA · Associate · exam 200-301
The foundation: how networks are built, switched, routed, secured and automated.
| Area | Weight | Topics |
|---|---|---|
| Network Fundamentals | 20% | OSI and TCP/IP models, TCP vs UDP; Cabling, interfaces and interface errors; IPv4 addressing and subnetting; IPv6 addressing and types; Switching: MAC learning, frames, collisions; Wireless principles; Virtualization and cloud basics |
| Network Access | 20% | VLANs, trunks and inter-VLAN routing; Spanning Tree (RSTP/PVST+); EtherChannel (LACP/PAgP); CDP and LLDP; Wireless architectures and WLC |
| IP Connectivity | 25% | The routing table, AD and longest match; Static and default routes (IPv4/IPv6); Single-area OSPFv2; First-hop redundancy (HSRP) |
| IP Services | 10% | NAT and PAT; DHCP, DNS, NTP, SNMP, Syslog; QoS concepts; SSH, TFTP/FTP and device management |
| Security Fundamentals | 15% | Access control lists; Port security, DHCP snooping, DAI; AAA, passwords, VPN and wireless security |
| Automation and Programmability | 10% | Controller-based networking and SDN; REST APIs, JSON, Ansible/Terraform concepts |
CCNP Enterprise · Professional · exam ENCOR 350-401 · ENARSI 300-410
The core exam and the advanced routing concentration — the CCIE written is ENCOR.
| Area | Weight | Topics |
|---|---|---|
| ENCOR · Architecture | 15% | Two- and three-tier design, fabric, cloud; SD-WAN and SD-Access architecture; QoS: marking, queuing, policing, shaping; Hardware and software switching (CEF, TCAM) |
| ENCOR · Virtualization | 10% | VRF-lite; GRE and IPsec tunnels, LISP, VXLAN concepts |
| ENCOR · Infrastructure | 30% | Trunking, EtherChannel, RSTP and MST; EIGRP vs OSPF, multi-area OSPF, filtering; eBGP and best-path selection; Wireless: RF, roaming, AP modes; NTP/PTP, NAT, HSRP/VRRP, multicast |
| ENCOR · Network Assurance | 10% | Debugs, ping/traceroute, SNMP, syslog, NetFlow, SPAN, IP SLA |
| ENCOR · Security | 20% | Device access control, AAA, CoPP; ACLs, ZBFW, 802.1X, MACsec, wireless security |
| ENCOR · Automation | 15% | Python, JSON, YANG, NETCONF/RESTCONF; Ansible, Chef, Puppet, EEM, webhooks |
| ENARSI · Layer 3 | 35% | Redistribution, AD, loops and tagging; PBR, route maps, prefix lists, distribute lists; iBGP, route reflectors, BGP attributes and troubleshooting; EIGRP stub, summarization, variance, named mode; OSPF areas, LSA types, stub/NSSA, virtual links |
| ENARSI · VPN | 20% | MPLS operations and L3VPN; DMVPN phases, NHRP, IPsec |
| ENARSI · Infrastructure Security | 20% | AAA, uRPF, CoPP, IPv6 first-hop security |
| ENARSI · Infrastructure Services | 25% | Troubleshooting DHCP, NAT, SNMP, syslog, IP SLA, NetFlow |
CCIE Enterprise Infrastructure · Expert · exam Written: ENCOR · Lab: 8 hours
Design, deploy, operate and optimise — then troubleshoot under the clock.
| Area | Weight | Topics |
|---|---|---|
| Network Infrastructure | 30% | Switched campus: VTPv3, MST, EtherChannel, UDLD, loop guard; EIGRP and OSPF at scale: filtering, summarization, convergence, BFD; BGP: policy, communities, RR, confederations, multipath, AS-path; Multi-protocol redistribution and loop prevention; Multicast: PIM-SM, RP, IGMP, SSM, RPF |
| Software-Defined Infrastructure | 25% | SD-Access: fabric, LISP, VXLAN, SGT; SD-WAN: OMP, TLOC, policies, templates |
| Transport Technologies and Solutions | 15% | MPLS L3VPN: VRF, MP-BGP, RD/RT, PE-CE; DMVPN phase 2/3, IPsec profiles |
| Infrastructure Security and Services | 15% | CoPP, uRPF, IPv6 FHS, 802.1X, ZBFW; QoS, NAT, FHRP, IP SLA, NetFlow, multicast services |
| Automation and Programmability | 15% | Python, YANG, NETCONF/RESTCONF, model-driven telemetry, EEM |
CompTIA Network+ · Foundation · exam N10-009
Vendor-neutral networking from cabling to troubleshooting — the first certification many network engineers take.
| Area | Weight | Topics |
|---|---|---|
| Networking Concepts | 23% | OSI model, ports and protocols; Network types, topologies and appliances; IPv4 addressing, subnetting and VLSM; IPv6 addressing and transition; Cloud and virtualisation concepts |
| Network Implementation | 20% | Static and dynamic routing (RIP, OSPF, EIGRP); VLANs, trunking, STP, EtherChannel, VTP; Wireless standards and configuration; Cabling, media and WAN access |
| Network Operations | 19% | Monitoring, logging, SNMP and traffic capture; High availability and disaster recovery; DHCP, DNS, NTP and network services; Configuration management and documentation |
| Network Security | 14% | Security concepts, threats and device hardening; Attacks and their defences (spoofing, flooding, rogue devices); Access control: ACLs, AAA, remote access and VPNs |
| Network Troubleshooting | 24% | The troubleshooting methodology; Physical and switching problems; Addressing and routing problems; Service problems: DNS, DHCP, NAT, ACLs; Wireless problems |
CompTIA Security+ · Associate · exam SY0-701
Security foundations: threats, architecture, operations and governance — the baseline for security roles.
| Area | Weight | Topics |
|---|---|---|
| General Security Concepts | 12% | Security controls, the CIA triad and zero trust; Authentication, authorisation and accounting; Cryptography, hashing, PKI and certificates |
| Threats, Vulnerabilities and Mitigations | 22% | Threat actors, vectors and social engineering; Malware and application attacks; Network attacks: spoofing, flooding, rogue devices, VLAN hopping; Vulnerability management and scanning; Hardening and mitigation techniques |
| Security Architecture | 18% | Network segmentation, DMZ and firewalls; Secure communications: VPN, IPsec, tunnels; Cloud, virtualisation, IoT and embedded systems; Resilience, redundancy and recovery |
| Security Operations | 28% | Secure baselines and configuration; Identity and access management; Monitoring, logging, SIEM and traffic analysis; Incident response and forensics; Automation and orchestration |
| Security Program Management and Oversight | 20% | Risk management and governance; Compliance, audit and privacy; Third-party risk and security awareness |
CCNP Security Core · Professional · exam SCOR 350-701
Implementing and operating the security core: VPNs, network and infrastructure security, access and visibility.
| Area | Weight | Topics |
|---|---|---|
| Security Concepts | 25% | Common threats, vulnerabilities and attack techniques; Cryptography: encryption, hashing, key exchange, PKI; VPN technologies: site-to-site IPsec, DMVPN, GRE |
| Network Security | 20% | Firewalls: ACLs, zone-based policy, NGFW concepts; Infrastructure security: Layer 2 and the management plane; Intrusion prevention and traffic visibility |
| Securing the Cloud | 15% | Cloud security models, workload and SaaS protection |
| Content Security | 15% | Email and web security, DNS-layer protection |
| Endpoint Protection and Detection | 10% | Endpoint protection, EDR, MDM and posture |
| Secure Network Access, Visibility and Enforcement | 15% | AAA, RADIUS/TACACS+, 802.1X and identity services; Network visibility: NetFlow, SPAN, syslog, NTP |
Ethical Hacking (network level) · Associate · exam CEH-style · Pentest basics
Think like the attacker so you can defend: how network attacks work, and the switch and router features that stop them.
| Area | Weight | Topics |
|---|---|---|
| Reconnaissance, Scanning and Enumeration | 25% | Footprinting, DNS and passive reconnaissance; Host and port discovery, banner grabbing; Service enumeration: SNMP, CDP/LLDP, NTP |
| Network Attacks and Defences | 40% | Sniffing and man-in-the-middle: rogue DHCP, ARP spoofing; Layer-2 attacks: MAC flooding, VLAN hopping, STP takeover; IP spoofing and reflection attacks; Denial of service and control-plane abuse |
| Perimeter, Evasion and Secure Design | 20% | Firewalls, DMZ design and filtering; Encrypted tunnels and VPN attacks; Detection: logging, NetFlow, SPAN and IDS placement |
| Systems, Web, Wireless and Cryptography | 15% | System hacking, malware and privilege escalation; Web servers and applications, SQL injection; Wireless attacks and wireless security; Cryptography and attacks on it |
Service Provider · Professional · exam CCNP SP · CCIE SP
Carrier networks: IS-IS and BGP at scale, MPLS and L3VPN, access technologies and automation.
| Area | Weight | Topics |
|---|---|---|
| Core Routing: IS-IS, OSPF and MPLS | 30% | IS-IS levels, areas and metrics; OSPF in the provider core: areas, stub types, summarisation; MPLS and LDP label switching; Fast failure detection: BFD |
| BGP for Providers | 25% | eBGP policy, communities and prefix filtering; iBGP, route reflectors and scale |
| VPN Services | 20% | VRFs and L3VPN customer separation; Overlays: GRE, IPsec, SD-WAN; QoS in the provider edge |
| Access Networks | 15% | Fibre, DSL, cable, microwave and satellite access; PPPoE subscriber access |
| Automation and Operations | 10% | Network automation and programmability |
Routing Mastery · Skills · exam Skills course · IPv4 routing
Static, default, floating, RIPv2, EIGRP, OSPF and eBGP — each built, broken and fixed in sixty graded drills until the commands are automatic.
| Area | Weight | Topics |
|---|---|---|
| Static and default routing | 30% | Static routes between two LANs; Default routes toward an ISP; Floating static routes and administrative distance |
| Interior gateway protocols | 45% | RIPv2; EIGRP; Single-area OSPF; OSPF across three routers |
| Exterior routing | 25% | eBGP between two autonomous systems |
Switching and VLAN Mastery · Skills · exam Skills course · Layer 2
VLANs, router-on-a-stick, spanning tree, EtherChannel and port security — sixty drills of each, each graded on the live network.
| Area | Weight | Topics |
|---|---|---|
| VLANs and inter-VLAN routing | 40% | Create VLANs and assign access ports; Router on a stick |
| Loop prevention and bundling | 35% | Spanning tree: choosing the root; EtherChannel |
| Securing the access layer | 25% | Port security |
Network Services and Hardening · Skills · exam Skills course · IP services
DHCP, NAT/PAT, ACLs, SSH-only management and first-hop redundancy: the services every site needs, drilled until you can build them under exam time.
| Area | Weight | Topics |
|---|---|---|
| Addressing and translation | 35% | DHCP server pools; NAT overload (PAT) |
| Access control and management | 40% | Standard and extended ACLs; SSH-only device management |
| Gateway redundancy | 25% | HSRP |
IPv4 Addressing and Subnetting Bootcamp · Skills · exam Skills course · subnetting
Work out the mask, the range and the first host — then apply it on a router and prove it with a ping. Sixty VLSM plans and sixty addressed static-routing builds.
| Area | Weight | Topics |
|---|---|---|
| Planning with VLSM | 50% | Right-sizing subnets for host counts |
| Applying the plan | 50% | Address interfaces and route between them |
IPv6 Mastery · Skills · exam Skills course · IPv6
Addresses, autoconfiguration, routing, security and transition: everything about IPv6 a network engineer is asked, with the commands.
| Area | Weight | Topics |
|---|---|---|
| Addressing and autoconfiguration | 50% | IPv6 notation, address types and scopes; SLAAC, DHCPv6 and Neighbor Discovery |
| Routing, security and transition | 50% | Static routing, OSPFv3 and EIGRP for IPv6; IPv6 security: RA guard, ACLs and extension headers; Transition: dual stack, tunnels and NAT64 |
Wireless Networking Essentials · Skills · exam Skills course · Wi-Fi
RF, standards, architectures, WLANs, security and site surveys: the wireless knowledge behind CCNA, Network+ and CWNA-style exams.
| Area | Weight | Topics |
|---|---|---|
| Radio and standards | 35% | RF fundamentals: frequency, power, dBm and antennas; Standards, bands and channels: 802.11a to ax |
| Architectures and WLANs | 35% | Autonomous, controller-based and cloud access points; WLANs, SSIDs, VLANs, QoS and roaming |
| Security and operations | 30% | WPA2, WPA3 and 802.1X; Site surveys and troubleshooting |
Network Automation (DevNet Associate) · Skills · exam Skills course · automation
APIs, data formats, Python, Git, Cisco platforms, Ansible and CI/CD: how networks are automated.
| Area | Weight | Topics |
|---|---|---|
| Foundations | 40% | REST APIs and HTTP; JSON, XML, YAML and data models; Python for network engineers |
| Platforms and tools | 30% | Git and version control; Cisco platforms: DNA Center, Meraki and Webex APIs |
| Operations | 30% | Ansible, Terraform and configuration management; CI/CD, testing and DevSecOps |
Packet Analysis with Wireshark · Skills · exam Skills course · packet capture
Capture, filter and read packets: Ethernet, ARP, IP, ICMP, TCP, DNS, DHCP, HTTP and TLS — and find the fault in the trace.
| Area | Weight | Topics |
|---|---|---|
| Capturing and filtering | 40% | Capturing: SPAN, TAPs and where to capture; Capture and display filters |
| Reading protocols | 60% | Ethernet, ARP, IP and ICMP in a trace; TCP: handshake, retransmissions and windows; DNS, DHCP, HTTP and TLS in captures |
Finished a course? Now take a mock interview.
The mock interview asks the questions an interviewer would ask for the job you want, CCNA to CCIE, aloud. Answer by speaking or typing, and see how a panel would mark you. It is free, and the answered questions are on the same page to read first.
Questions people ask
Are the courses really free?
Yes. The lessons and practice questions are free to read and use. The labs run in the simulator, which starts with a free trial. Plans only matter if you want to run real vendor images on a server.
Is this the real exam?
No. These are study materials and practice questions written for zNetLaB. They are not exam dumps, they are not the vendor's questions, and passing a practice exam does not guarantee a pass on the real one.
Which course should I start with?
If you are new to networking, start with CCNA or, for vendor-neutral basics, CompTIA Network+. If you want one skill, the shorter courses (IPv4 addressing, routing, switching, IPv6) go deep on one subject.
More ways to practise
All guided labs by track, CCNA labs mapped to exam topics, and the subnetting trainer.
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.