CCNP Enterprise ENCOR (Cisco, exam 350-401)Study guide

Covers enterprise design models—2-tier (collapsed core), 3-tier, fabric, and cloud—together with redundancy via FHRP, SSO (Stateful Switchover), and stacking/VSS, framed as the design judgment of "which form of redundancy actually satisfies this availability requirement" and "what is lost during a switchover."

Covers how responsibilities are split across vSmart (control), vManage (SD-WAN Manager) (management), vBond (orchestration), and cEdge/vEdge (data plane); route distribution via OMP; and the benefits of centralized policy and circuit-cost optimization against the limits of controller dependence—framed as diagnosing "which component to suspect" during a fault.

Covers the three-layer structure of SD-Access—LISP for the control plane (mapping EIDs to RLOCs), VXLAN for the data plane (L2-over-L3 encapsulation), and Cisco TrustSec/SGT for policy—along with the division of labor between the underlay and the overlay, and the fabric border as the interconnection point with the traditional campus, framed as isolating "where exactly is this happening."

Covers classification that identifies traffic, marking (DSCP/CoS) that stamps the result into headers, queuing that decides what leaves first under congestion, and the choice between policing (dropping excess) and shaping (delaying it)—framed as diagnosing "how does this configuration treat voice" and "why did retransmissions increase."

Covers the two forms of the hypervisor that let multiple virtual machines (VMs) share one physical server—type 1 (bare metal) and type 2 (hosted on a host OS)—the virtual NICs and resource allocation a VM uses, and the virtual switching that connects VMs to each other and to the outside, framed as the design and diagnostic judgment of "which form fits this requirement" and "what to suspect when a VM cannot reach the outside."

Covers VRF, which holds multiple independent routing tables inside one router/L3 switch (route separation that tolerates overlapping addresses); GRE, which wraps arbitrary protocols to build a logical link (encapsulation only, no encryption); IPsec, which supplies confidentiality/integrity; and GRE over IPsec, which combines them—all as configuration commands, show-based verification, and the isolation of typical failures.

Covers LISP, which separates an endpoint's identity from its location (resolving through the split between EID and RLOC and a mapping system), and VXLAN, which overlays L2 segments on an L3 network (the VNI is 24 bits, giving about 16 million segments, encapsulated over UDP 4789), together with why SD-Access uses LISP for the control plane and VXLAN for the data plane, from both a conceptual and a fault-isolation standpoint.

Covers how 802.1Q tagging multiplexes VLANs, how the native VLAN (untagged) is handled, the difference between dynamic trunking via DTP (dynamic auto / dynamic desirable) and static trunking, and pruning with the allowed VLAN list, building a procedure to isolate causes from symptoms such as "the trunk will not come up," "only one VLAN fails," and "VLAN leaking."

Covers EtherChannel, which bundles multiple physical links into one logical link: the mode combinations of LACP (active/passive), PAgP (desirable/auto), and on (static); bundling failures caused by mismatched bundling conditions such as speed, duplex, trunk mode, and allowed VLANs; reading the flags in show etherchannel summary; and choosing the load-balancing hash—all framed as diagnosis.

Covers RSTP port roles (root, designated, alternate, backup) and states with its convergence in seconds; MST, which maps many VLANs onto a few instances for scalability; and the topology-protecting features root guard (a superior BPDU puts the port in root-inconsistent) and BPDU guard (a PortFast port receiving a BPDU goes err-disabled), understood through real fault scenarios.

Compares EIGRP (advanced distance vector, DUAL, a bandwidth-and-delay metric, unequal-cost load balancing via variance, AD 90) with OSPF (link-state, SPF, cost = 10^8 / bandwidth, equal-cost-only load balancing, AD 110, and area types), framed as the judgment of "which fits this requirement" and "why was this path chosen."

Covers designing multiple normal areas, summarization and filtering at the ABR, the conditions for adjacency (area ID, timers, authentication, MTU, subnet mask, network type), the difference in DR/BDR election between point-to-point and broadcast networks, and the true meaning of passive-interface, all as diagnosis of "the adjacency will not come up" and "the route is not advertised."

Covers eBGP between autonomous systems (AD 20, TCP 179, directly connected neighbors), the conditions for establishing a session, the order of the best-path selection algorithm (weight -> LOCAL_PREF -> locally originated -> shortest AS_PATH -> ORIGIN -> MED -> eBGP over iBGP -> IGP metric), and PBR (policy-based routing), which overrides routing on criteria other than destination—framed as "why was this path chosen" and "which attribute should I touch."

Covers the NTP hierarchy expressed by stratum and how to read its synchronization state, when to use the higher-precision PTP (IEEE 1588) instead, and NAT/PAT with its four address types (inside local, inside global, outside global, outside local) plus multiplexing via overload—framed as diagnosis of faults such as "log timestamps are skewed so events cannot be correlated" and "no translation is happening."

Compares the FHRP options for gateway redundancy—HSRP (Cisco, active/standby, virtual MAC 0000.0c07.acXX, priority default 100, preempt disabled by default) and VRRP (standard, master/backup, preempt enabled by default)—and covers the multicast building blocks RPF check, PIM SM (RP shared tree, then shortest-path tree), IGMP v2/v3 (v3 enables SSM), bidir, and MSDP, framed as diagnosis.

Covers debug and the CPU-friendly conditional debug, ping for L3 reachability (extended ping with source/size/df-bit), traceroute for seeing where a path stops, SNMP for collecting device state by polling and notification, and syslog with severity design--all framed as the isolation judgment of "which tool confirms what, without overloading a production device."

Covers Flexible NetFlow for aggregating "who talked to whom and how much" (define a flow record, flow exporter, and flow monitor, then apply it to an interface), packet-copying with SPAN (same device), RSPAN (via a VLAN), and ERSPAN (across L3 using GRE), and IP SLA for actively measuring reachability, latency, and jitter with synthetic traffic and switching paths through object tracking--framed as the selection judgment of "which measurement confirms this symptom."

Covers the four intent-based workflows of Cisco Catalyst Center (formerly DNA Center) with Assurance and its AI/machine-learning anomaly detection, NETCONF which writes XML over SSH port 830 into a candidate datastore and applies it atomically with commit, and RESTCONF which maps CRUD onto HTTP methods with JSON--framed as the selection judgment of "which mechanism safely delivers this change."

Covers applying local user authentication to line vty / line console and centralizing control with AAA (authentication, authorization, accounting). It frames the difference between TACACS+ (TCP 49, separates the AAA functions, encrypts the entire packet) and RADIUS (UDP 1812/1813, combines authentication and authorization, encrypts only the password) as design judgment: who may run which commands, and whether you get locked out when the server fails.

Covers the difference between a standard ACL (matching only the source IP) and an extended ACL (matching source/destination IP, protocol, and port), sequential evaluation (the first matching entry decides) with the trailing implicit deny, and the placement judgment of which interface and direction to apply it to. It also covers editing named ACLs by sequence number and verifying with log, so you can build a configuration that passes only the intended traffic.

CoPP classifies and rate-limits traffic punted to the device's own CPU (the control plane), protecting routing protocols and management access from DoS and excessive control traffic. You build classes and rate design with MQC (class-map, policy-map, service-policy) and apply the policy to control-plane. The goal is to be able to judge why an ACL alone cannot protect the CPU and why an adjacency went down.

Covers what it takes to use the REST APIs of controllers such as Catalyst Center and SD-WAN Manager safely: protecting the channel with HTTPS/TLS, authenticating and authorizing with tokens and OAuth 2.0, handling rate limiting (HTTP 429), designing roles on least privilege, and never embedding credentials in code—framed as design judgment for automation scripts.

Organizes threat defense (IPS, sandboxing, threat intelligence), endpoint security (EDR, posture assessment), the next-generation firewall (NGFW) (control with application/user identity), TrustSec (group-based control via SGTs), and MACsec (IEEE 802.1AE hop-by-hop L2 encryption) as the design judgment of which mechanism at which layer satisfies a given requirement.

Treats Python's building blocks—variables, lists, dictionaries, loops, conditionals, and functions—not as syntax to memorize but as tools for reading what the script in front of you does and where it is wrong. You will learn to diagnose the network-automation staple of "iterate a device inventory and act only on matching devices" through its classic breaking points: indentation, missing keys, and return values.

Teaches reading and writing JSON to the level of judging whether a document is valid (object {} vs. array [], no trailing comma, keys in double quotes, value-type distinctions), and then YANG as the language that defines data types and structure with container/list/leaf, understood as the benefit of model-driven operations.

Covers Catalyst Center's Intent API and SD-WAN Manager (vManage)'s REST API as a flow from token acquisition to the actual call, then teaches deciding what to do next (retry, fix credentials, fix the URL, or wait) from the returned status code—200/201/204, 400/401/403/404/429, and 5xx—together with the payload.

Teaches reading applets of EEM (Embedded Event Manager)—which runs autonomously on the device—as pairs of event (what triggers it: a syslog pattern, a timer, or a CLI command) and action (what it runs), so you can automate configuration, troubleshooting, and data collection. It also contrasts external configuration management as agent-based (Puppet/Chef, a resident agent pulling) versus agentless (Ansible, pushing over SSH).