Ccnp Encor Exam Topics

What Actually Gets Asked on the ENCOR

The Cisco CCNP ENCOR exam covers a lot of ground across six domains, and most study guides gloss over how these topics intersect in real practice. I spent three weeks pulling my hair out over automation questions because everyone focused on the definitions instead of the workflow. The exam doesn't care if you can recite what REST API means. It wants to know whether you'd use push or pull when the network device can't sustain persistent connections. Let me break down the actual domains and what they mean for your study time. Architecture makes up about 10% of the exam. You need to understand data center concepts like vPC versus LACP port channels, but more importantly you should know when NOT to use them. I once designed a vPC pair across two Nexus switches and spent four hours troubleshooting because the peer link saturated during a Spanning Tree convergence event. The workaround was reducing the vPC keepalive interval and adding a dedicated management path for peer communication. Automation is the largest domain at 20%, and it's where most candidates fail. They memorize Python syntax but can't explain when to use REST versus gRPC. gRPC requires bidirectional streaming support on the device. Not all Cisco IOS-XE versions implement it correctly. I ran into this when testing telemetry collection on a ISR 4321. The gRPC stream dropped every 30 seconds because the IOS version had a known bug with dynamic port allocation. The workaround was falling back to gNMI over TLS on port 443 instead of trying to force gRPC.

The Automation Trap Most People Fall Into

Here's something counter-intuitive about configuration management: structured data like JSON or YAML is easier for humans to read, but machine-to-machine communication actually performs better with Protocol Buffers or CBOR. The exam loves to ask about schema-driven automation, but it rarely mentions that Cisco's own tools like Ansible modules for Nexus switches lag behind feature deployment by 6 to 12 months. When I tried automating SPANCOR exam-style scenarios with Cisco IOx, the container orchestration failed because the application couldn't bind to privileged ports without explicit capability flags. You should understand the difference between programmed automation and scripted automation. Programmed means you write Python code that queries the API. Scripted means you run pre-built modules from the Cisco DevNet sandbox. The exam asks about this distinction because it reveals whether you understand maintainability versus rapid deployment. Programmed automation usually takes 2 hours to set up but runs reliably for years. Scripted automation takes 15 minutes to deploy but breaks whenever the API version changes.

Infrastructure Deep Dive

Infrastructure makes up 25% of the exam. You need to know OSPF network types, but more importantly you should understand why OSPF on point-to-point links doesn't require DR/BDR election. I encountered this when troubleshooting a WAN link between two routers. The OSPF neighbor state was stuck in EXSTART because the MTU mismatch on the serial interface prevented database description packets from completing. The workaround was reducing the OSPF MTU to match the underlying WAN circuit instead of forcing the default 1500 byte value. Wireless networking is only 5% of the exam, but candidates spend weeks studying it because it's unfamiliar territory. You need to understand 802.11 frame types, but more importantly you should know why 802.11ac doesn't support simultaneous transmit and receive on the same channel. This is the fundamental limitation of half-duplex wireless communication. I designed a wireless deployment for a hospital where the RFID tracking systems interfered with the 5 GHz access points. The workaround was using dedicated 900 MHz IoT channels instead of trying to fit everything on the 2.4 GHz spectrum.

Virtualization and Security Realities

Virtualization covers 15% of the exam. You need to understand hypervisor types, but more importantly you should know why Type 1 hypervisors perform better for network function virtualization. Type 1 runs directly on the hardware without an operating system layer. I encountered this when migrating from VMware ESXi to KVM on Cisco UCS servers. The virtual switch configuration failed because the MAC address table entries didn't persist across host failover without explicit sticky MAC learning enabled on the vPC uplinks. Security is 20% of the exam. You need to know about ACLs and VPN types, but more importantly you should understand why IPsec with AES-256-GCM performs better than AES-256-CBC for modern SD-WAN deployments. GCM provides authenticated encryption in a single pass. I ran into performance issues when configuring DMVPN with Cisco IOS-XE 17.3. The mGRE interface caused routing loops because the spoke-to-spoke traffic wasn't being encrypted without explicit tunnel mode gre point-to-point configuration on each hub interface.

What the Exam Actually Tests

Let me be blunt about the downsides of current CCNP ENCOR preparation methods. Most bootcamps spend 80% of their time on troubleshooting scenarios because those make good classroom exercises. The actual exam tests 60% knowledge recall and 40% application. If you can't explain why BGP best path selection prefers highest local preference over shortest AS path, you'll fail the architecture questions. I recommend spending the first week memorizing all the default values: OSPF priority, EIGRP metric components, and BGP community attributes. The exam has a 3-minute per question average, which means you'll encounter 15 to 20 questions where you have no idea what the answer is. The trick is recognizing these questions early and flagging them for review. I developed a mental shortcut where I'd skip any question mentioning a technology I hadn't used in the past 12 months. This usually saved 15 minutes during the exam, giving me extra time for the automation scenarios that required actual calculation.

Practical Lab Recommendations

If you're planning to take the ENCOR exam, stop using the Cisco IOx developer sandbox. It's deprecated and doesn't reflect the current exam objectives. Instead, use the Cisco Enterprise Implementation Virtual Box with IOS-XE 17.6 or later. This gives you access to the latest DNA Center features and automation APIs that actually appear on the exam. I spent 40 hours running through the official curriculum and found that the hands-on labs covered 70% of the exam content. The remaining 30% comes from understanding how different technologies interact. You need to know how SD-Access fabric control plane works with the underlay routing protocol. I encountered this when troubleshooting a campus deployment where the BGP EVPN overlay couldn't establish neighbor relationships with the border nodes. The issue was that the management VRF wasn't explicitly configured for L3Out connectivity on the border router interfaces.

Final Honest Assessment

The CCNP ENCOR exam is difficult because it tests breadth, not depth. You need to know enough about 12 different technologies to answer scenario-based questions. The worst mistake candidates make is specializing too early. I saw an engineer who knew OSPF inside and out but failed the entire automation domain because he'd never written a single Python script. The exam requires basic coding ability, not mastery. My recommendation is to study the official Cisco curriculum for 6 weeks minimum. Supplement with the DevNet learning labs for automation practice. Take at least 3 full-length practice exams before scheduling your actual test date. I scored 720 on my first practice exam and 890 on the actual test. The difference came down to understanding how the questions are phrased, not knowing more material. Read each question twice. Look for words like ALWAYS, NEVER, and MOST IMPORTANT because those are usually trap answers.