The CCIE Enterprise Infrastructure qualifying core is ENCOR 350-401 v1.2. Passing it earns the Enterprise Core Specialist credential and qualifies you for the separate lab step. This guide covers core preparation, the current six-domain blueprint and a worked forwarding decision.
How the two-step certification path works
Cisco grants the CCIE Enterprise Infrastructure certification only after both a core written exam and a hands-on lab exam. The core exam is 350-401 ENCOR, and passing it also earns a standalone specialist certification.
Passing ENCOR earns the Cisco Certified Specialist – Enterprise Core credential. CCIE Enterprise Infrastructure additionally requires its practical lab; the current lab version is v1.1, lasts eight hours and is listed at US$1,600.
The core and lab have separate topic documents and version numbers. Core preparation does not establish readiness for the entire practical assessment.
Official sources: CCIE Enterprise Infrastructure - Cisco — official certification page, core exam and lab exam sections
Core exam format and logistics
Cisco lists a 120-minute core exam at US$400, offered in English and Japanese.
Confirm booking currency, applicable charges and appointment requirements. Cisco lists no formal prerequisite for the core, but that does not establish that a beginner has the knowledge needed.
The core pass is valid for three years. Check qualification windows separately from recertifying an existing credential; this guide does not establish that Continuing Education extends an exam-pass window.
Official sources: CCIE Enterprise Infrastructure - Cisco — official certification page, core exam and lab exam sections
What the ENCOR v1.2 blueprint covers
The core uses the ENCOR blueprint: six domains covering enterprise networking, assurance, security and automation.
Use the weights below to check breadth, then follow the required objective verbs. Infrastructure’s 30% includes Layer 2, Layer 3 and IP services; it is not a 30% allocation to routing alone.
| Testing area | Weight | Representative objectives |
|---|---|---|
| Architecture | 15% | Enterprise design models (2-tier, 3-tier, fabric, cloud); high availability such as redundancy, FHRP, and SSO; Cisco Catalyst SD-WAN and SD-Access working principles; interpreting QoS configurations |
| Virtualization | 10% | Hypervisor types 1 and 2, virtual machines, virtual switching; configuring and verifying VRF, GRE, and IPsec tunneling; LISP and VXLAN concepts |
| Infrastructure | 30% | Layer 2: 802.1q trunking, EtherChannels, RSTP/MST, root guard and BPDU guard. Layer 3: EIGRP vs OSPF concepts, OSPFv2/v3, eBGP, policy-based routing. IP services: NTP/PTP, NAT/PAT, HSRP/VRRP, multicast |
| Network Assurance | 10% | Diagnosing with debugs, conditional debugs, traceroute, ping, SNMP, syslog; Flexible NetFlow; SPAN/RSPAN/ERSPAN; IPSLA; Cisco Catalyst Center workflows; NETCONF and RESTCONF |
| Security | 20% | Device access control (lines, local users, AAA); ACLs and CoPP; REST API security; security design components such as threat defense, endpoint security, next-generation firewall, TrustSec, and MACsec |
| Automation and Artificial Intelligence | 15% | Python components and scripts; valid JSON; YANG data modeling; APIs for Cisco Catalyst Center and SD-WAN Manager; REST API response codes; EEM applets; agent vs. agentless orchestration tools |
Official sources: Implementing Cisco Enterprise Network Core Technologies v1.2 (350-401) Exam Topics — official exam topics PDF, pages 1–3
What changed in version 1.2
Cisco's release notes list a minor update effective March 19, 2026: wireless topics were removed from 350-401 and several product names were renamed across the blueprint.
ENCOR v1.2 took effect on March 19, 2026. Use its current objectives when mapping older notes, including the removal of the earlier wireless topics. A current core-version update does not by itself change the lab version.
Update older terminology to current names such as Catalyst SD-WAN, Catalyst Center, SD-WAN Validator, SD-WAN Manager and SD-WAN Controller. Use the current objective list to decide whether a particular older chapter remains relevant.
Official sources: CCNP Enterprise v1.1 and v1.2 Release Notes — 350-401 minor update section, effective March 19, 2026
Worked example: route installation versus packet forwarding
For normal destination-based forwarding, choose the longest matching installed prefix. Administrative distance does not override that forwarding choice.
Cisco’s route-selection document distinguishes installation from forwarding. Different prefixes can coexist; administrative distance helps select among eligible sources for the identical destination prefix. The exercise assumes the entries have already been installed.
Worked example
Use ordinary IPv4 destination-based forwarding in one routing table, with no policy-based routing. These are the only installed destination entries relevant to the packets; every next hop and forwarding adjacency is reachable and resolved. Entry A: internal EIGRP 10.40.16.0/20 via 10.1.1.2. Entry B: OSPF 10.40.16.0/24 via 10.1.1.3. Entry C: static 10.40.0.0/16 via 10.1.1.4. (a) Which next hop is selected for 10.40.16.77? (b) Which is selected for 10.40.20.5? (c) Does the static source’s lower default administrative distance make it the forwarding choice?
Show answer
(a) 10.1.1.3 through the /24. (b) 10.1.1.2 through the /20. (c) No. Among the installed matches, the more specific prefix wins.
The /16 spans 10.40.0.0–10.40.255.255, the /20 spans 10.40.16.0–10.40.31.255 and the /24 spans 10.40.16.0–10.40.16.255. The first address matches all three, so /24 wins. The second matches /16 and /20, so /20 wins. Administrative distance is relevant when choosing among eligible routing sources for an identical prefix during installation; these already-installed entries are different prefixes. Their route-source labels do not replace longest-prefix matching in this exercise.
Official sources: Implementing Cisco Enterprise Network Core Technologies v1.2 (350-401) Exam Topics — official exam topics PDF, pages 1–3; Configure Route Selection for Routers - Cisco — technical support document, route installation and forwarding sections
Preparation priorities by testing area
Use the weights, objective verbs and your own gaps to allocate study time.
For explain or describe tasks, practise giving a clear account of the mechanism and its limits. For configure-and-verify or troubleshoot tasks, use your own lab and compare observed behavior with a stated expectation.
Include Layer 2, routing, IP services, virtualization, assurance, security and automation. Do not postpone a weak domain simply because it has a smaller weight.
Review mixed practice errors against the specific objectives. The current Network Assurance area includes traditional and AI-powered Catalyst Center workflows; Automation and AI includes Python, JSON, YANG, APIs, EEM and orchestration. Use the actual task list to decide the required depth.
Official sources: Implementing Cisco Enterprise Network Core Technologies v1.2 (350-401) Exam Topics — official exam topics PDF, pages 1–3
Next steps and official documents
Confirm the current core topics and appointment details, then plan the lab as a separate preparation stage.
Use Cisco’s CCIE Enterprise Infrastructure page to check the qualifying path and current lab equipment/software list. Track your pass date alongside the requirements for the next assessment.
Official sources: CCIE Enterprise Infrastructure - Cisco — official certification page, core exam and lab exam sections
Official sources
Facts checked against official Cisco documents: