Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about Cisco's professional-level enterprise networking certification as of 2026: the 350-401 ENCOR v1.2 core exam and its six domains, the six concentration exams, cost, career paths, DoD 8140 status, and how CCNP Enterprise compares to CCNA, CCNP Security and CCIE. A complete reference for anyone deciding on the professional tier or working out what it actually covers.
CCNP Enterprise is Cisco's professional-level certification for the people who design, run and troubleshoot enterprise networks. It sits one tier above CCNA and one below CCIE.
You earn it by passing two exams. The first is the 350-401 ENCOR core exam, Implementing Cisco Enterprise Network Core Technologies, which tests architecture, virtualization, infrastructure, network assurance, security, and automation and AI. The second is a concentration exam of your choice from six options covering advanced routing, SD-WAN, design, automation, secure cloud connectivity and network assurance. There are no formal prerequisites, and the credential is valid for three years.
The exam this page describes is ENCOR v1.2, effective March 19, 2026. That refresh removed all wireless content from the core exam and expanded automation and programmability, SD-WAN, Zero Trust security concepts and AI-assisted network management. The credential is vendor-specific and professional-level and issued by Cisco. Cisco credentials appear on the DoD 8140 Approved Qualifications Matrix for some work roles; check the current matrix on the DoD Cyber Exchange for CCNP Enterprise.
One more thing the core exam does for you: passing ENCOR also satisfies the qualifying exam for the CCIE Enterprise Infrastructure and CCIE Enterprise Wireless labs. The same pass that starts your CCNP opens the door to the expert tier, which is why many engineers treat ENCOR as the single most valuable Cisco exam to prepare for. Read what changed in v1.2 before you pick study materials.
Enterprise design, high availability, WAN and SD-WAN, SD-Access, QoS. 15%.
Device virtualization, VRF, GRE and IPsec, LISP and VXLAN concepts. 10%.
Layer 2, OSPF, EIGRP and BGP, IP services, multicast. The heaviest at 30%.
Debugs, SNMP, syslog, NetFlow, IP SLA, Catalyst Center workflows. 10%.
Device and infrastructure security, threat defense, TrustSec, MACsec, 802.1X. 20%.
Python, JSON, YANG, NETCONF and RESTCONF, APIs, Ansible, Terraform, AI ops. 15%.
Four things that make it the credential hiring managers look for above CCNA.
Cisco gear runs a large share of the world's enterprise campuses and WANs, and CCNP Enterprise is the credential those employers name when they want someone who can own the routing, switching and services layer rather than just operate it. It signals depth, not familiarity.
One core exam, then a concentration that matches your job: advanced routing, SD-WAN, design, automation, secure cloud connectivity or network assurance. Two people can both hold CCNP Enterprise and have proven quite different specialties.
ENCOR v1.2 dropped wireless from the core and added weight to automation, SD-WAN, Zero Trust and AI-assisted operations. The exam now tests scenario-based problem solving more than command recall, which is closer to the actual job.
Cisco credentials appear on the Approved Qualifications Matrix that supports DoD Manual 8140.03 for some DoD Cyber Workforce Framework (DCWF) work roles. The matrix maps each credential to specific work roles and proficiency levels, and those mappings shift between matrix versions, so this page makes no claim about CCNP Enterprise either way.
Service members, DoD civilians and contractors in network-coded positions should check the current matrix for CCNP Enterprise before relying on it. The matrices are published at the DoD Cyber Exchange.
The certification, the 350-401 ENCOR core exam, and how to keep CCNP Enterprise current as of 2026.
The professional tier is where many careers settle, but it is also the launch point for the expert level. Your ENCOR pass already counts toward two of the CCIE labs.
The expert credential for enterprise routing and switching. ENCOR is the qualifying exam, so the remaining step is the eight-hour hands-on lab. The long-term goal for many network engineers.
Wireless left the ENCOR blueprint, but ENCOR still serves as the qualifying exam for the CCIE Enterprise Wireless lab. A path for engineers whose career is heading toward large-scale wireless design and operations.
The sideways move. Built around the 350-701 SCOR core exam plus a concentration, it suits engineers whose enterprise work keeps pulling them toward firewalls, identity and network defense.
CCNP Enterprise is the middle rung of the Cisco ladder. It builds on CCNA-level fundamentals, branches into a concentration that matches your work, and leads to the CCIE labs or a security specialization.
Build the baseline
Core plus concentration
Pick your path
Two things to settle before you commit: how ready you are to sit ENCOR, and whether CCNP Enterprise is the right credential for where your work is heading. Here is a straight answer to both.
You can start on ENCOR directly.
Cisco sets no formal prerequisites. If you already configure OSPF, VLANs and trunks, and IP services on Cisco gear, or have done so on the job for a few years, you are ready to start ENCOR prep now. The free ENCOR practice test is a quick way to see which domains need the most work before you build a study plan.
Get to CCNA level first.
Nothing stops you from registering for ENCOR, but it assumes the associate-level material and moves fast past it. If subnetting, spanning tree and single-area OSPF still feel new, earning CCNA first, or at least working through its material with a lab, will make the professional exam far less painful.
CCNP Enterprise is the Cisco credential most often named in postings for mid-level and senior enterprise networking roles. The concentration you choose shapes which of these it points toward.
Owns routing, switching and WAN connectivity for an enterprise: designing changes, implementing them on Cisco gear, and troubleshooting the multi-protocol problems that a first-tier team escalates. The role CCNP Enterprise is most often listed for.
Leads the technical direction of a network team, reviews designs, and handles the hardest outages. CCNP Enterprise is a common hiring bar for senior titles because it proves depth across OSPF, EIGRP, BGP and the services layered on top of them.
Plans campus, data center edge and WAN designs before anyone touches a console. The Architecture domain of ENCOR and the ENSLD design concentration map directly to this work, and the credential is a frequent stepping stone toward it.
Deploys and operates Cisco Catalyst SD-WAN across branch, data center and cloud connections. ENCOR covers the SD-WAN architecture, and the ENSDWI concentration goes deep on deployment, policy and troubleshooting.
Replaces repetitive configuration work with Python, Ansible and Terraform, and integrates network APIs into wider IT workflows. The expanded Automation and Artificial Intelligence domain, plus the ENAUTO concentration, targets exactly this role.
Runs the operations side: monitoring, assurance, incident response and change control across an enterprise estate. The Network Assurance domain, and the ENNA concentration for those who want it, cover the tooling this role lives in.
CCNA sits below CCNP Enterprise as the associate tier, CCNP Security is the parallel professional track for network defense, and CCIE Enterprise Infrastructure is the expert level above. Here is how the four line up.
| CCNP Enterprise | CCNA | CCNP Security | CCIE Enterprise Infrastructure | |
|---|---|---|---|---|
| Issuer | Cisco | Cisco | Cisco | Cisco |
| Level | Professional | Associate | Professional | Expert |
| Focus | Enterprise routing, switching, SD-WAN, assurance, security, automation | Networking fundamentals on Cisco gear | Network security, firewalls, identity, threat defense | Expert-level enterprise infrastructure, hands-on |
| Exams | 350-401 ENCOR (120 min) plus one concentration | 200-301, one exam (120 min) | 350-701 SCOR plus one concentration | ENCOR plus an 8-hour lab |
| Core Exam Cost | $400 USD (ENCOR) | ~$300 USD | See Cisco | See Cisco |
| Prerequisites | None | None | See Cisco | ENCOR pass before the lab |
| Recertification | 3 years (exams or CE credits) | 3 years (exam or 30 CE credits) | See Cisco | See Cisco recertification policy |
| DoD 8140 Approved | Check current matrix | Yes (Advanced, DCWF 441) | Yes | Check current matrix |
| Best For | Mid-level and senior enterprise network engineers | Entry and junior networking roles | Network security engineers | Senior engineers aiming for the expert tier |
Exam and recertification details vary by region and version; concentration exam pricing is set separately by Cisco. Many engineers hold more than one of these over a career.
Our ten-day Cisco CCNP Enterprise boot camp covers the 350-401 ENCOR core exam and the 300-410 ENARSI concentration, with hands-on labs, exam vouchers and a free retake included, so you can sit both exams within two weeks of starting.
What changed in ENCOR v1.2, where Cisco credentials sit for DoD 8140, and how to read certification salary numbers.
ENCOR moved from v1.1 to v1.2 on March 19, 2026. Wireless left the core exam for a new track, and automation, SD-WAN, zero trust and AI-assisted operations took on more weight. What that means for your study plan.
The skills employers now expect from Cisco-certified engineers beyond command-line fluency, from automation and cloud connectivity to security awareness, and how the certification path lines up with them.
A work-role-by-work-role map of the DoD 8140 Approved Qualifications Matrix, including where the Cisco credentials sit for network-coded positions and how to read the proficiency levels.
A sober look at certification salary surveys: where the numbers come from, why they are usually inflated by the people who answer them, and how to read them when weighing a professional-level credential.
The story of the step before CCNP: how one student went from retail tech work to a network engineering job through the CCNA, and why the fundamentals it builds carry straight into ENCOR.
If you are not yet at CCNA level, this is the place to start. How an immersive Cisco boot camp actually runs, who it suits, and how to prepare so the week sets you up for the professional tier later.
For experienced IT generalists thinking about specializing, a look at the paths that reward deep technical credentials, including enterprise networking, and how to plan the move without starting over.
The 350-401 ENCOR v1.2 exam is organized into six domains, each carrying its own weight. Click any domain for what it tests. Your concentration exam has its own separate blueprint.
How enterprise networks are designed: campus and WAN design principles, high availability, SD-WAN and SD-Access, and quality of service. It also covers the difference between hardware and software switching paths and why that matters for performance.
Device virtualization and the ways one physical network carries many logical ones, including VRF instances, GRE and IPsec tunnels, and data path virtualization. LISP and VXLAN appear at the concept level as the building blocks behind SD-Access fabrics.
The largest domain and the heart of the exam: Layer 2 trunking, EtherChannel and spanning tree, then Layer 3 routing with OSPF, EIGRP and BGP concepts. IP services such as NTP, NAT, HSRP and VRRP and multicast round it out, and this is where most of the configuration and troubleshooting items land.
How you know the network is healthy: diagnostics and debugs, SNMP, syslog, NetFlow and Flexible NetFlow, and IP SLA. It also covers the monitoring and troubleshooting workflows in Cisco Catalyst Center (formerly DNA Center).
Securing the devices and the network they form: device access control, infrastructure security, and REST API security. Network security design covers threat defense, endpoint security, next-generation firewalls, TrustSec and MACsec, plus network access control with 802.1X, MAB and WebAuth.
Python scripting basics, JSON, YANG, and the NETCONF and RESTCONF protocols, along with the APIs exposed by Catalyst Center, vManage and IOS XE. EEM, orchestration tools such as Ansible and Terraform, and AI-assisted network operations complete the domain, which grew in the v1.2 refresh.
Domains and weights reflect the Cisco 350-401 ENCOR v1.2 exam topics, effective March 19, 2026. Cisco updates the blueprint on a periodic cycle. To see how these domains feel in question form, try the free ENCOR practice test.
The questions candidates ask most often when researching the Cisco Certified Network Professional Enterprise certification.
CCNP Enterprise is Cisco's professional-level certification for enterprise networking. You earn it by passing two exams: the 350-401 ENCOR core exam, which covers architecture, virtualization, infrastructure, network assurance, security, and automation and AI, plus one concentration exam of your choice from a list of six.
No. Cisco sets no formal prerequisites, so you don't need to hold CCNA first. In practice the ENCOR exam assumes you already know CCNA-level routing, switching and IP services, so most candidates either hold CCNA or work at that level before they start.
The 350-401 ENCOR core exam costs $400 USD, or the equivalent in Cisco Learning Credits, as of 2026. The concentration exam is priced separately, so check Cisco's exam page for the one you choose. Pricing can vary by region and tax, and boot camps often bundle the vouchers, so check what's included before paying separately.
ENCOR runs 120 minutes and is offered in English and Japanese. Cisco doesn't publish a question count. Expect multiple choice items alongside simulations where you configure or troubleshoot devices, and the v1.2 blueprint leans toward scenario-based problem solving rather than recalling command syntax.
Cisco doesn't publish a passing score for 350-401 ENCOR. Scoring is criterion-referenced against a fixed standard, and question difficulty can vary between candidates. Your score report shows how you did in each domain rather than giving a simple percentage.
The six ENCOR v1.2 domains are Architecture (15%), Virtualization (10%), Infrastructure (30%), Network Assurance (10%), Security (20%), and Automation and Artificial Intelligence (15%). Infrastructure, which covers Layer 2, routing protocols and IP services, carries the heaviest weight by a wide margin.
ENCOR v1.2 took effect March 19, 2026, and the last day to test on v1.1 was March 18, 2026. All wireless content was removed, including RF fundamentals, WLAN configuration, wireless security, Meraki and 802.11. Automation and programmability, SD-WAN architecture and deployment, Zero Trust security concepts, and AI-assisted network management were expanded. Core routing and switching, enterprise architecture, security fundamentals and infrastructure services stayed.
Pick the one closest to your job. The six options are 300-410 ENARSI (advanced routing and services), 300-415 ENSDWI (Catalyst SD-WAN), 300-420 ENSLD (enterprise network design), 300-435 ENAUTO (automation and programming), 300-440 ENCC (secure cloud connectivity), and 300-445 ENNA (network assurance). ENARSI is a common choice for engineers whose day is routing and troubleshooting.
CCNP Enterprise is valid for three years. To recertify you can pass qualifying Cisco exams or earn Cisco Continuing Education credits within the three-year cycle, and you can mix the two. Cisco's recertification policy page has the current options and credit requirements.
Cisco credentials appear on the DoD 8140 Approved Qualifications Matrix for some DCWF work roles, but the work roles and proficiency levels change between matrix versions. Check the current matrix on the DoD Cyber Exchange for CCNP Enterprise before relying on it for a coded position. See the full DoD 8140 work role paths.
CCNP Enterprise supports roles such as network engineer, senior network engineer, network architect, SD-WAN engineer, network automation engineer and network operations lead. It's the Cisco credential most often named in postings for mid-level and senior enterprise networking positions.
Yes. Passing 350-401 ENCOR also satisfies the qualifying exam requirement for the CCIE Enterprise Infrastructure and CCIE Enterprise Wireless lab exams. If you plan to pursue CCIE, the same ENCOR pass gets you both your CCNP core and your lab eligibility.
For engineers who work on enterprise networks, yes. It's the professional credential employers ask for by name above CCNA, and the v1.2 refresh added the automation, SD-WAN and AI-assisted operations content that current roles demand. It's less useful if your work has moved fully into cloud-native networking with little Cisco gear.
If you are weighing the certification, choosing a concentration, working out funding, or planning training for a team, tell us where you are and we'll help you map out the right path.