Cisco ENCC (300-440) key terms

A network controller that discovers devices, builds a topology, and pushes intent-based configuration and assurance policies across campus and branch fabrics from a single dashboard.

A Catalyst Center structure of global area, regions, sites, and buildings that groups devices geographically so policies, credentials, and software images can be applied by location.

The Catalyst Center capability that collects telemetry and health scores from devices and clients, then correlates issues to show root cause and suggested remediation for network problems.

A Cisco intent-based architecture using a fabric underlay and VXLAN overlay, with Catalyst Center as controller and ISE as policy engine, to segment users and things by identity.

A Catalyst Center object defining a location where SD-Access fabric roles such as control plane, border, and edge nodes are assigned to devices for overlay networking.

A fabric device running LISP that maintains the endpoint-to-edge-node mapping database and answers map requests so traffic can be routed across the overlay.

A fabric device that connects the SD-Access overlay to external networks and other fabric sites, handling VXLAN handoff and route redistribution between fabric and non-fabric domains.

A 16-bit identifier carried in VXLAN-GPO headers that expresses group-based policy, letting the fabric enforce permit or deny between security groups without per-subnet ACLs.

An extension of VXLAN that adds a group policy option field to the overlay header, allowing security group tags to travel with packets across the fabric data plane.

Locator/ID Separation Protocol, used in SD-Access as the control plane that registers endpoint identifiers with their routing locators and resolves lookups between fabric edge nodes.

Cisco's identity-based segmentation framework that assigns security group tags to users and devices and enforces policy through network devices rather than relying on IP addresses.

A segmentation model where policy is written between security groups rather than subnets, so members can move locations and keep the same access rights automatically.

Identity Services Engine, the policy platform that authenticates users and devices via 802.1X, MAC authentication bypass, or profiling, and returns authorization results such as VLAN or SGT.

An IEEE port-based access control standard where a supplicant authenticates through an authenticator switch to an authentication server before the port grants network access.

MAC Authentication Bypass, a fallback method that sends a device's MAC address to the authentication server as both username and password when no 802.1X supplicant exists.

The process of identifying endpoint type and operating system from DHCP, CDP, LLDP, or HTTP attributes so ISE can apply appropriate authorization policy to unmanaged devices.

The centralized Cisco SD-WAN controller interface for onboarding devices, defining templates and policies, and monitoring the overlay fabric from a single management plane.

The Cisco SD-WAN control protocol that distributes routes, TLOCs, and policies between controllers and edge routers over DTLS or TLS tunnels.

Transport Locator, an address and color pair identifying a WAN interface on a Cisco SD-WAN edge, used by OMP to advertise reachability and steer traffic per transport.

A Cisco SD-WAN policy that continuously measures latency, loss, and jitter per path and reroutes selected application traffic to the best available transport.

Bidirectional Forwarding Detection, a lightweight hello protocol that detects path failures in milliseconds and feeds SD-WAN SLA measurements used for path selection.

A reusable configuration blueprint in Cisco SD-WAN Manager that pushes feature templates and variables to edge devices, keeping deployments consistent and repeatable.

A newer Cisco SD-WAN Manager construct that bundles device settings and policies into a hierarchy applied by device role, replacing many per-device templates.

The cloud management console for Cisco Meraki products, providing zero-touch provisioning, live monitoring, and centralized configuration for wireless, switching, and security appliances.

A Meraki feature that automatically builds encrypted site-to-site tunnels between MX security appliances, with the dashboard handling key exchange and route advertisement.

A deployment method where a new device contacts a cloud service on first boot, authenticates, and downloads its configuration without an engineer on site.

Cisco's cloud onboarding service that maps device serial numbers to configurations so routers and switches can be claimed and provisioned automatically at any location.

A Cisco internet and cloud intelligence platform using agents and vantage points to measure path performance and digital experience from user locations to applications and SaaS.

The practice of measuring application and network performance as experienced by end users, combining endpoint, synthetic, and path telemetry to locate degradation.

A Cisco service that consumes SD-WAN telemetry to detect anomalies, forecast bandwidth needs, and recommend policy or capacity changes for the overlay.

Streaming or periodic export of device and flow metrics to a collector or cloud service, enabling monitoring and analytics without polling each device individually.

An XML-based network management protocol that uses YANG models to read and edit device configuration over a secure session, common in programmatic automation.

A HTTP-based protocol exposing YANG-modeled data as REST resources, letting scripts and applications retrieve or modify device configuration with standard web methods.

A data modeling language that defines the structure and constraints of configuration and state data for network devices, consumed by NETCONF, RESTCONF, and automation tooling.

A push-based monitoring approach where devices stream YANG-modeled operational data to collectors on a schedule or event trigger, replacing frequent SNMP polling.

A REST interface on Catalyst Center that lets scripts query inventory, run compliance, deploy templates, and pull assurance data programmatically for automation workflows.

A suite of protocols that authenticates and encrypts IP packets, commonly used for site-to-site VPNs with IKE key negotiation and ESP encapsulation.

Secure Access Service Edge, a cloud-delivered model converging WAN connectivity with security services such as secure web gateway, CASB, and zero trust enforcement near users.

Security Service Edge, the security-focused subset of SASE covering secure web gateway, cloud access security broker, and zero trust network access delivered from cloud points of presence.

Zero Trust Network Access, a service that grants users access to specific applications after identity and device checks, rather than placing them on a flat corporate network.