CCNP ENCOR 350-401 Exam Topics (v1.2): Every Domain and Weight
The complete ENCOR v1.2 blueprint, with Cisco's official weights and the verb attached to every topic - because on this exam the verb is what separates a topic you read about from one you have to configure under time pressure. Two things worth knowing up front: Infrastructure alone is 30%, and wireless is entirely gone, so if your course still has a WLAN module you can skip it.
See your score broken down by these exact domains
The blueprint tells you what is testable. A full-length practice exam tells you which parts of it you cannot do yet. The first one is free - v1.2 aligned, with an explanation and an Exam Tip on every item and a personalized Exam Coach at the end. Create an account on the next screen and the code applies itself.
CCNP-EXAM-FULL
Start the free exam
Already have an account? Log in to start · Prefer a 5-question taster? Try the short version.
On this page
Where the marks are
This is a far less even spread than the CCNA or the CISSP, which makes it genuinely useful for planning. Infrastructure and Security together are half the exam, and both are dominated by configure-and-verify topics rather than describe. The two 10% domains, Virtualization and Network Assurance, are small enough that over-studying them is a real and common mistake.
Note the name of domain 6.0: since v1.2 it is "Automation and Artificial Intelligence", not simply Automation. AI also surfaces inside Network Assurance, where topic 4.5 now explicitly covers Catalyst Center's "traditional and AI-powered workflows".
How to read the blueprint
Cisco writes each topic with a verb, and on ENCOR the spread is wider than most people expect:
Troubleshoot / Diagnose find the fault and fix it. Only two places on ENCOR, and both are in the heaviest domain.
Configure / Verify / Construct build it and prove it works. The bulk of Infrastructure, Security and Automation.
Describe / Explain / Interpret / Compare understand it well enough to reason about it. All of Architecture, most of Virtualization.
The six domains, topic by topic
1.0 Architecture4 topics, zero configuration. Pure understanding.
- 1.1ExplainDesign principles used in an enterprise networkHigh-level design - 2-tier, 3-tier, fabric and cloud; high availability techniques including redundancy, FHRP and SSO.
- 1.2ExplainWorking principles of the Cisco Catalyst SD-WAN solutionControl and data plane elements, plus the benefits and limitations of the solution. The limitations half is routinely skipped and routinely tested. SD-WAN vs SD-Access.
- 1.3ExplainWorking principles of the Cisco SD-Access solutionControl and data plane elements, and how a traditional campus interoperates with SD-Access. LISP vs VXLAN, the two planes.
- 1.4InterpretQoS configurationsInterpret, not configure - you read a QoS policy and say what it does, which is a much smaller job than building one.
2.0 Virtualization3 topics. Small, and the easiest domain to over-study.
- 2.1DescribeDevice virtualization technologiesHypervisor type 1 and type 2, virtual machines, virtual switching.
- 2.2ConfigureData path virtualization technologiesVRF, plus GRE and IPsec tunnelling. The only configuration work in this domain, so it is where the domain's marks concentrate.
- 2.3DescribeNetwork virtualization conceptsLISP and VXLAN - the control plane and data plane of the campus fabric respectively.
3.0 InfrastructureThree sub-areas and the only troubleshoot verbs on the exam. Nearly a third of your score.
- 3.1.aTroubleshootStatic and dynamic 802.1Q trunking protocols
- 3.1.bTroubleshootStatic and dynamic EtherChannels
- 3.1.cConfigureCommon spanning tree protocols (RSTP, MST) and enhancements such as root guard and BPDU guardNote MST - this is beyond CCNA level and a reliable source of marks. STP fundamentals refresher.
- 3.2.aCompareRouting concepts of EIGRP and OSPFAdvanced distance vector versus link state, load balancing, path selection, path operations, metrics and area types.
- 3.2.bConfigureSimple OSPFv2/v3 environmentsMultiple normal areas, summarization and filtering; neighbor adjacency, point-to-point and broadcast network types, passive-interface. OSPF guide.
- 3.2.cConfigureeBGP between directly connected neighborsBest path selection algorithm and neighbor relationships. BGP path selection explained.
- 3.2.dDescribePolicy-based routing
- 3.3.aInterpretNetwork time protocol configurations such as NTP and PTP
- 3.3.bConfigureNAT/PAT
- 3.3.cConfigureFirst hop redundancy protocols such as HSRP and VRRP
- 3.3.dDescribeMulticast protocolsRPF check, PIM SM, IGMP v2/v3, SSM, bidir and MSDP. Describe only - do not sink lab time into building multicast.
4.0 Network Assurance6 topics for 10%. Thinly spread, and heavy on tools.
- 4.1DiagnoseNetwork problems using debugs, conditional debugs, traceroute, ping, SNMP and syslog
- 4.2ConfigureFlexible NetFlow
- 4.3ConfigureSPAN, RSPAN and ERSPAN
- 4.4ConfigureIP SLA
- 4.5DescribeHow Cisco Catalyst Center (formerly DNA Center) applies configuration, monitoring and managementUsing traditional and AI-powered workflows - the AI wording is new in v1.2, and it is the second place AI appears on this blueprint.
- 4.6ConfigureNETCONF and RESTCONFNETCONF vs RESTCONF vs gNMI.
5.0 Security4 topics for 20% - the highest weight-per-topic on the exam.
- 5.1ConfigureDevice access controlLines and local user authentication; authentication and authorization using AAA.
- 5.2ConfigureInfrastructure security featuresACLs and CoPP (control plane policing).
- 5.3DescribeREST API security
- 5.4DescribeComponents of network security designThreat defense, endpoint security, next-generation firewall, and TrustSec and MACsec. For the 802.1X and identity side in depth, that belongs to CCNP Security - see 802.1X and Cisco ISE.
Do the arithmetic here. Four topics carrying 20% means each one is worth roughly 5% of the whole exam - more than any individual topic in Infrastructure. Security is the most under-studied domain on ENCOR relative to its value.
6.0 Automation and Artificial Intelligence7 topics. Renamed in v1.2, and vendor tool names removed.
- 6.1InterpretBasic Python components and scriptsInterpret, not write. You read a script and say what it does.
- 6.2ConstructValid JSON-encoded files
- 6.3DescribeHigh-level principles and benefits of a data modeling language such as YANG
- 6.4DescribeAPIs for Cisco Catalyst Center and SD-WAN Manager
- 6.5InterpretREST API response codes and payload results using Catalyst Center and RESTCONF
- 6.6ConstructAn EEM applet to automate configuration, troubleshooting or data collectionThe one place you genuinely have to write something. EEM applets are short and highly patterned, so this is very learnable.
- 6.7CompareAgent versus agentless orchestration toolsNote the phrasing: v1.2 removed the named vendor tools (Chef, Puppet, Ansible, SaltStack) and asks about the architectural distinction instead. Older courses still drill the product names.
Turn the blueprint into a priority list
A checklist tells you everything matters. One full-length attempt tells you which topics are actually costing you marks - and on an exam where Infrastructure and Security are half your score, that distinction is worth weeks. Free, with a personalized Exam Coach that names what to revisit first.
CCNP-EXAM-FULL
Redeem the code
Already have an account? Log in to redeem
Is ENCOR changing in 2027?
Cisco has announced nothing for ENCOR in 2027. v1.2 took effect on 19 March 2026 and it is what you sit. That is worth saying plainly, because the question is being asked a lot right now for a reason that has nothing to do with ENCOR:
- The CCNA is genuinely changing. 200-301 moves to v2.0 on 3 February 2027 with a restructured blueprint - six domains to five, troubleshooting back, AI added. That is real news, and it makes people assume the rest of the Cisco portfolio is moving too. What is changing on the CCNA.
- ENCOR already had its update. v1.2 was the change, and it was a substantial one - all wireless removed to the new CCNP Wireless track (350-101 WLCOR), automation reworded, AI added to two domains. What v1.2 changed.
So there is no ENCOR deadline to race and no version boundary to plan around. If you were holding off on booking because you feared a change, stop holding off. Check Cisco's official exam topics before your test date, as always, but the current answer is that v1.2 is stable.
One consequence worth naming: because ENCOR is stable while the CCNA is not, any question bank or dump sold as covering "Cisco 2027" is telling you nothing about ENCOR. Material built for v1.1 - which still teaches wireless - is the actual risk here, and it is already out of date rather than about to become so. If a course you are looking at still has a WLAN module for ENCOR, that is your signal it has not been maintained since March 2026.
What to study first
ENCOR's weights are uneven enough to follow directly, unlike the CISSP. A sequence that matches where the marks actually are:
- Infrastructure, and give it the time its 30% deserves. Start with the two troubleshoot topics - trunking and EtherChannel - because they are the only place on the exam Cisco asks you to fix something rather than build or describe it, and that is a different skill.
- Security next, at 20% across only four topics. Each topic is worth about 5% of the whole exam. AAA, ACLs and CoPP are configuration; threat defense, NGFW, TrustSec and MACsec are description. Both halves are quick relative to their value.
- Architecture, which reads faster than it looks. No configuration verbs at all. If lab time is scarce, this is where 15% is available from reading alone - especially the SD-WAN and SD-Access working principles.
- Automation and AI, focused on the two constructive topics. JSON and EEM applets are the ones that need practice; the rest is interpret and describe.
- Virtualization and Network Assurance last. Ten percent each. In Virtualization, prioritise VRF and GRE/IPsec, since that is the only configuration in the domain.
- Then sit a full exam and check the shape. The readiness rubric sets out the thresholds worth hitting before you book.
Frequently asked questions
What are the CCNP ENCOR domains and their weights?
Six domains in v1.2: Architecture 15%, Virtualization 10%, Infrastructure 30%, Network Assurance 10%, Security 20%, and Automation and Artificial Intelligence 15%. Infrastructure is by far the largest, and with Security it accounts for half the exam.
Is wireless still on the CCNP ENCOR exam?
No. All wireless topics were removed when ENCOR moved to v1.2 on 19 March 2026 and now sit in the CCNP Wireless track under the 350-101 WLCOR core exam. There is no residual wireless section, so RF fundamentals and WLAN configuration are wasted study for ENCOR. If a course still includes them, it has not been updated since March 2026.
Is ENCOR changing in 2027?
Cisco has announced nothing. v1.2, effective 19 March 2026, is the current and only blueprint. The question comes up because the CCNA moves to v2.0 on 3 February 2027, but that change is specific to the CCNA - ENCOR already had its update in v1.2. There is no ENCOR deadline to plan around.
How many questions are on the ENCOR exam?
Cisco does not publish a fixed count and it varies between forms. The exam is 120 minutes and mixes multiple choice with drag-and-drop and simulation items. Treat the domain weights as percentages of your score rather than converting them into an exact number of questions.
Which domain should I study first?
Infrastructure, at 30%. It carries the heaviest hands-on load - trunking, EtherChannel, RSTP and MST, OSPF with multiple areas and summarization, eBGP, and first hop redundancy - and it holds the only troubleshoot verbs on the exam. After that, Security at 20% across just four topics, which makes each one unusually valuable.
Does ENCOR count towards the CCIE as well?
Yes. 350-401 ENCOR is the core exam for both CCNP Enterprise and CCIE Enterprise Infrastructure and Wireless. For CCNP Enterprise you pass ENCOR plus one concentration exam; for the CCIE, ENCOR serves as the qualifying written exam ahead of the lab. That dual role is part of why the blueprint is broad relative to its 120 minutes.