ENSLD 300-420 key terms

A three-tier campus structure of core, distribution, and access layers, where each layer has a defined role in forwarding, policy enforcement, and endpoint connectivity, keeping designs modular and predictable as the network grows.

A two-tier design that merges the core and distribution layers into one pair of switches, typically used in smaller campuses where a dedicated core adds cost and hops without adding resilience.

A campus topology with separate access, distribution, and core layers, suited to large sites that need high port density, policy boundaries at distribution, and a fast, simple core.

A Layer 2 loop-prevention protocol that elects a root bridge and blocks redundant paths, leaving a single active tree per VLAN. Design choices include root placement, timers, and alternatives such as MST or routed access.

A design where Layer 3 routing extends to the access switch, so each closet forms its own subnet and Layer 2 loops are avoided, improving convergence and allowing equal-cost multipathing to the distribution layer.

A mechanism such as HSRP, VRRP, or GLBP that gives hosts a shared virtual default gateway, so a failed distribution switch does not strand the subnet and failover is transparent to endpoints.

The deliberate mapping of users, devices, and services to broadcast domains, balancing segmentation for security and policy against subnet size, mobility needs, and the number of spanning-tree or routing instances.

Advertising a single aggregate prefix that covers many more-specific subnets, which shrinks routing tables and confines topology changes. It requires addressing plans with contiguous, summarizable blocks at each layer boundary.

The allocation of IP address blocks by site, building, floor, and function so that subnets stay contiguous and summarizable, growth has room, and NAT or renumbering is rarely needed later.

A technology that runs multiple independent routing tables on one physical device, letting a design separate tenants, security zones, or overlapping address spaces without separate hardware.

A fabric architecture using LISP for control-plane mapping, VXLAN for data encapsulation, and ISE for policy, giving identity-based segmentation and consistent policy across wired and wireless campus networks.

The physical and routed foundation beneath an overlay fabric, usually a simple, redundant Layer 3 topology sized for predictable latency and equal-cost paths, carrying encapsulated traffic without policy awareness.

A logical topology tunneled over an existing transport, enabling segmentation, mobility, and policy independent of physical cabling. Examples include VXLAN fabrics, SD-WAN tunnels, and VPNs.

A tunneling protocol that encapsulates Layer 2 frames in UDP, using a 24-bit VNI to identify up to 16 million segments and stretching them across a routed underlay.

Dividing a network into broad zones, such as users, guests, servers, and management, enforced by VRFs, firewalls, or fabric policy, so that traffic between zones passes through a controlled point.

Applying policy to individual endpoints or small groups based on identity or attributes rather than subnet location, typically using security group tags or fabric policy so lateral movement inside a zone is restricted.

A Cisco policy framework that assigns security group tags to traffic, so enforcement devices can permit or deny flows by group identity instead of by IP address and subnet.

Planning access point placement, channel and power settings, and controller or cloud architecture to meet coverage, capacity, roaming, and high-density requirements for client devices across a site.

Classifying, marking, queuing, and scheduling traffic so latency-sensitive and business-critical flows keep acceptable delay, jitter, and loss when links are congested, applied consistently end to end.

A controller-based WAN architecture with centralized management and policy, using encrypted tunnels over any transport and application-aware routing to steer traffic across multiple WAN links.

A policy that measures path characteristics such as latency, jitter, and loss in real time and steers each application class onto the best available WAN link, falling back when thresholds are breached.

A branch design that sends internet-bound traffic straight out a local link instead of backhauling it to a central site, reducing latency and WAN load while requiring local security controls.

A cloud-delivered set of security controls, including secure web gateway, cloud access security broker, and zero-trust network access, used to inspect branch internet traffic that no longer traverses a central data center.

A security model that authenticates and authorizes every request based on identity and device posture rather than assumed network trust, driving designs toward per-application access and encrypted, segmented paths.

The pattern of encrypted tunnels connecting sites, such as hub-and-spoke, full mesh, or partial mesh, chosen by weighing traffic patterns against tunnel count, latency, and cost.

A WAN topology where every branch connects to a central hub, simplifying policy and reducing circuit count, but adding latency and hub dependency for spoke-to-spoke traffic unless the hub redirects it.

A topology in which every site connects directly to every other, minimizing latency and removing single points of failure but scaling poorly because tunnel and peer counts grow with the square of site count.

A provider-managed WAN service that forwards customer traffic over label-switched paths with per-VRF separation, offering predictable latency and any-to-any connectivity but typically long provisioning and high cost.

Using ordinary broadband or dedicated internet circuits as the transport beneath encrypted overlays, trading service guarantees for lower cost, broader availability, and fast provisioning.

The process of choosing which tunnel or next hop carries a given flow, based on routing metrics, policy, or measured link quality, determining how traffic uses the available WAN paths.

A design that separates the control plane from forwarding devices, placing configuration, policy, and topology decisions in centralized controllers so devices stay simple and consistent across the network.

An operational model where an engineer states the desired outcome and policy, and the system translates it into device configuration, verifies it continuously, and corrects drift automatically.

Managing network configuration through versioned, machine-readable templates and pipelines rather than manual changes, enabling review, repeatability, rollback, and automated validation before deployment.

Continuous measurement of a network against intended behavior using telemetry, flow data, and synthetic tests, so that policy violations, path changes, and degradation are detected before users report them.

Streaming operational data such as interface statistics, flow records, and device health from network elements to a collector at regular intervals, giving designers evidence for capacity and performance decisions.

Examining records of conversations between endpoints, including addresses, ports, and byte counts, to understand application mix, traffic paths, and top talkers when sizing and placing network resources.

Forecasting traffic growth and link utilization from measured baselines and demand trends, then sizing circuits, device throughput, and oversubscription ratios so performance targets hold through the design's lifetime.

A source-routing approach where the headend encodes a path as an ordered list of segment identifiers, removing per-flow state from core devices and simplifying traffic engineering over an underlay.