CNPE study plan

CNPE · Give each week a clear focus.

8 weeks · About 7 hours per week

Week 1

Network Architecture and Design & Routing and Switching

Diagram a three-tier campus and a collapsed-core design from memory, labeling every device role and failure domain
Calculate VLSM subnets for a /22 allocation and document the address plan in a table
Configure VLANs, 802.1Q trunks, and Rapid PVST+ on a four-switch lab and verify loop-free convergence
Explain when to choose routed access versus spanning-tree access, with two trade-offs each

A one-page design brief with topology diagram, IP addressing table, and a written justification for the L2/L3 boundary placement

Week 2

Configure and verify OSPFv2 multi-area adjacencies, including ABR and stub-area behavior
Tune EIGRP metrics and verify feasible-successor selection using show commands
Configure eBGP between two autonomous systems and manipulate path selection with local preference and AS-path prepending
Troubleshoot a deliberately broken redistribution point between OSPF and EIGRP

A routing lab workbook with captured verification output for each protocol plus a root-cause writeup for the redistribution fault

Week 3

Compare HSRP, VRRP, and GLBP across failover behavior, preemption, and load sharing, and pick one for a stated requirement
Build an access-control policy that enforces least privilege across a DMZ and an internal server segment
Configure zone-based firewall inspection and verify stateful return traffic
Explain how a first-hop redundancy gateway interacts with a stateful firewall during failover

A security-and-resilience configuration package with FHRP configs, ACL tables, and a failover test log

Week 4

Configure 802.1X with a RADIUS server and test authentication, authorization, and failure fallback
Design a segmentation scheme using VLANs, VRFs, or microsegmentation and defend the choice
Identify and mitigate common Layer 2 attacks: DHCP snooping, dynamic ARP inspection, and port security
Describe how to detect and respond to a compromised endpoint using flow data and logs

A segmentation and access-control design document with a table mapping each user or device class to its permitted zones and enforcement point

Week 5

Build a structured troubleshooting method and apply it to three injected faults using layered verification
Capture and interpret packet flows to isolate a performance problem between two sites
Compare MPLS L3VPN, dedicated internet with IPsec, and SD-WAN overlay for a branch of 50 users
Configure a site-to-site IPsec tunnel with IKEv2 and verify Phase 1 and Phase 2 establishment

A troubleshooting runbook with three case studies: symptom, evidence gathered, root cause, and fix

Week 6

Map a cloud VPC or VNet design including subnets, route tables, and connectivity back to on-premises
Explain the shared responsibility model for a hybrid workload and list the network controls you own
Use a model-driven interface to retrieve device configuration and state programmatically
Write an idempotent script that pushes a VLAN change to multiple devices and validates the result

A working automation script in a repository with a README explaining intent, inputs, and rollback

Week 7

Compare REST API, NETCONF, and gNMI across transport, encoding, and typical use cases
Design a wireless deployment covering channel plan, power settings, and roaming for a dense office floor
Troubleshoot a client connectivity issue using association, authentication, and roaming evidence
Explain how a controller-based wireless architecture differs operationally from autonomous APs

A wireless site plan with channel and power table plus an API-driven configuration template for the access layer

Week 8

Draft a change-management record for a production cutover including rollback criteria and approval path
Map a regulatory or contractual obligation to the specific technical control that satisfies it
Review the full blueprint and rate confidence per domain, then target the two weakest areas
Complete a timed mixed-domain practice set and analyze every miss by root cause

A final readiness report with per-domain confidence scores, a remediation list, and one complete change record

Week 2: Can design and verify a multi-area OSPF plus eBGP topology without notes, and explain path selection decisions out loud

Week 4: Can justify every segmentation boundary in the design and demonstrate a working 802.1X authentication with fallback

Week 6: Can describe an end-to-end path from branch to cloud and show a script that configures devices reproducibly

Week 8: Scores at or above 80 percent on a timed mixed-domain set and has a written remediation plan for remaining gaps