350-401

ENCOR 350-401 Exam Details

Domain Weight Breakdown

Certification Path

The 350-401 ENCOR is the core exam for the CCNP Enterprise certification. Candidates must pass ENCOR plus one concentration exam (e.g., ENARSI 300-410, SD-WAN 300-415, or others) to earn CCNP Enterprise. ENCOR also serves as the qualifying exam for CCIE Enterprise Infrastructure and CCIE Enterprise Wireless lab exams. Prerequisites include a solid understanding of CCNA-level topics. Cisco recommends 3-5 years of enterprise networking experience before attempting ENCOR.

Tip: Infrastructure (30%) is the heaviest domain. Focus heavily on routing protocols (OSPF, EIGRP, BGP), switching technologies (STP, VLANs, EtherChannel), and wireless (WLC, AP modes). Combined with Security (20%), these two domains account for half the exam.

Enterprise Network Design Models

Cisco SD-Access Fabric

SD-Access is Cisco's software-defined campus LAN solution built on top of DNA Center. It uses an overlay/underlay architecture to provide automated segmentation, policy enforcement, and simplified management.

Tip: Remember the SD-Access trio: LISP (control plane for host tracking), VXLAN (data plane for encapsulation), and Cisco TrustSec SGTs (policy plane for segmentation).

LISP (Locator/ID Separation Protocol)

LISP separates the device identity (Endpoint Identifier - EID) from its network location (Routing Locator - RLOC). This enables host mobility without changing IP addresses and simplifies routing tables.

• EID: The IP address assigned to the endpoint (stays with the host)
• RLOC: The IP address of the router (xTR) where the endpoint is attached
• Map Server (MS): Accepts EID-to-RLOC registrations from ETRs
• Map Resolver (MR): Resolves EID-to-RLOC lookups from ITRs
• xTR: Performs both ITR (encapsulates) and ETR (decapsulates) functions
• Proxy xTR (PxTR): Connects LISP sites to non-LISP networks

VXLAN (Virtual Extensible LAN)

VXLAN extends Layer 2 segments over a Layer 3 underlay using MAC-in-UDP encapsulation. It uses a 24-bit VNI (VXLAN Network Identifier) allowing up to 16 million segments versus 4094 VLANs.

Cisco SD-WAN Architecture (Viptela)

• OMP (Overlay Management Protocol): SD-WAN's control plane protocol (similar to BGP) distributing routes, TLOCs, and policies between vSmart and WAN edges
• TLOC: Transport Locator - identifies a WAN edge connection (system IP + color + encapsulation)
• BFD: Bidirectional Forwarding Detection used between WAN edges for fast path liveness detection

Wireless Architecture Models

Cisco AP Modes

Spanning Tree Protocol (STP) Variants

STP Port States (RSTP): Discarding (no forwarding, no learning), Learning (learning MACs, no forwarding), Forwarding (full operation). RSTP Port Roles: Root, Designated, Alternate (backup to root port), Backup (backup to designated port on same segment).

Tip: Root bridge election: Lowest Bridge ID wins (Priority + MAC). Default priority 32768. Modify with spanning-tree vlan X root primary (sets priority to 24576) or spanning-tree vlan X priority 4096.

EtherChannel (Port Aggregation)

All member ports must have matching speed, duplex, VLAN, and trunk settings. LACP supports up to 16 links (8 active + 8 standby). Load balancing methods: src-mac, dst-mac, src-dst-mac, src-ip, dst-ip, src-dst-ip.

OSPF (Open Shortest Path First)

OSPF Area Types

Tip: OSPF LSA types: 1 (Router), 2 (Network/DR), 3 (Summary/ABR), 4 (ASBR Summary), 5 (External), 7 (NSSA External). On high-bandwidth links, adjust reference bandwidth: auto-cost reference-bandwidth 100000 (100 Gbps).

EIGRP (Enhanced Interior Gateway Routing Protocol)

EIGRP Named Mode (recommended on ENCOR): Configured under router eigrp INSTANCE-NAME with address-family sub-mode. Advantages: single configuration hierarchy, supports both IPv4 and IPv6 under one process, per-AF configuration, and wide metrics (64-bit) for high-bandwidth links.

• Successor: Best route to destination (lowest Feasible Distance)
• Feasible Successor: Backup route meeting Feasibility Condition (RD < FD of successor)
• Stuck-in-Active (SIA): Occurs when a query is not answered within 3 minutes; use stub routing to limit query scope

BGP (Border Gateway Protocol)

BGP Best Path Selection (in order)

Tip: Mnemonic for BGP path selection: "We Love Oranges AS Oranges Mean Pure Refreshment" (Weight, Local Pref, Originated, AS Path, Origin, MED, Paths eBGP > iBGP, Router ID).

First Hop Redundancy Protocols (FHRP)

IP Services Quick Reference

Network Monitoring & Assurance Tools

SNMP Versions Comparison

Tip: Always use SNMPv3 with authPriv (authentication + encryption) in production environments. SNMPv2c community strings are sent in plaintext and are vulnerable to interception.

Cisco DNA Center Assurance

DNA Center provides intent-based assurance using AI/ML analytics to monitor network health, detect issues proactively, and provide guided remediation. Key assurance features include:

• Network Health Dashboard: Overall scores for clients, network devices, and applications
• Client 360: Per-client visibility including onboarding time, connectivity issues, and roaming history
• Path Trace: Visual hop-by-hop path analysis between endpoints showing ACLs, QoS, and routing decisions
• Intelligent Capture: On-demand or scheduled packet capture at AP for wireless troubleshooting
• AI-Driven Insights: Machine learning detects anomalies in network behavior and suggests root cause

AAA Framework

Authentication: Who are you? (verify identity) | Authorization: What can you do? (permissions) | Accounting: What did you do? (logging/auditing)

802.1X Port-Based Network Access Control

IEEE 802.1X provides port-based authentication using EAP (Extensible Authentication Protocol) between three components:

• Supplicant: Client software requesting access (e.g., Windows native, Cisco AnyConnect NAM)
• Authenticator: Network switch or WLC controlling port access (NAD - Network Access Device)
• Authentication Server: RADIUS server (e.g., Cisco ISE) validating credentials and pushing authorization policy

Cisco ISE (Identity Services Engine): Centralized policy platform for 802.1X, MAB, WebAuth, guest access, BYOD, profiling, posture assessment, and TrustSec SGT assignment. ISE integrates with Active Directory and supports RADIUS and TACACS+.

MACsec (IEEE 802.1AE)

MACsec provides Layer 2 hop-by-hop encryption between directly connected devices (switch-to-switch or host-to-switch). It encrypts the entire Ethernet frame payload using AES-GCM-128 or AES-GCM-256.

Control Plane Policing (CoPP)

CoPP protects the CPU of a network device from excessive or malicious traffic targeting the control plane (e.g., routing protocol attacks, SSH brute force, ICMP floods). It applies QoS policy to traffic destined for the router's CPU.

• Class-maps: Classify control plane traffic (BGP, OSPF, SSH, SNMP, ICMP, etc.)
• Policy-maps: Define rate-limit or police actions per traffic class
• Applied to: control-plane interface with service-policy input

Cisco TrustSec & Security Group Tags (SGTs)

TrustSec assigns SGTs (Security Group Tags) to users/devices at ingress based on identity (via ISE). Policy enforcement uses SGACLs (Security Group ACLs) based on source and destination SGTs rather than IP addresses. This provides scalable, identity-based micro-segmentation that works across the fabric.

Wireless Security (WPA2 / WPA3)

Tip: WPA3-Personal uses SAE (Simultaneous Authentication of Equals) which replaces the 4-way handshake with a Dragonfly key exchange, providing forward secrecy and protection against offline dictionary attacks.

REST APIs and HTTP Methods

REST (Representational State Transfer) is an architectural style for APIs. REST APIs use standard HTTP methods and are stateless. Data is exchanged in JSON or XML format.

YANG Data Models

YANG (Yet Another Next Generation) is a data modeling language used to define the structure of configuration and operational data on network devices. YANG models are used by NETCONF and RESTCONF to programmatically manage devices.

• Module: Top-level container for a YANG data model
• Container: Grouping node (no value itself, holds child nodes)
• Leaf: Single value node (e.g., hostname, IP address)
• Leaf-list: Array of scalar values
• List: Collection of entries identified by key(s) (e.g., list of interfaces)
• Model Sources: IETF models (vendor-neutral), OpenConfig (vendor-neutral, operational focus), Cisco-native (device-specific)

NETCONF vs RESTCONF

Tip: NETCONF is more powerful for production automation (transactional, candidate datastore, locking). RESTCONF is simpler for quick integrations and lightweight reads (uses familiar HTTP/REST patterns).

Python for Network Automation

Python is the most common language for network automation. Key libraries used with Cisco devices:

Ansible for Network Automation

Ansible is an agentless automation tool using YAML playbooks. It connects to network devices via SSH or API (no agent installation required on devices).

Cisco DNA Center APIs

DNA Center exposes northbound REST APIs for automation and integration. Authentication uses a token-based system.

• Authentication: POST to /dna/system/api/v1/auth/token with Basic Auth to get a bearer token
• Network Discovery: GET /dna/intent/api/v1/network-device to list all managed devices
• Path Trace: POST /dna/intent/api/v1/flow-analysis for hop-by-hop path analysis
• Command Runner: POST /dna/intent/api/v1/network-device-poller/cli/read-request to run CLI commands
• Template Programmer: Deploy configuration templates to devices programmatically
• API Versioning: Intent APIs (/dna/intent/) are the primary set; use current documented version

Data Formats: JSON vs XML vs YAML

Routing Protocol Comparison

SPAN vs NetFlow vs Syslog vs SNMP

SD-Access vs Traditional Campus

NETCONF vs RESTCONF vs CLI vs SNMP

Overlay Technologies: VXLAN vs GRE vs IPsec

Administrative Distance (AD) Quick Reference

Tip: Lower AD is preferred. Connected (0) and Static (1) always win over dynamic protocols. eBGP (20) is preferred over all IGPs. EIGRP internal (90) beats OSPF (110). Remember: AD is local to the router and is used to select between routing protocols when multiple sources provide the same prefix.

SD-WAN vs Traditional WAN