Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Cisco
Exam Format
Registration
Validity
Skills this practice test covers
- Configure and verify OSPFv2 and OSPFv3 areas, summarization and filtering, and eBGP between directly connected neighbors.
- Troubleshoot 802.1q trunks and EtherChannels, and tune RSTP and MST with root guard and BPDU guard.
- Build VRFs and GRE or IPsec tunnels, and describe how LISP and VXLAN carry traffic.
- Configure CoPP, ACLs and AAA to protect device access and the control plane.
- Set up Flexible NetFlow, IPSLA and SPAN, RSPAN or ERSPAN to diagnose network problems.
- Read Python scripts, REST API response codes and RESTCONF payloads, and write an EEM applet.
Explore related topics
350-401 exam content
6 domains · 27 topics · 248 of 258 questions sorted by domain
Architecture15%36 questions
This domain asks how an enterprise network is designed before it is built. Candidates compare 2-tier, 3-tier, fabric and cloud designs, explain Catalyst SD-WAN and SD-Access, and read QoS configurations.
Skills tested
- Compare 2-tier, 3-tier, fabric and cloud designs for a campus network.
- Explain redundancy, FHRP and SSO as high availability techniques.
- Separate the control plane and data plane elements of Catalyst SD-WAN and SD-Access.
- Read a QoS configuration and say which traffic it marks, queues or drops.
Questions by topic
- Explain the working principles of the Cisco SD-Access solution8
- Explain the different design principles used in an enterprise network5
- Interpret QoS configurations11
- Explain the working principles of the Cisco Catalyst SD-WAN solution12
Virtualization10%26 questions
Engineers split one physical network into many logical ones. This domain covers hypervisors and virtual switching, VRFs, GRE and IPsec tunnels, and the overlay protocols LISP and VXLAN.
Skills tested
- Tell a type 1 hypervisor from a type 2 hypervisor.
- Configure a VRF and verify its separate routing table.
- Build a GRE tunnel and protect it with IPsec.
- Describe how LISP maps endpoints to locations and how VXLAN carries Layer 2 frames over an IP network.
Questions by topic
- Configure and verify data path virtualization technologies15
- Describe device virtualization technologies4
- Describe network virtualization concepts7
Infrastructure30%72 questions
The largest domain is daily switching and routing work. Candidates troubleshoot trunks and EtherChannels, tune spanning tree, configure OSPF and eBGP, and set up NAT, NTP and first hop redundancy.
Skills tested
- Fix a trunk or EtherChannel that will not come up between two switches.
- Configure RSTP or MST and protect the topology with root guard and BPDU guard.
- Configure multi-area OSPFv2 or OSPFv3 with summarization and filtering.
- Configure eBGP between directly connected neighbors and trace the best path selection.
- Configure NAT/PAT and HSRP or VRRP, and describe multicast with PIM SM and IGMP.
Questions by topic
- IP Services19
- Layer 332
- Layer 221
Network Assurance10%29 questions
This domain covers how engineers see what the network is doing. Candidates use debugs, traceroute, SNMP and syslog, collect flow and probe data, mirror traffic, and describe Cisco Catalyst Center workflows.
Skills tested
- Narrow a fault with conditional debugs, ping, traceroute and syslog.
- Configure Flexible NetFlow and read which hosts send the traffic.
- Mirror traffic to an analyzer with SPAN, RSPAN or ERSPAN.
- Configure an IPSLA probe and verify NETCONF and RESTCONF access.
Questions by topic
- Diagnose network problems using such as debugs, conditional debugs, traceroute, ping, SNMP, and syslog7
- Configure and verify NETCONF and RESTCONF6
- Configure SPAN/RSPAN/ERSPAN4
- Configure and verify Flexible NetFlow4
- Describe how Cisco Catalyst Center (formerly Cisco DNA Center) is used to apply network configuration, monitoring, and management using traditional and AI-powered workflows4
- Configure and verify IPSLA4
Security20%44 questions
Engineers must lock down the devices that run the network. This domain covers device access with lines, local users and AAA, ACLs and CoPP, REST API security, and the parts of a network security design.
Skills tested
- Configure local user authentication on lines and move it to AAA.
- Write ACLs and a CoPP policy that protect the control plane.
- Describe how REST API security protects an automation interface.
- Place threat defense, endpoint security, next-generation firewalls, TrustSec and MACsec in a security design.
Questions by topic
- Configure and verify device access control15
- Configure and verify infrastructure security features12
- Describe REST API security2
- Describe the components of network security design15
Automation and Artificial Intelligence15%41 questions
Network changes now come from code as often as from the CLI. Candidates read Python and JSON, describe YANG and the APIs of Cisco Catalyst Center and SD-WAN Manager, write EEM applets, and compare orchestration tools.
Skills tested
- Read a basic Python script and predict what it sends to a device.
- Write a valid JSON-encoded file and spot one that is broken.
- Interpret REST API response codes and payloads from Cisco Catalyst Center and RESTCONF.
- Construct an EEM applet that collects data when an event occurs.
- Compare agent and agentless orchestration tools.
Questions by topic
- Describe APIs for Cisco Catalyst Center and SD-WAN Manager3
- Compare agent vs. agentless orchestration tools7
- Describe the high-level principles and benefits of a data modeling language, such as YANG6
- Construct an EEM applet to automate configuration, troubleshooting, or data collection8
- Interpret basic Python components and scripts6
- Interpret REST API response codes and results in payload using Cisco Catalyst Center and RESTCONF8
- Construct valid JSON-encoded files3
Requirements
- No formal prerequisites: anyone can book the exam.
About the 350-401 exam
Cisco's 350-401 ENCOR exam checks that an engineer can implement and operate the core of an enterprise network. It covers architecture, virtualization, Layer 2 and Layer 3 infrastructure, network assurance, security and automation. Passing it earns the Cisco Certified Specialist - Enterprise Core certification. The same pass meets the core exam requirement for CCNP Enterprise and CCIE Enterprise Infrastructure.
Infrastructure is the largest domain, so the PlanetCert practice test spends the most questions on trunks, EtherChannels, spanning tree, OSPF, eBGP, NAT and first hop redundancy. Each explanation follows the configuration line by line and shows why a neighbor does or does not form. Study Mode suits the automation domain, where a Python script or a JSON payload needs a slow read. Brainy AI Assistant can walk through the eBGP best path selection steps for any question, or decode a RESTCONF response code.
How to earn the certification
- Earns
- Cisco Certified Specialist - Enterprise CoreProfessional
The certification stays valid for three years, and the exam also counts toward recertification.
- After
- 300-410 Enterprise Advanced Routing and Services (ENARSI)
A concentration exam that, with ENCOR, completes CCNP Enterprise. It goes deeper into routing and services troubleshooting.
- 300-420 Designing Cisco Enterprise Networks (ENSLD)
A CCNP Enterprise concentration about network design.
- 300-415 Implementing Cisco Catalyst SD-WAN Solutions (ENSDWI)
A CCNP Enterprise concentration that builds on the SD-WAN topics in the Architecture domain.
- 300-435 Automating and Programming Cisco Enterprise Solutions (ENAUTO)
A CCNP Enterprise concentration that extends the Automation and Artificial Intelligence domain.
- 300-440 ENCC - Designing and Implementing Cloud Connectivity
A CCNP Enterprise concentration about connecting enterprise networks to the cloud.
- 300-410 Enterprise Advanced Routing and Services (ENARSI)
How to prepare for 350-401
- 1
Build an IOS XE lab
Set up a few virtual routers and switches so trunks, EtherChannels, OSPF and eBGP can be configured and broken by hand.
- 2
Give Infrastructure the most hours
Infrastructure carries the largest weight. Work through spanning tree, multi-area OSPF, eBGP neighbor states, NAT/PAT, HSRP and VRRP until each one can be verified with show commands.
- 3
Read code and payloads daily
Spend short sessions on Python scripts, JSON files, YANG models and REST API response codes from Cisco Catalyst Center and RESTCONF. Then write one EEM applet in the lab.
- 4
Map the overlays on paper
Draw the control and data planes of Catalyst SD-WAN and SD-Access, and where VRFs, GRE, IPsec, LISP and VXLAN fit. Architecture and Virtualization questions test this picture.
- 5
Practise by domain, then timed
Take the ENCOR practice test one domain at a time in Study Mode and read every explanation. Finish with full runs in Timed Mode, and rebuild each missed configuration in the lab.
Start a timed 350-401run
Who 350-401 is for
- Network engineers working toward CCNP Enterprise, where this is the core exam.
- Engineers aiming at CCIE Enterprise Infrastructure, which uses the same core exam.
- Network administrators who run Cisco campus and WAN networks and want a professional-level certification.
- Engineers moving from CLI-only work into Catalyst Center, SD-WAN and automation.
Typical job titles: Network engineer · Senior network administrator · Enterprise network engineer · Network operations engineer · Network automation engineer
350-401 glossary
18 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- BPDU guard
- A spanning tree feature that shuts a port down if it receives a BPDU, so an access port cannot join the topology.
- CoPP
- Control plane policing: a policy that limits the traffic sent to a device's CPU, so floods cannot overload it.
- EEM applet
- An Embedded Event Manager script on a Cisco device that runs set actions when a chosen event occurs.
- ERSPAN
- Encapsulated remote SPAN: mirrored traffic sent inside GRE across a routed network to a distant analyzer.
- EtherChannels
- Bundles of physical links between two switches that act as one logical link for more bandwidth and redundancy.
- FHRP
- First hop redundancy protocol: a way for two or more routers to share one gateway address so hosts keep working if one router fails.
- Flexible NetFlow
- A Cisco feature that records traffic flows by fields the engineer chooses, so it shows who sends what across the network.
- HSRP
- Hot Standby Router Protocol: Cisco's first hop redundancy protocol, with one active router and one standby router.
- Hypervisor type 1 and 2
- A type 1 hypervisor runs directly on the hardware; a type 2 hypervisor runs as an application on a host operating system.
- IPSLA
- IP Service Level Agreement: probes a device sends to measure delay, loss and reachability on a path.
- LISP
- Locator/ID Separation Protocol, which keeps an endpoint's identity apart from its location so the endpoint can move.
- policy-based routing
- Routing that chooses a path by rules such as source address, not only by the destination in the routing table.
- SD-Access
- Cisco's campus fabric solution, which builds an overlay network on top of the physical switches and applies policy by group.
- SSO
- Stateful switchover: a feature that lets a standby supervisor take over from a failed one without losing its forwarding state.
- TrustSec and MACsec
- TrustSec applies access policy by security group tags; MACsec encrypts traffic on each Ethernet link.
- VRF
- Virtual routing and forwarding: separate routing tables on one router, so traffic in one VRF cannot reach another by default.
- VXLAN
- Virtual Extensible LAN, which wraps Layer 2 frames inside UDP packets so they can cross a Layer 3 network.
- YANG
- A data modeling language that describes a device's configuration and state in a fixed structure that tools can read.
Related practice tests
- 300-535Automating and Programming Cisco Service Provider Solutions (SPAUTO)
- 200-901CCNA Automation (DevNet Associate)
- 200-201CCNA Cybersecurity (CyberOps Associate)
- 200-301Cisco Certified Network Associate (CCNA)
- 300-420Designing Cisco Enterprise Networks (ENSLD)