Cisco CCNP Enterprise Core (ENCOR 350-401) — The Professional Network Engineer Cert for 2026

Domain 1: Architecture — 15%

The Architecture domain tests design-level understanding of enterprise campus and WAN topologies. Core areas include: campus network design — two-tier (collapsed core) versus three-tier (access/distribution/core) hierarchical models, when each is appropriate, and how to dimension links and redundancy across tiers; SD-WAN architecture — Cisco Viptela overlay components (vManage, vSmart, vBond, vEdge/cEdge) and how they map to the control plane, data plane, and management plane; QoS architecture — DSCP marking, traffic classification, queuing strategies (CBWFQ, LLQ), and how QoS policy is applied end-to-end across an enterprise network; and high availability (HA) design for campus networks, including dual-homing designs, switch clustering, and first-hop redundancy protocol (FHRP) placement. Candidates must be able to evaluate design tradeoffs — this domain tests applied architectural reasoning, not just protocol knowledge.

The domain also covers software-defined access (SDA) — Cisco’s campus fabric solution that uses LISP for the control plane and VXLAN for the data plane, with ISE for policy. Candidates should understand how SDA maps traditional VLANs and VRFs to a fabric-based model, what the role of the fabric edge/border/control plane nodes is, and how macro-segmentation (VNs) and micro-segmentation (SGTs) are applied in a Cisco DNA Center-managed campus. SDA architectural components and their roles are tested at a conceptual level, not at CLI configuration depth.

Domain 2: Virtualization — 10%

Virtualization covers the technologies that create logical separation and overlay networks in enterprise environments. Primary areas: VRF (Virtual Routing and Forwarding) — how VRF instances segment routing tables within a single device, VRF-Lite configuration across multiple routers, and how VRFs are extended across an MPLS backbone using MP-BGP; MPLS fundamentals — label distribution protocol (LDP), the MPLS forwarding plane (label imposition, swapping, and disposition), and the relationship between MPLS labels and IP routing tables; VXLAN — how VXLAN encapsulates Layer 2 frames in UDP, the VNI concept, and how VXLAN is used in both campus (SDA) and data center (EVPN) contexts at the architectural level; and network functions virtualization (NFV) — virtualizing network services (firewalls, load balancers, routers) that traditionally ran on dedicated hardware, and the role of hypervisors and service chaining in NFV deployments.

Domain 3: Infrastructure — 30%

At 30%, Infrastructure is the ENCOR exam’s heaviest domain and covers the complete Layer 2 and Layer 3 implementation stack. Layer 2 technologies tested include: STP (Rapid PVST+, MST) — root bridge election, port states, topology change behavior, PortFast and BPDU Guard; EtherChannel (LACP, PAgP, static) and load-balancing algorithms; VLANs and 802.1Q trunking; and storm control and MAC address table management. The exam tests these at implementation depth, including troubleshooting scenarios with STP loops, EtherChannel misconfiguration, and trunk negotiation failures.

Layer 3 routing protocols are tested in depth: OSPF (single-area and multi-area, DR/BDR election, LSA types 1–7, route filtering, summarization, authentication, and virtual links); EIGRP (DUAL algorithm, successor/feasible successor selection, load balancing, named mode configuration, filtering, and redistribution); and BGP (eBGP and iBGP peering, path selection algorithm and all 11 attributes in order, route reflectors, communities, route filtering with prefix-lists and route-maps, and conditional advertisement). Redistribution between protocols — managing administrative distance, preventing routing loops when redistributing bidirectionally, and using route-maps to tag and filter redistributed routes — is a frequent scenario topic. The Infrastructure domain also covers IPv6 at implementation depth: dual-stack configuration, OSPFv3, EIGRPv6, IPv6 ACLs, and transition technologies (6to4, NAT64).

The wireless infrastructure subarea covers enterprise wireless architecture: autonomous versus controller-based APs, Cisco WLC (Wireless LAN Controller) deployment modes (local, FlexConnect, fabric-enabled), SSID to VLAN mapping, WPA3 and 802.1X authentication, and roaming behavior (intra-controller, inter-controller with mobility groups). Candidates should understand how wireless clients associate, how RF management (RRM) works in a Cisco wireless infrastructure, and how to troubleshoot association and authentication failures in a WLC-managed network.

Domain 4: Network Assurance — 10%

Network Assurance covers the tools and protocols enterprise networks use to monitor health, collect telemetry, and troubleshoot. Key testable areas: IP SLA — synthetic traffic generation for measuring latency, jitter, packet loss, and availability between network points, including ICMP echo, UDP jitter, HTTP, and FTP SLA operations and how results are used to trigger track objects for IP routing and HSRP preemption; SNMP (v2c and v3) — MIB structure, OIDs, community strings, traps versus informs, and SNMPv3 security modes (noAuthNoPriv, authNoPriv, authPriv); Cisco DNA Center assurance — what the platform collects (streaming telemetry, SNMP polling, Syslog, NetFlow), how it surfaces health scores for clients, APs, switches, and routers, and how its issue detection engine uses AI/ML to identify anomalies without manual threshold configuration; and NetFlow and IPFIX — flow records, exporters, collectors, and how flow data is used for capacity planning and security analysis.

The domain also tests Cisco IOS troubleshooting tools: debug commands and their appropriate use (and when not to use them in production), the embedded event manager (EEM) for automated response to network events, and Bidirectional Forwarding Detection (BFD) for fast failure detection independent of routing protocol hello timers — how BFD sessions are established and how they interface with OSPF, EIGRP, and BGP to trigger rapid convergence.

Domain 5: Security — 20%

The Security domain covers both device hardening and network-level security enforcement. Device hardening topics include: management plane security (SSH with key authentication, disabling Telnet, HTTP server restriction, AAA with RADIUS/TACACS+, privilege levels and role-based CLI access); control plane security (CoPP — Control Plane Policing — and the rate-limiting of control plane traffic to protect the route processor); and data plane security on access switches (Dynamic ARP Inspection, DHCP Snooping, IP Source Guard, 802.1X port authentication, and storm control).

Network access control (NAC) via Cisco ISE is tested at the architectural level: authentication policies, authorization policies (downloadable ACLs and dACLs, VLAN assignment, SGT assignment), and posture assessment. The Security domain also covers VPN technologies: site-to-site IKEv2 IPsec (IKE phases, ISAKMP policies, transform sets, crypto maps and tunnel interfaces), DMVPN (phases 1/2/3, NHRP operation, spoke-to-spoke tunnels, and dynamic routing over DMVPN), FlexVPN, and remote access SSL VPN with Cisco AnyConnect. Candidates should understand the difference between DMVPN phases in terms of spoke-to-spoke traffic flow, which is a frequent exam scenario. The PKI section covers how digital certificates are used in IKEv2, certificate enrollment via SCEP, and how a Cisco IOS router can act as a CA for PKI deployments.

Domain 6: Automation — 15%

The Automation domain is ENCOR’s most modern section and covers programmatic network management. Python fundamentals for network automation: data types (strings, lists, dictionaries, tuples), control flow (loops, conditionals), functions, and the networking libraries candidates are expected to know — netmiko for SSH-based device interaction, ncclient for NETCONF, and the requests library for REST API calls. Candidates must be able to read and understand short Python scripts and identify what they do, but ENCOR is not a scripting exam; the depth is at the reading and interpretation level, not production coding.

APIs and data formats are tested in depth: REST API concepts (HTTP methods GET/POST/PUT/DELETE, status codes, authentication with tokens and basic auth), JSON and XML structure and how to navigate nested objects, and YANG data models as the schema language used with NETCONF and RESTCONF. The exam tests how to read a YANG model and map it to an API payload — a skill that bridges traditional CLI configuration to model-driven programmability. NETCONF and RESTCONF are covered at the conceptual level: how each uses YANG models, what the RPC operations are (get-config, edit-config, commit), and how RESTCONF maps NETCONF operations to HTTP verbs.

Configuration management tools (Ansible, Puppet, Chef) are tested at a conceptual comparison level: what each tool’s architecture is (agentless versus agent-based, push versus pull model), how Ansible playbooks and inventory files are structured, and what Cisco IOS modules exist for Ansible. The Automation domain also covers Cisco DNA Center as a platform API: how REST API calls are made against DNA Center’s Intent API to retrieve device inventory, get network health, and push configuration templates — with specific attention to authentication via Cisco DNA Center’s token-based auth flow.