Cisco ENCOR 350-401 study plan
Cisco ENCOR 350-401 · Give each week a clear focus.
8 weeks · About 6 hours per week
Infrastructure
Diagram the packet flow for control-plane policing, data-plane forwarding, and management-plane access on a single topology
Configure and verify OSPFv2 multi-area adjacencies, including virtual links and summarization
Compare EIGRP and OSPF metric calculation and path selection using show commands and debug output
Build a lab that demonstrates Cisco Express Forwarding adjacency and FIB versus RIB entries
Your checkpoint
A one-page topology diagram with annotated packet flows and a lab workbook containing verified show command output for OSPFv2 and EIGRP
Infrastructure
Configure and verify BGP neighbor relationships, route reflectors, and prefix filtering
Explain and demonstrate BGP best-path selection using at least five attributes in a lab
Configure first-hop redundancy protocols (HSRP, VRRP, GLBP) and verify failover behavior
Implement and verify policy-based routing and VRF-lite in a multi-tenant lab
Your checkpoint
A BGP lab report showing best-path decisions before and after attribute manipulation, plus a working VRF-lite configuration
Infrastructure
Configure and verify Layer 2 trunking, EtherChannel, and Spanning Tree Protocol variants
Implement VLAN access control lists and private VLANs in a lab
Configure and verify multicast routing using PIM Sparse Mode and IGMP
Troubleshoot a broken Layer 2 topology using only show and debug commands
Your checkpoint
A troubleshooting log documenting at least five injected Layer 2 faults with root cause and fix for each
Security
Configure and verify AAA with TACACS+ and RADIUS for device administration
Implement 802.1X port-based authentication with a RADIUS server in a lab
Configure and verify IPsec site-to-site VPN with IKEv2 and pre-shared keys
Explain and apply control-plane protection features such as CoPP and CPU thresholding
Your checkpoint
A security lab report with working 802.1X and IPsec configurations plus captured authentication and encryption logs
Security & Architecture
Configure and verify zone-based firewall policies and inspect traffic between zones
Compare and contrast MACsec, TrustSec, and CoPP as defense-in-depth mechanisms
Design a campus network using a hierarchical model and document redundancy at each layer
Explain the role of SD-WAN and SD-Access controllers in the architecture
Your checkpoint
A security architecture brief that maps each security control to a campus layer and includes a zone-based firewall configuration
Virtualization & Network Assurance
Configure and verify GRE tunnels and IPsec VTI tunnels in a lab
Implement VXLAN with an underlay and demonstrate Layer 2 extension across a Layer 3 boundary
Configure and verify LISP and VXLAN EVPN control-plane concepts
Use NETCONF and RESTCONF to retrieve device configuration and operational data
Apply model-driven telemetry and SNMP polling to collect interface statistics
Your checkpoint
A virtualization lab report with a working VXLAN tunnel and a telemetry dashboard showing at least three interface metrics
Automation
Write Python scripts using the requests library to interact with RESTCONF and NETCONF endpoints
Build and apply Jinja2 templates to generate device configurations
Compare Ansible, Puppet, and Chef for network automation and demonstrate an Ansible playbook
Explain CI/CD pipeline concepts and version control for network configurations
Your checkpoint
A GitHub repository containing a Python script, a Jinja2 template, and an Ansible playbook that configures a VLAN across two devices
Architecture & Virtualization & Infrastructure & Network Assurance & Security & Automation
Complete a full-length practice exam under timed conditions and score each domain
Review every missed question and map it to a domain objective
Reconfigure two weak areas from memory without notes
Summarize key command syntax and architectural concepts in a personal cheat sheet
Your checkpoint
A scored practice exam report with a remediation plan listing three specific actions for exam week
Milestones
Week 2: Can configure and verify OSPF, EIGRP, and BGP in a lab without reference material, and explain best-path selection for at least five attributes
Week 4: Can deploy 802.1X and an IPsec site-to-site VPN from scratch and verify authentication and encryption using show and debug commands
Week 6: Can build a VXLAN tunnel over a Layer 3 underlay and retrieve interface statistics using NETCONF or RESTCONF
Week 8: Scores at least 80% on a timed full-length practice exam with no domain below 70%