CCNP Enterprise ENCOR (Cisco, exam 350-401) — knowledge map
The 54 core concepts of CCNP Enterprise ENCOR (Cisco, exam 350-401) and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (54)
VLAN (Virtual LAN)
A technique that logically divides switch ports into multiple broadcast domains without changing physical wiring. IEEE 802.1Q tagged VLAN adds a VLAN ID tag to frames so a single trunk link carries multiple VLANs distinctly. Communication between VLANs requires inter-VLAN routing by an L3 switch or router.
NETCONF, RESTCONF, and YANG
YANG is a data-modeling language that defines a device's configuration and state as a hierarchy of leaves, lists, and containers. NETCONF is a protocol that runs over SSH using XML messages to push YANG-modeled configuration transactionally into datastores such as candidate and running. RESTCONF is a more approachable protocol that accesses the same YANG models over HTTP with JSON/XML, mapping GET/POST/PUT/PATCH/DELETE onto CRUD operations.
Prerequisites: CRUD operations、JSON
Multicast
A communication mode that delivers data only to hosts that joined a specific group. Like broadcast, it's often not natively supported by cloud virtual networks; where it's required, teams use a dedicated feature such as a transit-gateway's multicast capability, or redesign around unicast instead.
SD-Access
A Cisco intent-based networking architecture that builds a VXLAN-based overlay fabric on top of a physical-topology-independent underlay, with policy (who can access what, and how) defined centrally and automatically distributed from Catalyst Center. It reduces manual per-device CLI configuration while improving segmentation consistency and deployment speed.
Prerequisites: VXLAN
JSON
A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.
Catalyst Center (formerly DNA Center)
Cisco's centralized management controller for enterprise networks. It unifies automated device discovery and bulk provisioning, SD-Access policy distribution, assurance (health visibility), and a REST API automation entry point into one dashboard. Formerly named DNA Center.
Related: SD-Access
CRUD operations
An acronym for the basic operations on data or resources: Create, Read, Update, and Delete. In a RESTful API these commonly map to the HTTP methods POST, GET, PUT (or PATCH), and DELETE respectively.
Prerequisites: REST API (network automation)
XML
A markup language that expresses hierarchical structure with tags. It is the message format NETCONF uses, and device configuration is sometimes represented as an XML document too. It is more verbose than JSON, but differs in supporting strict validation via a schema (XSD) and inline comments.
Prerequisites: NETCONF, RESTCONF, and YANG、JSON
RSPAN and ERSPAN
Extensions of SPAN used when the mirrored port and the monitoring tool are not on the same switch. RSPAN forwards mirrored traffic to another switch over a dedicated VLAN, staying within one Layer 2 domain. ERSPAN encapsulates the mirrored traffic in GRE so it can cross Layer 3 boundaries, reaching a monitoring tool at a remote site.
Prerequisites: TAP and SPAN、VLAN (Virtual LAN)
GRE (Generic Routing Encapsulation)
An encapsulation-only tunneling protocol that wraps an entire original packet inside a new IP header. It lets traffic that could not normally be carried directly across the internet — multicast or other protocols, for instance — pass through the tunnel, but GRE itself provides no encryption. Where confidentiality is required, it is paired with IPsec (GRE over IPsec).
IGMP (v2 / v3)
A protocol by which a host tells a router which multicast group it wants to join. IGMPv2 handles only group-level Join/Leave, whereas IGMPv3 can also specify a particular source when joining a group, which is required for SSM (source-specific multicast) to work at all.
Prerequisites: Multicast
Related: SSM (Source-Specific Multicast)
MSDP (Multicast Source Discovery Protocol)
A protocol that shares multicast source information across multiple PIM-SM domains, each with its own RP. Because an RP only knows about sources within its own domain, MSDP peers notify each other's RPs about sources that exist elsewhere, letting a receiver in one domain receive multicast traffic that originates from a source in a different domain.
Prerequisites: PIM (Protocol Independent Multicast)、Multicast
PIM (Protocol Independent Multicast)
A family of protocols that build multicast delivery trees. PIM-SM (sparse mode) by default delivers to a group over a shared tree rooted at an RP (rendezvous point), switching to a per-source shortest-path tree (SPT) as traffic volume grows, for efficiency. Bidir-PIM uses only a bidirectional shared tree through the RP, keeping state low in environments with many sources.
Prerequisites: Multicast
IPsec
A protocol suite that encrypts and authenticates traffic at the IP packet level, used to encrypt the path in site-to-site VPNs (on-prem to a cloud VNet/VPC). The tunnel won't establish unless both ends agree on encryption, integrity, and key-exchange settings.
DSCP and PHB
DSCP (Differentiated Services Code Point) marks a packet's priority class in a field of the IP header, with values such as EF (Expedited Forwarding, for top-priority traffic like voice), AF (Assured Forwarding, subdivided by class and drop precedence), and CS (backward-compatible with the old IP precedence field). Each network device independently applies a per-hop behavior (PHB) matching the DSCP value at every hop, delivering consistent QoS from source to destination.
DTP (Dynamic Trunking Protocol)
A Cisco proprietary protocol that auto-negotiates trunking between adjacent switch ports. While convenient, an unintentionally negotiated trunk can be a foothold for VLAN hopping, so best practice is to disable DTP (nonegotiate) on ports that do not need it.
Prerequisites: VLAN (Virtual LAN)
EtherChannel
Cisco's implementation name for bundling multiple physical switch ports into one logical link, using either LACP (open standard) or PAgP (Cisco proprietary) to negotiate the bundle. STP sees the bundle as a single logical link, so it gains bandwidth and redundancy without STP blocking individual member links.
Related: PAgP (Port Aggregation Protocol)
FHRP (First Hop Redundancy Protocol)
A collective term for protocols that make multiple physical routers appear as one virtual router, making a device's default gateway (its first hop) redundant. The open-standard VRRP and Cisco's proprietary HSRP and GLBP are common examples, all using a virtual IP address to automatically recover from a gateway failure without changing client configuration.
Related: HSRP (Hot Standby Router Protocol)
HSRP (Hot Standby Router Protocol)
Cisco's proprietary protocol implementing an FHRP. Within a group, the router with the highest priority becomes the active router and owns the virtual IP/MAC address, while the runner-up waits as the standby router. Whether a recovered former-active router automatically reclaims control is governed by the preempt setting.
Related: FHRP (First Hop Redundancy Protocol)
Native VLAN
The default VLAN that a trunk port forwards untagged under IEEE 802.1Q. If the native VLAN configured on each end of a trunk does not match, frames can land in the wrong VLAN or enable a VLAN hopping attack.
Prerequisites: VLAN (Virtual LAN)
OSPF adjacency
The state (Full state) in which two OSPF routers have exchanged LSAs and fully synchronized their link-state databases with each other. Unlike a neighbor relationship that merely exchanges Hellos and stays at 2-Way, only routers with an established adjacency actually exchange routing information. Duplicate router IDs, mismatched Hello/Dead timers, and mismatched area numbers are typical causes that block adjacency formation.
Prerequisites: Hello/Dead timer (OSPF)、LSA (Link State Advertisement)、Router ID (OSPF)
PAgP (Port Aggregation Protocol)
A Cisco proprietary protocol that auto-negotiates EtherChannel bundling. It serves the same purpose as the open-standard LACP but works only between Cisco devices, with modes desirable (active) and auto (passive).
Related: EtherChannel
PortFast
A Cisco feature applied to access ports connecting only end hosts (like a PC) that skips STP's listening/learning states and moves straight to forwarding, eliminating delays such as a DHCP client timing out while waiting for STP convergence. It must never be enabled on ports connecting to another switch, which risks a loop.
REST API (network automation)
An API design style that operates on resources using HTTP methods (GET/POST/PUT/DELETE, etc.). It lets scripts query and change configuration on a controller such as Catalyst Center by exchanging JSON-formatted data, enabling bulk operations across many devices instead of logging into each device's CLI individually.
Prerequisites: Catalyst Center (formerly DNA Center)、JSON
RSTP and Rapid PVST+
RSTP (IEEE 802.1w) collapses the original STP (802.1D) four states (blocking/listening/learning/forwarding) into discarding/learning/forwarding and, via alternate ports (backup paths) and a proposal/agreement handshake, converges far faster than STP. Rapid PVST+ is Cisco's implementation that runs an independent instance of RSTP per VLAN, allowing a different root bridge and load balancing per VLAN.
Prerequisites: VLAN (Virtual LAN)
Cisco Catalyst SD-WAN and NSO
Cisco Catalyst SD-WAN (formerly Viptela) is a controller-based SD-WAN solution that centrally manages WAN connectivity between sites, with configuration and monitoring automated through APIs such as Catalyst SD-WAN Manager (formerly vManage). NSO (Network Services Orchestrator) is a multi-vendor tool that declaratively orchestrates configuration across many devices at once using YANG service models and NETCONF.
Prerequisites: NETCONF, RESTCONF, and YANG
Related: Cisco Catalyst SD-WAN components (vManage/vSmart/vBond/cEdge)
NetFlow
A technology by which routers and switches export the traffic they see as flow-level statistics keyed by the 5-tuple — byte and packet counts, start and end times, and so on. Because it does not store full packets, it is lightweight and well suited to understanding large-scale traffic patterns and detecting anomalies (a leading example of transaction data).
TAP and SPAN
Both are ways to hand a copy of traffic to a monitoring tool. A TAP (test access point) is dedicated hardware physically inserted into the link that duplicates every signal on it exactly. SPAN (switched port analyzer, or port mirroring) is a switch feature that copies traffic from a chosen port to another port in software. SPAN can drop packets under heavy switch load, whereas a TAP, being dedicated hardware, essentially never does.
EEM (Embedded Event Manager)
A Cisco IOS mechanism that detects an event occurring on the device and automatically runs a response to it. Inside an applet, an administrator defines an event (a trigger such as a matching syslog message pattern, a timer, or a CLI command) paired with an action to run when it fires (such as another CLI command or sending a notification), automating troubleshooting or configuration changes on the device itself with no external tooling required.
Prerequisites: Syslog and Syslog Aggregation
Flexible NetFlow
An implementation of NetFlow that lets an administrator freely combine key and non-key fields into a flow record, define an exporter specifying where to send the data, and tie them together with a monitor, which is then applied to an interface — giving flexible control over exactly what flow statistics get collected. Compared to classic NetFlow's fixed field set, it collects only the information actually needed, more efficiently.
Prerequisites: NetFlow
MST (Multiple Spanning Tree)
The IEEE 802.1s standard that groups multiple VLANs into a small number of spanning-tree instances, rather than running one PVST+ instance per VLAN, reducing CPU load. For switches to belong to the same MST region, their region name, revision number, and VLAN-to-instance mapping table must all match exactly.
Prerequisites: VLAN (Virtual LAN)
RPF check
A mechanism that prevents multicast loops. For each multicast packet it receives, a router checks whether the interface it would use to route back (unicast) toward the packet's source address matches the interface the packet actually arrived on — the reverse-path-forwarding check — and drops the packet if the two do not match.
Prerequisites: Multicast
Cisco Catalyst SD-WAN components (vManage/vSmart/vBond/cEdge)
The four main components that make up Cisco Catalyst SD-WAN (formerly Viptela). vManage (SD-WAN Manager) is the management plane for configuration and monitoring; vSmart is the control plane that distributes routes and policy; vBond handles orchestration, brokering initial authentication and connectivity between the other components; and vEdge/cEdge form the data plane, terminating tunnels and forwarding actual traffic (cEdge is IOS XE-based, while vEdge is the older Viptela OS-based edge router). OMP (Overlay Management Protocol) is what the control plane uses to distribute routes. Note that vManage is now renamed Catalyst SD-WAN Manager.
Related: Cisco Catalyst SD-WAN and NSO
SSM (Source-Specific Multicast)
A multicast model in which a receiver explicitly specifies both the group and the exact source it wants traffic from. It skips the RP-based shared tree entirely, building only a shortest-path tree straight to that source, avoiding the RP as a single point of failure and avoiding unwanted traffic. A receiver needs IGMPv3 to make that source-specific request. This SSM is an unrelated concept from AWS Systems Manager, which shares the same abbreviation.
Prerequisites: PIM (Protocol Independent Multicast)、Multicast
Related: IGMP (v2 / v3)
Cisco TrustSec (SGT)
A group-based segmentation technology that classifies traffic by a group identifier called an SGT (Security Group Tag) rather than by IP address, defining and enforcing which groups may communicate as centralized policy such as an SGACL. Because enforcement follows group membership, the same policy applies consistently even if a device's IP address or VLAN changes.
Prerequisites: VLAN (Virtual LAN)
VXLAN
An overlay tunneling technique that encapsulates L2 frames in UDP/IP over an L3 network. Its 24-bit segment identifier (VNI) allows about 16.77 million segments, breaking the 4094-segment limit of IEEE 802.1Q VLAN IDs (12 bits). VTEPs perform (de)encapsulation; it is used in large multi-tenant data centers.
Prerequisites: VLAN (Virtual LAN)
RADIUS
A protocol for centralized authentication, authorization, and accounting (AAA). Used as an authentication server in wireless LAN, VPN, and IEEE 802.1X environments, it centrally manages per-user credentials to control network access.
AAA (Authentication, Authorization, Accounting)
A collective term for three access-control functions. Authentication verifies who the user is, authorization decides what an authenticated user is permitted to do, and accounting records what was actually done. Cisco devices centralize these functions using RADIUS or TACACS+ as the AAA server.
Ansible (network automation)
A configuration-management tool that declares desired configuration in YAML-formatted playbooks and applies it in bulk to many network devices over SSH or an API without requiring an agent on the device. Modules written in Python absorb per-vendor differences, and the design emphasizes idempotency — running the same playbook repeatedly produces the same result.
BPDU Guard
A Cisco feature that immediately puts a PortFast-enabled port into err-disable if it receives a BPDU (an STP control frame), preventing an unintended switch connection on a port meant only for an end host from causing an unexpected topology change or loop.
Prerequisites: PortFast
LSA (Link State Advertisement)
The unit of information an OSPF router advertises describing the state of its own links (interface, cost, connected neighbor, etc.). The collection of LSAs gathered from every router forms the link-state database (LSDB), from which each router computes its shortest-path tree via the SPF algorithm. LSA types (Type 1, Type 2, etc.) differ in scope and content.
Router ID (OSPF)
A 32-bit value the OSPF process uses to uniquely identify a router within the network. If not manually configured, it is auto-selected as the highest IP address among loopback interfaces, or failing that, the highest address among physical interfaces. A duplicate router ID is a classic cause of adjacency-formation failures.
TACACS+
A Cisco proprietary protocol providing AAA for device administration (login and command authorization on network devices). It uses TCP, encrypts the entire packet, and treats authentication, authorization, and accounting as independent processes, in contrast to RADIUS, which uses UDP, combines authentication and authorization into one packet, and is used mainly for network access control.
Prerequisites: RADIUS
Basic authentication, API keys, and bearer tokens
Three common ways to authenticate an API call. Basic authentication Base64-encodes a username and password into a header — simple but weak. An API key sends a fixed, issued key string in a header or query parameter. A bearer token presents a temporary token issued after authentication (such as an OAuth access token) via an "Authorization: Bearer" header, and its expiry limits the damage if it leaks.
Prerequisites: OAuth (authorization framework)
Model-driven programmability
The idea of operating a device's configuration and state through a common data model, such as YANG, rather than issuing device-specific CLI commands one by one. As long as the model is the same, the same code and process can drive devices from different models and even different vendors, which is what lets automation scale.
Prerequisites: NETCONF, RESTCONF, and YANG
Agent-based automation (Puppet/Chef)
A pull-style automation approach in which a resident agent is pre-installed on each managed device or server, and that agent periodically checks in with a master to fetch and apply configuration. Puppet and Chef are the leading examples. It contrasts with Ansible, which is agentless and pushes configuration over SSH; the tradeoff is the cost of installing and maintaining the agent, in exchange for being well suited to continuously self-healing drift.
Prerequisites: Ansible (network automation)
LISP (Locator/ID Separation Protocol)
A protocol used as SD-Access's control plane. It separates a device's identity (the EID, or endpoint identifier) from its location (the RLOC, or routing locator), resolving an EID to its current RLOC by querying a mapping system, so a device can move without changing its identifier while remaining reachable.
Prerequisites: SD-Access
MACsec (IEEE 802.1AE)
The IEEE 802.1AE standard that encrypts and authenticates frames hop by hop at Layer 2, such as between switches or between a switch and an endpoint. Unlike IPsec, which encrypts end to end or site to site at Layer 3, MACsec protects one adjacent link at a time, guarding against eavesdropping, tampering, and spoofing on that link.
Prerequisites: IPsec
Northbound API and southbound API
Names for the direction of an API relative to a controller. A northbound API is the interface a controller exposes upward to applications and automation tools (for example, a REST API), while a southbound API is the interface the controller uses downward to control the devices it manages (for example, NETCONF or OpenFlow).
Prerequisites: NETCONF, RESTCONF, and YANG
Hello/Dead timer (OSPF)
Two timers that govern how OSPF confirms a neighbor is alive. Routers exchange Hello packets at the Hello interval; if no Hello arrives within the Dead interval (by default four times the Hello interval), the neighbor is declared down and routes are recomputed. Mismatched Hello/Dead timer values between neighboring interfaces prevent adjacency from forming.
Root guard
An STP feature that, on a switch port facing a device that should never become the root bridge, blocks the port in a root-inconsistent state if it receives a superior BPDU (one with a lower bridge ID). It heads off a topology change where a misconnected or rogue device usurps the root bridge role, and differs from BPDU guard, which err-disables the port outright on receiving any BPDU.
Prerequisites: BPDU Guard
QoS (prioritization & rate control)
Mechanisms to control the quality of multiple traffic types sharing limited bandwidth. Delay/jitter-sensitive voice/video get prioritization (priority queuing); bursty traffic gets shaping (buffering the excess to smooth transmission) or policing (dropping/marking the excess). DiffServ (DSCP) classifies traffic.
Prerequisites: DSCP and PHB
Syslog and Syslog Aggregation
Syslog is a protocol for sending device event and error logs, typically over UDP/TCP port 514, in a standardized format that includes facility and severity level. Aggregating logs from many devices onto a single syslog server enables cross-device correlation, chronological cross-referencing during incident investigation, and long-term retention for compliance; note that UDP delivery offers no retransmission guarantee, risking log loss.
OAuth (authorization framework)
An "authorization" framework that delegates, as an access token, the permission for a third-party app to access resources on a user's behalf without handing over the password. Note it is not itself an authentication (identity-verification) mechanism; OpenID Connect layers authentication on top.