JNCDS-SEC study plan
JNCDS-SEC · Give each week a clear focus.
8 weeks · About 7 hours per week
Customer Network Design Requirements & Campus and Branch LAN Design
Break down a hypothetical multi-site customer brief into business drivers, technical requirements, and constraints, then classify each item as functional, non-functional, or assumption
Derive a campus LAN topology (two-tier versus three-tier, collapsed core, or routed access) from stated user counts, traffic patterns, and redundancy targets
Calculate east-west and north-south bandwidth needs for a given access/aggregation/distribution model and justify oversubscription ratios
Draft a requirements traceability table that maps each customer requirement to a design decision and a validation test
Your checkpoint
A 2-3 page design rationale document for one fictitious customer covering requirements classification, chosen campus topology with a diagram description in text, and a traceability table with at least 12 mapped requirements
Securing the Network & Customer Network Design Requirements
Translate customer security policy statements into enforceable segmentation zones (users, guests, IoT, management, DMZ) and define inter-zone policy intent
Select and position security controls (stateful firewalls, NGFW, IDS/IPS, NAC, secure access) along the traffic path for a campus and branch scenario
Design a guest and BYOD onboarding flow that separates authentication, authorization, and accounting decisions
Identify where encryption (MACsec, IPsec, TLS inspection) is required versus optional and state the operational trade-off for each
Your checkpoint
A zone-and-policy matrix listing at least 8 zones, permitted and denied flows, the enforcing device at each boundary, and the log source for each decision
Securing the Network & Network Management or Reliability
Design a management-plane protection scheme covering out-of-band access, AAA with TACL, role-based privilege levels, and protocol hardening
Choose logging, flow telemetry, and time-synchronization architecture that supports incident reconstruction across campus, WAN, and data center
Define a control-plane protection baseline (CoPP, control-plane policing, routing protocol authentication) for the campus and WAN edge
Map at least six threats (spoofing, VLAN hopping, DHCP starvation, ARP poisoning, rogue AP, lateral movement) to a specific mitigation and detection signal
Your checkpoint
A security baseline checklist with 15 or more configuration-level controls, each tied to the threat it mitigates and the monitoring signal that proves it is working
Network Management or Reliability & Campus and Branch WAN Design
Compare WAN transport options (dedicated internet, broadband, MPLS, SD-WAN overlay, 5G/LTE failover) against cost, SLA, and application requirements for a branch profile
Design a resilient WAN edge with dual transport, path selection policy, and defined failover behavior including voice and real-time traffic treatment
Specify QoS classification, marking, queuing, and shaping across the WAN under constrained bandwidth
Define reachability, latency, and jitter thresholds that trigger a failover and how to verify them with probes
Your checkpoint
A branch WAN design sheet for three branch tiers (small, medium, large) with transport mix, bandwidth sizing, failover policy, QoS model, and the measurable SLA targets per tier
Campus and Branch LAN Design & Network Management or Reliability
Design a branch LAN with local switching, Power over Ethernet budgeting, and survivable local services when the WAN is down
Plan a routing and segmentation scheme (VRF, SVI, or routed subnets) that scales to at least 50 branches without renumbering
Define a high-availability approach for campus (stacking, vPC/MC-LAG, first-hop redundancy) and state the failure domain of each option
Specify an automated configuration and image management approach for branch devices including rollback and compliance validation
Your checkpoint
A branch reference architecture with addressing plan, HA choice with failure-domain analysis, PoE and power budget, and a device onboarding/rollback procedure of at least 10 steps
Data Center Network Design & Securing the Network
Select a data center topology (spine-leaf, VXLAN/EVPN overlay, traditional three-tier) based on workload, scale, and operational maturity
Size and place data center security controls including firewall insertion, micro-segmentation, and east-west inspection without creating hairpinning
Design multi-tenancy and workload isolation using VRFs, overlay segments, and policy enforcement points
Plan data center resilience (redundant supervisors, MLAG, fabric underlay redundancy) and state convergence expectations
Your checkpoint
A data center design brief with a text-described fabric topology, overlay design, security insertion points, and a table of at least 6 failure scenarios with expected convergence behavior
Customer Network Design Requirements & Data Center Network Design & Campus and Branch WAN Design
Reconcile competing requirements across campus, WAN, and data center into one coherent end-to-end design with consistent addressing and policy
Produce a bill of materials rationale and capacity plan that traces each component to a requirement
Identify design risks and document them with likelihood, impact, and a mitigation or acceptance decision
Write the validation plan that proves the design meets each requirement, including test cases and pass criteria
Your checkpoint
An end-to-end design review package: one-page architecture summary, BOM rationale, risk register with at least 8 entries, and a validation plan with at least 15 test cases and pass criteria
Customer Network Design Requirements & Securing the Network & Network Management or Reliability & Campus and Branch LAN Design & Campus and Branch WAN Design & Data Center Network Design
Rehearse explaining design trade-offs out loud for each domain within a two-minute limit per decision
Audit the full design package for internal contradictions in addressing, policy, and redundancy claims
Close knowledge gaps by re-deriving the three weakest design decisions from first principles without notes
Finalize a one-page decision summary that a customer stakeholder could approve
Your checkpoint
A corrected final design package plus a one-page executive decision summary and a self-scored readiness sheet listing residual weak areas and the specific remediation for each
Milestones
Week 2: Can classify any customer requirement statement as functional, non-functional, or assumption, and justify a campus topology choice with bandwidth math in under 10 minutes without notes
Week 4: Can draw the zone-and-policy matrix from memory and defend every permit rule with a named business or security driver
Week 6: Can compare three WAN transport mixes and three data center topologies on cost, SLA, failure domain, and operational effort, and pick one for a stated scenario with reasons
Week 8: Final package passes a self-run contradiction audit with zero unresolved conflicts, and every one of the six domains has at least one documented design decision with a stated trade-off