CCDE study guide
CCDE · Work through your exam, one topic at a time.
The Cisco Certified Design Expert (CCDE) is an advanced certification for network architects who design large-scale, complex networks. Unlike exams that test configuration, the CCDE focuses on requirements analysis, technology selection, and design trade-offs across enterprise, service provider, data center, and security domains. The CCDE study guide has 8 sections and about 3,947 words.
01Network Design Fundamentals and Business Alignment
This domain tests whether you can convert a business outcome into a defensible technical design: eliciting requirements, quantifying them, and proving the design satisfies them at an acceptable cost. A business driver states an outcome ("order capture must survive the loss of a data center").
485 words, about 2 min02Enterprise LAN and Campus Design
This domain examines campus topology, the Layer 2/Layer 3 boundary, loop prevention, first-hop redundancy, wired/wireless convergence and edge security - and the trade-offs between them. The central campus decision is how far VLANs stretch.
499 words, about 2 min03Enterprise WAN and Service Provider Edge Design
This domain covers WAN service selection, provider edge interaction, enterprise BGP edge policy, overlay designs, and the operational realities of hybrid WAN. Compare Internet DIA, MPLS Layer 3 VPN, Carrier Ethernet (E-Line, E-LAN, E-Tree), broadband, and LTE/5G backup on: SLA and jitter guarantees, any-to-any vs point-to-point, QoS treatment, cost per Mbps at each site, lead time, and encryption requirements.
496 words, about 2 min04Data Center and Cloud Connectivity Design
This domain covers fabric topology and oversubscription, overlay control planes, storage transport, hybrid cloud attachment, and the cost and failure models unique to each. A Clos fabric connects every leaf to every spine with ECMP and no spanning tree.
498 words, about 2 min05Routing Protocol Design and Policy
This domain tests IGP area and hierarchy design, BGP policy and scaling, redistribution control, and convergence engineering. OSPF scales through areas: area 0 as backbone, ABRs between areas, and stub, totally stubby, NSSA or totally NSSA at the edge to suppress external or summary flooding.
511 words, about 3 min06Network Security Design
This domain covers segmentation and zoning, enforcement point placement, identity-based access control, and control/management plane protection. Define zones by trust and function rather than by convenience: untrusted Internet, DMZ for externally reachable services, internal user tiers, data/PCI scope, management, and IoT/OT.
471 words, about 2 min07Network Services, QoS, and Multicast Design
This domain covers service infrastructure (DHCP, DNS, NTP, IPAM), end-to-end QoS design across LAN and WAN, and multicast distribution design. DiffServ scales because classification and marking happen once, near the source, and each hop applies per-hop behavior to a small set of classes.
493 words, about 2 min08Network Automation, Programmability, and Operability
This domain covers the programmability stack, infrastructure-as-code workflows, telemetry-based operations, and designing for change safety. SNMP polling and traps remain for legacy OIDs and thresholds, but scale poorly: N devices × M OIDs × polling interval grows linearly and consumes device CPU.
494 words, about 2 min