All certifications
Cisco350-401 v1.2
Cisco CCNP Enterprise Core (ENCOR)
Exam overview, official domain weights and free sample questions. Subscribers get 230 practice questions, 119 flashcards, 4 labs, a study guide and video lessons for this exam.
Exam at a glance
- Exam code
- 350-401 v1.2
- Questions
- not published
- Time
- 120 minutes
- Question types
- performance-based, multiple choice, drag-and-drop
- Passing score
- not published (pass/fail, results usually within 48 hours)
- Exam fee
- US$400, or Cisco Learning Credits
- Delivery
- Pearson VUE (per Cisco ENCOR overview page)
- Prerequisites
- None published
- Renewal
- The exam can be used toward Cisco recertification requirements
- Version notes
- v1.2 first test date March 19, 2026 (v1.1 last test date March 18, 2026, wireless content removed). No retirement date published for v1.2
From the official exam page (checked 2026-11-09). Always confirm details with the vendor: official exam page, official objectives.
Domains and weights
Architecture15%
- 1.1 Explain the different design principles used in an enterprise network
- 1.2 Explain the working principles of the Cisco Catalyst SD-WAN solution
- 1.3 Explain the working principles of the Cisco SD-Access solution
- 1.4 Interpret QoS configurations
Virtualization10%
- 2.1 Describe device virtualization technologies
- 2.2 Configure and verify data path virtualization technologies
- 2.3 Describe network virtualization concepts
Infrastructure30%
- 3.1.a Troubleshoot static and dynamic 802.1q trunking protocols
- 3.1.b Troubleshoot static and dynamic EtherChannels
- 3.1.c Configure and verify common Spanning Tree Protocols (RSTP, MST) and Spanning Tree enhancements such as root guard and BPDU guard
- 3.2.a Compare routing concepts of EIGRP and OSPF (advanced distance vector vs. link state, load balancing, path selection, path operations, metrics, and area types)
- 3.2.b Configure simple OSPFv2/v3 environments, including multiple normal areas, summarization, and filtering (neighbor adjacency, point-to-point, and broadcast network types, and passive-interface)
- 3.2.c Configure and verify eBGP between directly connected neighbors (best path selection algorithm and neighbor relationships)
- 3.2.d Describe policy-based routing
- 3.3.a Interpret network time protocol configurations such as NTP and PTP
- 3.3.b Configure NAT/PAT
- 3.3.c Configure first hop redundancy protocols, such as HSRP, VRRP
- 3.3.d Describe multicast protocols, such as RPF check, PIM SM, IGMP v2/v3, SSM, bidir, and MSDP
Network Assurance10%
- 4.1 Diagnose network problems using such as debugs, conditional debugs, traceroute, ping, SNMP, and syslog
- 4.2 Configure and verify Flexible NetFlow
- 4.3 Configure SPAN/RSPAN/ERSPAN
- 4.4 Configure and verify IPSLA
- 4.5 Describe how Cisco Catalyst Center (formerly Cisco DNA Center) is used to apply network configuration, monitoring, and management using traditional and AI-powered workflows
- 4.6 Configure and verify NETCONF and RESTCONF
Security20%
- 5.1 Configure and verify device access control
- 5.2 Configure and verify infrastructure security features
- 5.3 Describe REST API security
- 5.4 Describe the components of network security design
Automation and Artificial Intelligence15%
- 6.1 Interpret basic Python components and scripts
- 6.2 Construct valid JSON-encoded files
- 6.3 Describe the high-level principles and benefits of a data modeling language, such as YANG
- 6.4 Describe APIs for Cisco Catalyst Center and SD-WAN Manager
- 6.5 Interpret REST API response codes and results in payload using Cisco Catalyst Center and RESTCONF
- 6.6 Construct an EEM applet to automate configuration, troubleshooting, or data collection
- 6.7 Compare agent vs. agentless orchestration tools
Free sample questions
Original questions in the style of the exam. Pick an answer to see the explanation.
Sample question 1 · Architecture
A university campus has 14 buildings, each with its own distribution switch pair, and traffic between buildings is growing fast. Which design is most appropriate?
Incorrect — “Two-tier collapsed core in one building”: Collapsing the core works for small campuses, but 14 distribution blocks would need a large mesh of links to one pair. Incorrect — “A single flat Layer 2 VLAN across buildings”: A campus-wide Layer 2 domain makes failure domains and STP problems huge. Correct — “Three-tier, with a dedicated core layer”: A separate core gives a fast, scalable backbone that interconnects many distribution blocks without full-meshing them. Incorrect — “Spine-leaf with buildings as spines”: Spine-leaf is a data center pattern; buildings are not spines.
Sample question 2 · Virtualization
A server team installs VMware ESXi directly on bare-metal servers, while developers run VirtualBox on their Windows laptops. How are these hypervisors classified?
Incorrect — “Both are Type 1 because both run VMs”: Type depends on whether a host OS sits underneath. Incorrect — “Both are container engines, not hypervisors”: Both run full virtual machines with guest operating systems. Incorrect — “ESXi is Type 2; VirtualBox is Type 1”: The classifications are reversed. Correct — “ESXi is Type 1; VirtualBox is Type 2”: Type 1 hypervisors run directly on hardware; Type 2 hypervisors run as applications on a host OS.
Sample question 3 · Infrastructure
SW1's uplink has `switchport mode trunk` and `switchport nonegotiate`. SW2's port is `switchport mode dynamic desirable`. What is the result?
Incorrect — “Both sides become access ports”: SW1 is hard-set to trunk and does not change to access. Correct — “SW1 trunks while SW2 stays an access port”: nonegotiate stops SW1 from sending DTP, so SW2's desirable port never hears a trunk offer and stays access, a mismatch that breaks tagged VLANs. Incorrect — “Both sides form an 802.1Q trunk”: SW2 needs DTP frames to become a trunk, and SW1 sends none. Incorrect — “Both ports are err-disabled by DTP”: DTP mismatches do not err-disable ports.
Unlock every question, lab and guide
Full access to all 20 certifications for $4.99/month. Cancel anytime.