Overview
Architecture covers 15% of ENCOR and has four exam topics: enterprise design principles (2-tier, 3-tier, fabric and cloud designs plus high availability through redundancy, FHRP and SSO), the working principles of Cisco Catalyst SD-WAN, the working principles of Cisco SD-Access, and interpreting QoS configurations. Most of it is explained at the concept level, so you need to know which component does which job rather than type long configurations.
The domain is the map for the rest of the exam. SD-Access is built from LISP and VXLAN, which you study in Virtualization; FHRPs and the routing that SSO protects come from Infrastructure; the controllers you describe here expose the APIs tested in Automation and Artificial Intelligence. Learn the roles and planes first, and those later domains read as details of designs you already understand.
How it's tested
Questions in this domain describe a design requirement or show an output, then ask which component, model or behavior fits. Many are 'which device performs this function' items about SD-WAN or SD-Access, and QoS items paste a policy-map and ask what happens to a traffic class. Read for the plane involved (management, control, data or policy) before choosing.
-
Name the component
A function is described, such as distributing routes and policy to WAN edges or answering endpoint location queries, and you pick the Catalyst SD-WAN or SD-Access role that performs it.
-
Choose the design
A campus size, budget or resiliency requirement is given, and you select collapsed core, three-tier, fabric or a high-availability feature such as SSO with NSF.
-
Read the QoS policy
An MQC configuration is shown, and you determine which class gets strict priority, what is dropped or re-marked, and where the policy actually applies.
A question says branch routers keep forwarding traffic for hours after losing contact with all SD-WAN Controllers, and asks why. Identify the plane: the controllers are control plane only, and the WAN Edge routers already hold their IPsec tunnels, routes and policy. With OMP graceful restart they keep using that last-known state, so data forwarding continues even though no new routes or policy can arrive.
Exam topics 4
Official exam topics from the Cisco outline, in outline order.
1.1 Explain the different design principles used in an enterprise networkTwo-tier, three-tier, fabric and cloud designs, plus redundancy, FHRP and SSO.
- What it means
- This topic covers the high-level enterprise design options (2-tier collapsed core, 3-tier access/distribution/core, fabric, and cloud) and the high availability techniques that keep them running: redundant links and devices, first hop redundancy protocols, and stateful switchover (SSO).
- What to understand
- A collapsed core merges core and distribution and suits a single building; a separate core layer is added when several distribution blocks need a high-speed, low-feature interconnect. SSO keeps a standby supervisor or stack member synchronized so it takes over without dropping links, and it is paired with NSF so routing neighbors keep forwarding during the restart instead of tearing down adjacencies.
- How it shows up
- A scenario describes a campus that has grown from one building to several and asks when to add a dedicated core, or asks which feature avoids a routing reconvergence when a supervisor fails.
- Common confusion
- Candidates treat SSO and FHRP as alternatives; SSO protects against a supervisor failure inside one chassis, while an FHRP protects hosts against the loss of a whole gateway device.
1.2 Explain the working principles of the Cisco Catalyst SD-WAN solutionOrchestration, management, control and data planes, plus benefits and limitations.
- What it means
- This topic covers the Catalyst SD-WAN components: SD-WAN Manager (management), SD-WAN Controller (control plane, running OMP), SD-WAN Validator (orchestration, authentication and NAT traversal), and WAN Edge routers (data plane, building IPsec tunnels to each other), along with what the solution does well and where it is constrained.
- What to understand
- Edges first contact the Validator, which authenticates them and points them to the Controllers and Manager. Controllers exchange routes, TLOCs and policy with edges over OMP inside DTLS or TLS connections, while user traffic flows only on edge-to-edge IPsec tunnels monitored by BFD. Benefits include transport independence, application-aware routing and centralized policy; limitations include dependence on controller reachability for changes and the operational overhead of certificates and controller hosting.
- How it shows up
- You are given a function (for example, 'authenticates new edges and helps them behind NAT') and must name the component, or you are asked what still works when controllers are unreachable.
- Common confusion
- Mixing up the Controller and the Validator: the Controller computes and distributes routing and policy, while the Validator is the first point of contact that authenticates devices and brokers NAT traversal.
1.3 Explain the working principles of the Cisco SD-Access solutionFabric underlay and overlay, control and data plane roles, and coexistence with a traditional campus.
- What it means
- This topic covers the SD-Access fabric: a routed underlay, a LISP control plane, a VXLAN data plane and a TrustSec policy plane, managed by Catalyst Center with Cisco ISE for identity. It also covers how a traditional campus connects to the fabric through border nodes.
- What to understand
- Edge nodes register endpoints with the control plane node (a LISP map server and map resolver) and encapsulate traffic in VXLAN with the scalable group tag carried in the header. Border nodes connect the fabric to outside networks, usually handing off each virtual network as VRF-lite with BGP to a fusion router; a Layer 2 border can extend a fabric subnet to a traditional VLAN during migration.
- How it shows up
- A question asks which node answers 'where is this endpoint' lookups, which protocol carries user traffic between edge nodes, or how a legacy distribution block reaches fabric hosts.
- Common confusion
- Assuming VXLAN is the control plane; in SD-Access, LISP provides endpoint-to-location mapping and VXLAN only encapsulates the data.
1.4 Interpret QoS configurationsReading MQC class-maps, policy-maps and service-policies and predicting their effect.
- What it means
- This topic asks you to read a Modular QoS CLI configuration and explain what it does: how class-maps classify traffic, what actions a policy-map applies (priority, bandwidth, police, shape, set), and where and in which direction the service-policy is applied.
- What to understand
- The priority command creates a low-latency queue that is implicitly policed during congestion, while bandwidth guarantees a minimum share and lets the class use more when it is available. Policing drops or re-marks excess traffic immediately, shaping buffers it to smooth the rate, and match-all requires every match statement while match-any needs only one. Know common markings: EF is DSCP 46 for voice, AF41 is 34 for interactive video, and CS3 is 24 for signaling.
- How it shows up
- A policy is shown and you are asked what happens to voice traffic above its priority rate, why a class is never matched, or why the policy has no effect on outbound traffic.
- Common confusion
- Believing a priority queue may consume all available bandwidth; under congestion the priority class is limited to its configured rate, and the excess is dropped.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Two-tier vs. three-tier campus
A two-tier (collapsed core) design merges core and distribution into one layer, while a three-tier design adds a dedicated core between several distribution blocks.
- Remember
- Add a separate core when the number of distribution blocks makes a full mesh between them impractical, or when buildings must be interconnected at scale.
- Tested as
- Design questions describe campus growth and ask which model is appropriate.
- Trap
- Choosing three-tier for a single small building, where the extra layer adds cost without adding resilience.
-
SSO with NSF
Stateful switchover synchronizes the standby route processor so it takes over without resetting interfaces, and Non-Stop Forwarding keeps forwarding with the existing FIB while routing protocols restart gracefully.
- Remember
- SSO alone keeps Layer 2 state; NSF (with NSF-aware neighbors) is what prevents routing adjacencies from being torn down.
- Tested as
- Asked when a scenario needs sub-second recovery from a supervisor failure in a single chassis or stack.
- Trap
- Selecting HSRP for a supervisor failure, which only helps when the whole gateway device is lost.
-
Catalyst SD-WAN component roles
SD-WAN Manager is the GUI and management plane, SD-WAN Controller is the control plane, SD-WAN Validator is orchestration and authentication, and WAN Edge routers forward data.
- Remember
- Only WAN Edge routers carry user traffic; the Controller distributes routes and policy through OMP; the Validator is the first device an edge contacts and needs a public or reachable address.
- Tested as
- The single most common Catalyst SD-WAN question type is matching a function to a component.
- Trap
- Using the old names interchangeably: vManage is SD-WAN Manager, vSmart is SD-WAN Controller and vBond is SD-WAN Validator.
-
OMP and TLOCs
The Overlay Management Protocol runs between edges and Controllers and advertises OMP routes, TLOC routes and service routes, where a TLOC identifies a transport attachment by system IP, color and encapsulation.
- Remember
- Edges do not run OMP with each other; all OMP exchanges go through the Controllers, which reflect routes and apply centralized policy.
- Tested as
- Explains how a branch learns another branch's prefixes and which tunnel endpoint to use.
- Trap
- Assuming edges form a routing protocol mesh, when they form an IPsec data-plane mesh but a hub-and-spoke control plane.
-
BFD in SD-WAN tunnels
Bidirectional Forwarding Detection runs inside every edge-to-edge IPsec tunnel to detect failures and measure loss, latency and jitter.
- Remember
- Application-aware routing uses these BFD measurements to move an application to the tunnel that meets its SLA class.
- Tested as
- Appears when a question asks how SD-WAN detects that an internet transport no longer meets a voice SLA.
- Trap
- Thinking IP SLA probes configured by the administrator provide the SD-WAN path measurements.
-
SD-Access fabric roles
Control plane nodes keep the endpoint-to-location database, edge nodes connect endpoints and act as the anycast gateway, border nodes connect the fabric to other networks, and intermediate nodes simply route underlay traffic.
- Remember
- The control plane node is a LISP map server and map resolver; border nodes can be internal, external or anywhere borders.
- Tested as
- Component identification questions are as common for SD-Access as for SD-WAN.
- Trap
- Naming Catalyst Center as the control plane; it is the management and automation platform, not part of the forwarding path.
-
SD-Access planes
The underlay is a routed network (commonly IS-IS built by LAN automation), the overlay control plane is LISP, the data plane is VXLAN, and the policy plane is TrustSec with scalable group tags.
- Remember
- SD-Access VXLAN uses the Group Policy Option, so the scalable group tag travels in the VXLAN header for egress enforcement.
- Tested as
- Questions ask which protocol handles which plane, and why micro-segmentation works across the fabric.
- Trap
- Swapping LISP and VXLAN, or assuming the fabric still depends on spanning tree between access and distribution.
-
Fusion router and border handoff
A fusion router outside the fabric peers with the border node per virtual network, usually with VRF-lite and BGP, so shared services and traditional networks can reach fabric hosts.
- Remember
- Route leaking between virtual networks for shared services such as DHCP and DNS happens on the fusion device, not inside the fabric.
- Tested as
- Covers the 'traditional campus interoperating with SD-Access' subtopic.
- Trap
- Expecting fabric hosts in different virtual networks to reach each other without leaking routes between VRFs.
-
LLQ priority command
The priority command gives a class strict-priority scheduling for delay-sensitive traffic such as voice, with an implicit policer during congestion.
- Remember
- Only traffic up to the configured priority rate is protected; excess priority traffic is dropped when the link is congested so it cannot starve other queues.
- Tested as
- Configuration-interpretation questions often ask what happens when voice exceeds its priority allocation.
- Trap
- Assuming bandwidth and priority are equivalent; bandwidth guarantees a minimum but has no strict-priority scheduling.
-
Policing vs. shaping
Policing enforces a rate by dropping or re-marking excess packets immediately, while shaping queues excess packets and sends them later at the configured rate.
- Remember
- Shaping adds delay but avoids drops and works outbound; policing can work in either direction and causes TCP retransmissions when it drops.
- Tested as
- A provider contract rate or an ingress limit scenario asks you to pick the right tool.
- Trap
- Choosing policing to match a sub-rate provider circuit, which causes bursts to be dropped instead of smoothed.
-
DSCP values to recognize
EF (46) marks voice, AF41 (34) marks interactive video, CS3 (24) marks call signaling, AF21 (18) marks transactional data and CS0 (0) is best effort.
- Remember
- AF classes encode drop precedence in the second digit, so AF43 is dropped before AF41 under WRED.
- Tested as
- Class-maps in exhibits often match on DSCP names or numbers.
- Trap
- Reading a higher AF drop-precedence number as higher priority.
-
Service-policy attachment
A policy-map takes effect only when attached with service-policy input or service-policy output on an interface, subinterface or the control plane.
- Remember
- Queuing actions such as priority and bandwidth are output actions; an input policy can classify, mark and police but cannot queue.
- Tested as
- Exhibit questions sometimes hinge on a policy applied in the wrong direction.
- Trap
- Expecting an input service-policy with a priority class to give voice low latency.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
SD-WAN Manager vs. SD-WAN Controller vs. SD-WAN Validator vs. WAN Edge
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SD-WAN Manager | Centralized GUI and API for configuration, monitoring and templates | Management plane; pushes configuration and collects statistics | Thinking it distributes routes; that is the Controller's job |
| SD-WAN Controller | Control plane device running OMP with every edge | Distributes routes, TLOCs, keys and centralized policy; carries no user data | Expecting traffic to stop instantly when it fails |
| SD-WAN Validator | Orchestrator that authenticates devices and assists NAT traversal | First point of contact for a new edge; tells it where the Controllers and Manager are | Confusing it with the Controller because both are 'controllers' in older material |
| WAN Edge router | Branch, campus or data center router in the fabric | Only component that forwards user traffic over IPsec tunnels | Assuming edges exchange routing information directly with each other |
SD-Access control plane node vs. edge node vs. border node
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Control plane node | LISP map server and map resolver for the fabric | Holds the endpoint ID to location (RLOC) database | Thinking it forwards user traffic |
| Edge node | Access switch where endpoints connect | Registers endpoints, acts as anycast gateway and VXLAN tunnel endpoint | Assuming each edge has a unique default gateway IP; all edges share the anycast gateway |
| Border node | Exit point between the fabric and external or shared networks | Translates between fabric virtual networks and VRFs or VLANs outside | Assuming the border performs route leaking between virtual networks, usually done on the fusion router |
Priority vs. bandwidth vs. police vs. shape
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| priority | Strict-priority low-latency queue | Serviced first; implicitly policed to its rate under congestion | Believing it can use unlimited bandwidth |
| bandwidth | Minimum guarantee for a class-based queue | Guarantees a share during congestion; may borrow unused bandwidth | Treating it as a rate cap |
| police | Rate enforcement by drop or re-mark | No buffering; works inbound or outbound | Using it where smoothing to a provider rate is required |
| shape | Rate enforcement by buffering | Delays excess traffic instead of dropping it; outbound only | Expecting it to work on an input policy |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Controller loss means outage
- What candidates pick
- All SD-WAN branch traffic stops immediately when the Controllers are unreachable.
- Why it looks right
- The Controllers are central to the solution, so losing them sounds fatal.
- Why it's wrong
- Edges keep forwarding on existing IPsec tunnels with last-known routes and policy for the OMP graceful-restart period; only changes and new route learning stop.
Clue to watch for The question asks what happens to existing traffic, not to new configuration.
-
Catalyst Center as a fabric node
- What candidates pick
- Catalyst Center answers endpoint location lookups in SD-Access.
- Why it looks right
- It is the central controller for the whole SD-Access solution.
- Why it's wrong
- Catalyst Center automates and monitors; endpoint lookups are answered by the LISP control plane node in the fabric.
Clue to watch for Wording such as 'map server', 'resolve endpoint location' or 'register endpoint' points to the control plane node.
-
FHRP for chassis failover
- What candidates pick
- Configure HSRP to avoid routing reconvergence when an active supervisor fails.
- Why it looks right
- HSRP is the best-known gateway redundancy feature.
- Why it's wrong
- HSRP fails over between two separate routers and does nothing for a supervisor failure inside one chassis; SSO with NSF handles that.
Clue to watch for The scenario mentions redundant supervisors, a stack or a single chassis.
-
Input policy queuing
- What candidates pick
- The voice class gets priority because the policy contains a priority statement.
- Why it looks right
- The configuration itself is correct and complete.
- Why it's wrong
- Priority and bandwidth are queuing actions that only work in the output direction; an input service-policy cannot provide them.
Clue to watch for Check the direction keyword on the service-policy line in the exhibit.
-
match-all with exclusive criteria
- What candidates pick
- A class-map matching DSCP EF and DSCP AF41 catches both voice and video.
- Why it looks right
- Both match lines look correct.
- Why it's wrong
- class-map match-all requires every statement to be true, and a packet cannot carry two DSCP values, so nothing matches; match-any is needed.
Clue to watch for Look for the match-all keyword, which is the default when none is written.
-
Extending VLANs into the fabric
- What candidates pick
- Trunk legacy VLANs straight to SD-Access edge nodes so old and new hosts share subnets.
- Why it looks right
- It mirrors how traditional campuses extend VLANs.
- Why it's wrong
- SD-Access uses a routed underlay and VXLAN overlay; traditional networks connect through border nodes, with a Layer 2 border handoff used when a subnet must be shared during migration.
Clue to watch for The question mentions migration or interoperation between a traditional campus and the fabric.
Answer framework
Use this sequence when an Architecture question names a requirement or shows a component or policy.
- Identify the plane involved (management, orchestration, control, data or policy) before you look at the answer choices.
- Match the described function to its role, such as the SD-WAN Controller for route and policy distribution or the control plane node for endpoint lookups.
- Check what still works when a component fails, separating existing forwarding state from the ability to learn routes or change configuration.
- For design choices, compare the scale and failure domain in the scenario with what each campus model or high-availability feature actually protects.
- For QoS exhibits, trace one packet through the class-map, the policy action and the service-policy direction before judging the result.
Practice question
Want more like this? The CCNP ENCOR practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with design principles because they set up every later topic: draw a collapsed core and a three-tier campus, then mark where SSO, NSF and an FHRP each remove a single point of failure. Next, learn Catalyst SD-WAN and SD-Access as two sets of roles mapped to planes; a one-page table with component, plane, protocol and failure behavior covers most questions in topics 1.2 and 1.3.
Give QoS more time than its single topic number suggests. Interpreting configurations is the one hands-on skill in this domain, and it rewards lab repetition: build a policy-map with priority, bandwidth and police classes on a lab router, generate traffic, and read show policy-map interface output until the counters make sense.
Candidates commonly underestimate the old-to-new naming changes (vManage to SD-WAN Manager, DNA Center to Catalyst Center) and the details of how the fabric interoperates with a traditional campus. Afterwards, move to Virtualization to study LISP and VXLAN in depth, then take timed practice questions that mix component identification with QoS exhibits.
FAQ
How much of the ENCOR exam is Architecture?
Cisco weights Architecture at 15% of the v1.2 exam. That makes it roughly as large as Automation and Artificial Intelligence, and half the size of Infrastructure.
Do I need to configure SD-WAN or SD-Access for ENCOR?
No. The v1.2 topics ask you to explain their working principles, so focus on components, planes, protocols and failure behavior rather than configuration syntax.
Does ENCOR still use the names vManage, vSmart and vBond?
The v1.2 topics use Catalyst SD-WAN and SD-WAN Manager naming. Learn both sets of names, because study material and older documentation still use vManage, vSmart and vBond.
What is the difference between SSO and an FHRP?
SSO fails over between route processors inside one device while keeping its state synchronized. An FHRP such as HSRP or VRRP moves a virtual gateway address between two separate devices.
Is QoS configuration tested or only theory?
Topic 1.4 says interpret QoS configurations, so expect to read MQC exhibits and predict their effect. Being able to write the configuration helps you read it faster.
Is wireless architecture still part of this domain?
No. Wireless topics were removed from ENCOR in v1.2 and moved to the separate CCNP Wireless track, so wireless deployment models no longer appear in the Architecture topic list.
How does Architecture relate to the Virtualization domain?
SD-Access is built from LISP and VXLAN, which Virtualization covers in more depth. Studying them together explains why the fabric separates control and data planes.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
You have mapped SD-WAN and SD-Access roles to their planes and traced QoS policies through priority and policing. Check whether you can apply that under time pressure.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CCNP ENCOR AI tutor Get any concept explained your way