• 80 questions

CCNP Practice Test

ENCOR 350-401, the core exam of CCNP Enterprise: routing, switching, SD-WAN, security and automation, with the source of each answer.

Which protocol is the overlay control plane of Cisco SD-Access based on?

Pick an answer, then press Check answer. Then you see Correct or Not quite, with the reason. Keys: A to D pick, Enter checks.

Print covers the next 80 questions. Share this set copies a link to the same questions in the same order.

Exam mode: 80 questions, 120 minutes.

More options

Unofficial practice questions, not affiliated with Cisco Systems, Inc. Bank checked October 8, 2026.

Next step Another IT certification? Pick it

All 80 questions

Architecture 12

  • A class map matches DSCP AF41, AF42 and AF43. What sets the three codepoints apart? RFC 2597, section 1
  • A modular campus switch has two supervisors. Which pair of features gives it chassis-level high availability, much like the active and standby members of a switch stack? Cisco Campus LAN and Wireless LAN Solution Design Guide
  • A policer is configured as a two-rate three-color marker. When is a packet marked red? RFC 2698, section 1
  • A QoS policy marks voice with the Expedited Forwarding codepoint. Which DSCP value is that? RFC 3246, section 2.7
  • At what point does Cisco's campus design guide say a core layer should be considered for a LAN? Cisco Campus LAN and Wireless LAN Solution Design Guide
  • How do Cisco WAN Edge routers detect that an IPsec tunnel across a transport has gone down? Cisco Catalyst SD-WAN Design Guide
  • In Cisco Catalyst SD-WAN, which component distributes routes and policy to the WAN Edge routers through OMP, acting as a route reflector? Cisco Catalyst SD-WAN Design Guide
  • In Cisco Catalyst SD-WAN, which component is the orchestration plane and is the first to authenticate WAN Edge devices? Cisco Catalyst SD-WAN Design Guide
  • In Cisco Catalyst SD-WAN, which three values identify a TLOC? Cisco Catalyst SD-WAN Design Guide
  • What does the control plane node of a Cisco SD-Access fabric site keep? Cisco SD-Access Solution Design Guide
  • Which encapsulation carries data packets between the fabric nodes of Cisco SD-Access? Cisco SD-Access Solution Design Guide
  • Which protocol is the overlay control plane of Cisco SD-Access based on? Cisco SD-Access Solution Design Guide
Show all 80 questions (68 more)

Virtualization 8

  • In VXLAN, what is a VTEP? RFC 7348, section 1.1
  • LISP separates two namespaces. What does a Routing Locator (RLOC) identify? RFC 9300
  • Two customers of one provider edge router both use 10.1.1.0/24. What keeps their routes apart? RFC 4364, section 3.1
  • What sets a bare metal (Type 1) hypervisor apart from a hosted (Type 2) one? NIST SP 800-125, Guide to Security for Full Virtualization Technologies, section 2
  • Which IPv4 protocol number marks a packet that carries GRE? RFC 2784, section 4
  • Which UDP destination port carries LISP control messages such as an encapsulated Map-Request? RFC 9301, section 3
  • Which UDP destination port has IANA assigned to VXLAN? RFC 7348, section 5
  • Which value does the Protocol field of an IPv4 header hold when an ESP header comes next? RFC 4303, section 2

Infrastructure 24

  • A BGP speaker receives a route whose AS_PATH already holds its own AS number. What does it do with the route? RFC 4271, section 9.1.2
  • A Cisco router holds two BGP paths to one prefix. Which attribute does the best path algorithm compare first? Cisco, Select BGP Best Path Algorithm (document 13753)
  • An OSPF not-so-stubby area redistributes a few static routes. Which LSA type carries them inside the area? RFC 3101, section 2.3
  • Area 5 is configured as an OSPF stub area. Which LSAs are kept out of it? RFC 2328, section 3.6
  • How does rapid spanning tree decide that a link is point-to-point, when nothing is configured? Cisco, Understand Rapid Spanning Tree Protocol 802.1w (document 24062)
  • HSRP version 2 sends its hello packets to which multicast address? Cisco IP Addressing Services Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring HSRP
  • In Cisco IOS XE, what does the no-summary keyword add to the command area 1 stub on an ABR? Cisco IP Routing Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring OSPF
  • In EIGRP, what must be true of a neighbor's route for it to pass the Feasibility Condition? RFC 7868, section 3.3
  • On which links can rapid spanning tree move a designated port to forwarding quickly, without waiting on timers? Cisco, Understand Rapid Spanning Tree Protocol 802.1w (document 24062)
  • Root guard has blocked a port that received superior BPDUs. What brings the port back? Cisco, Spanning Tree Protocol Root Guard Enhancement (document 10588)
  • SW1 has switchport mode trunk and switchport nonegotiate. SW2, at the other end, is left at dynamic auto. Why is the link not a working trunk? Cisco VLAN Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring VLAN Trunks
  • Two BGP paths tie on weight, local preference and AS_PATH length. One has origin IGP and the other origin INCOMPLETE. Which wins on a Cisco router? Cisco, Select BGP Best Path Algorithm (document 13753)
  • Two BGP peers propose Hold Times of 180 and 90 seconds in their OPEN messages. Which value does the session use? RFC 4271, section 4.2
  • Two switches fail to bundle four links. One side uses channel-group mode desirable and the other mode active. What is wrong? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring EtherChannels
  • What does MSDP let PIM sparse-mode domains do? RFC 3618, section 3
  • What is the default EIGRP variance on a Catalyst 9300, and what does it mean for load balancing? Cisco IP Routing Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring EIGRP
  • What is the default LACP system priority and port priority on a Catalyst 9300? Cisco Layer 2 Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring EtherChannels
  • What is the default priority of a VRRP router that backs up a virtual router it does not own? RFC 5798, section 5.2.4
  • Which address range does IANA set aside for source-specific multicast (SSM) in IPv4? RFC 4607
  • Which addresses does OSPF for IPv6 use as the source of its packets on a normal link? RFC 5340, section 2.5
  • Which OSPFv2 LSA type does an area border router originate to describe a network in another area? RFC 2328, section 12.4.3
  • Which router originates the network-LSA of a broadcast segment? RFC 2328, section 12.4.2
  • Which three attributes must switches share to be in the same MST region? Cisco, Understand the Multiple Spanning Tree Protocol 802.1s (document 24248)
  • With EIGRP's default K-values, which two parts of the metric formula count? RFC 7868, section 5.5

Network assurance 8

  • In a Flexible NetFlow flow record, which command keyword defines a key field, one that tells flows apart? Cisco Network Management Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Flexible NetFlow
  • On which ports of the switches along the path is an RSPAN VLAN configured? Cisco Network Management Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring SPAN and RSPAN
  • What does the IP SLA ICMP echo operation measure? Cisco Network Management Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Service Level Agreements
  • What lets ERSPAN deliver mirrored traffic to an analyzer several routed hops away? Cisco Network Management Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring ERSPAN
  • Where does a RESTCONF client look first to find the root of the RESTCONF API on a device? RFC 8040, section 3.1
  • Which Flexible NetFlow component is applied to an interface to start monitoring traffic there? Cisco Network Management Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Flexible NetFlow
  • Which port has IANA assigned to NETCONF sessions over SSH? RFC 6242, section 3
  • Which SNMPv3 security level adds encryption of the message on top of authentication? Cisco Network Management Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Simple Network Management Protocol

Security 16

  • A login method list reads: group tacacs+, then local. When does the switch try the local user database? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Authentication
  • A method list tries RADIUS first, and the RADIUS server answers with a rejection. What happens next? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Authentication
  • A REST API returns 401 to one request and 403 to another. What is the difference? RFC 9110, section 15.5.2
  • A vty line is set with transport input ssh, but no RSA key pair exists on the switch. What is the state of the SSH server? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Secure Shell
  • An extended access list is being written on a Catalyst switch. What can it match that a standard list cannot? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring IPv4 ACLs
  • Cisco tells administrators to move enable secret and username secret passwords of type 5 to which types? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Controlling Switch Access with Passwords and Privilege Levels
  • How does RADIUS protect the User-Password attribute of an Access-Request? RFC 2865, section 5.2
  • In Cisco TrustSec, as SD-Access uses it, what are Security Group Tags? Cisco SD-Access Solution Design Guide
  • No privilege level is given when an enable secret is configured on a Catalyst switch. Which level does the password open? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Controlling Switch Access with Passwords and Privilege Levels
  • On a Catalyst 9300, to which point is the CoPP policy map attached? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Control Plane Policing
  • On switch-to-host links, which protocol supplies the session keys that MACsec encrypts with? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), MACsec Encryption
  • What does control plane policing (CoPP) protect on a switch? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring Control Plane Policing
  • Which numbers can an extended IPv4 access list have on a Catalyst switch? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), Configuring IPv4 ACLs
  • Which standard does MACsec implement, and between which points does it encrypt? Cisco Security Configuration Guide, IOS XE 17.12 (Catalyst 9300), MACsec Encryption
  • Which transport does TACACS+ use between the device and the server? RFC 8907, section 3.4
  • Why must an API bearer token be sent only over TLS? RFC 6750, section 1.2

Automation and artificial intelligence 12

  • A JSON file contains the line "enabled": True and a parser rejects it. Why? RFC 8259, section 3
  • A Python script holds interfaces = ["Gi1", "Gi2"] and runs interfaces.append("Gi3"). Why does the same call fail on ("Gi1", "Gi2")? Python 3 documentation, Tutorial, 5. Data Structures
  • A RESTCONF DELETE succeeds and the response has no body. Which status code fits? RFC 9110, section 15.3.5
  • A script gets a 5xx status code from a controller API. What does the class tell it? RFC 9110, section 15.6
  • A script runs data = json.loads(text) on the text of a JSON object. What type of Python object is data? Python 3 documentation, Library, json
  • In a JSON object, what separates one name/value pair from the next? RFC 8259, section 4
  • In a YANG module, which statement defines a node that holds one value and has no child nodes? RFC 7950, section 4.2.2.1
  • In an EEM applet, which statement runs a CLI command when the event fires? Cisco Embedded Event Manager Configuration Guide, IOS XE 16, Writing Embedded Event Manager Policies Using the Cisco IOS CLI
  • In Python's json module, which function turns a Python object into a JSON formatted string? Python 3 documentation, Library, json
  • What is YANG? RFC 7950
  • What makes Ansible an agentless tool, where Puppet is agent-based? Ansible community documentation, Introduction to Ansible (source text in the ansible-documentation repository)
  • Which command starts an Embedded Event Manager applet named WATCH on a Cisco router? Cisco Embedded Event Manager Configuration Guide, IOS XE 16, Writing Embedded Event Manager Policies Using the Cisco IOS CLI

How this list was compiled: Own questions, written to the six sections and weights of Cisco's exam topics for Implementing Cisco Enterprise Network Core Technologies v1.2 (ENCOR 350-401), the core exam of CCNP Enterprise, as Cisco publishes them at https://learningnetwork.cisco.com/s/encor-exam-topics and in the exam topics PDF https://learningcontent.cisco.com/documents/marketing/exam-topics/350-401-ENCORE-v1.2.pdf (both read 2026-10-08). Facts were read on 2026-10-08 in public texts: IETF RFCs on rfc-editor.org, Cisco's public configuration guides for IOS XE on cisco.com, Cisco's public design guides for campus, SD-Access and Catalyst SD-WAN, Cisco's public support documents, NIST SP 800-125, the Python documentation, and the Ansible and Puppet documentation. Each question names the text and section it was written from and links to it. Licence: Own work. Every question, wrong choice and explanation was written for this site from the public texts named in each question. Nothing is copied or reworded from a Cisco exam, a released or sample question, a practice product or a question dump.

How it works

This unofficial CCNP practice test follows ENCOR 350-401, the core exam of CCNP Enterprise: 80 of our own questions, sorted by Cisco's v1.2 topics. It is not affiliated with Cisco Systems, Inc., and nothing here comes from the real exam.

Read the full guide

What the core exam asks

Cisco's ENCOR v1.2 topics, read on October 8, 2026, weight architecture 15%, virtualization 10%, infrastructure 30%, network assurance 10%, security 20%, and automation and artificial intelligence 15%. The wireless subsections of v1.1 are gone from the list.

What is not in this bank

The questions are multiple choice only. Catalyst Center workflows, the controller APIs, Precision Time Protocol and policy-based routing are not asked, because no public text read for this bank settles them.

  • On a Cisco router WEIGHT is compared before LOCAL_PREF, and it never leaves the router that set it.
  • A login method list moves on only when a server gives no answer. A rejection ends the attempt.
  • Root guard unblocks a port by itself once the superior BPDUs stop. BPDU guard leaves the port error-disabled.

Questions and answers

Is this a CCIE practice test too?

For the written part, yes. Cisco lists ENCOR 350-401 as the core exam of both CCNP Enterprise and CCIE Enterprise Infrastructure. The CCIE then adds an eight-hour lab exam, which a question bank cannot stand in for.

How many questions are on the ENCOR exam?

Cisco gives no count, only the length, 120 minutes, and the question kinds: multiple choice, drag-and-drop and performance-based. Exam mode on this page uses all 80 questions of the bank and the same 120 minutes.

What is the passing score for the CCNP core exam?

None is published. Cisco's CCNP Enterprise page says the exam is graded pass or fail and that results appear online within 48 hours. A percent here is a study measure only.

Does this cover the CCNP concentration exams?

No. CCNP Enterprise takes the core exam and one concentration exam of your choice, such as ENARSI 300-410 or ENSDWI 300-415. Each concentration exam has its own published topics, and this bank follows the core alone.

More tests

Show 7 more

Browse Safety and Trades