Overview
Network Assurance is 10% of ENCOR but has six exam topics, more than any domain except Automation and Artificial Intelligence. They cover diagnosing problems with debugs, conditional debugs, traceroute, ping, SNMP and syslog; configuring and verifying Flexible NetFlow; configuring SPAN, RSPAN and ERSPAN; configuring and verifying IP SLA; describing how Cisco Catalyst Center applies configuration, monitoring and management through traditional and AI-powered workflows; and configuring and verifying NETCONF and RESTCONF.
Four of the six are configure items, so this small domain is unusually hands-on. It sits between Infrastructure, whose protocols these tools observe, and Automation and Artificial Intelligence, which uses the same NETCONF, RESTCONF and Catalyst Center interfaces programmatically.
How it's tested
Most questions show a monitoring or diagnostic configuration and a symptom, then ask why data is missing or which command completes it. Others describe a visibility requirement, such as capturing traffic at a remote site or measuring jitter, and ask for the right tool. Catalyst Center items are descriptive and focus on what each workflow does.
-
Choose the visibility tool
A requirement such as capturing packets across a routed network or measuring path jitter is described, and you select SPAN, RSPAN, ERSPAN, NetFlow or an IP SLA operation.
-
Complete the monitoring configuration
A Flexible NetFlow, SPAN, IP SLA or NETCONF configuration is missing one element, and you identify it.
-
Read the diagnostic output
Syslog levels, traceroute output, SNMP settings or a RESTCONF response are shown, and you interpret what they reveal.
A question says a static default route must move to a backup ISP when the primary provider's gateway stops responding, even though the local interface stays up. Interface state alone cannot detect the failure, so you need an active probe: an IP SLA icmp-echo operation to the provider gateway, a track object referencing its reachability, and the track keyword on the primary static route.
Exam topics 6
Official exam topics from the Cisco outline, in outline order.
4.1 Diagnose network problems using such as debugs, conditional debugs, traceroute, ping, SNMP, and syslogChoosing and reading the classic diagnostic tools safely.
- What it means
- This topic covers using debugs (and conditional debugs that limit output to an interface, address or other condition), ping and extended ping, traceroute, SNMP polling and traps, and syslog messages and severity levels to find network faults.
- What to understand
- Debug output is CPU-intensive, so production use calls for debug condition commands and logging to the buffer rather than the console; terminal monitor is needed to see debugs over SSH. Syslog severities run from 0 (emergencies) to 7 (debugging), and a logging level includes everything numerically lower. SNMPv3 with authPriv adds authentication and encryption that SNMPv2c community strings lack, and informs are acknowledged while traps are not.
- How it shows up
- A question asks why debug output does not appear in an SSH session, which syslog messages a configured level captures, or which SNMP version meets an encryption requirement.
- Common confusion
- Thinking logging trap warnings (level 4) sends only warnings; it sends severity 4 and every more severe level, 0 through 3.
4.2 Configure and verify Flexible NetFlowFlow records, exporters and monitors applied to interfaces.
- What it means
- This topic covers building a Flexible NetFlow configuration from a flow record (which fields define and describe a flow), a flow exporter (where and how to send data), and a flow monitor (record, exporter and cache) applied to an interface in a direction.
- What to understand
- In a flow record, match statements define key fields that make a flow unique, such as source and destination address and ports, while collect statements gather non-key data such as byte and packet counters. The monitor must be applied with ip flow monitor NAME input or output on an interface, and show flow monitor NAME cache displays the local data even before export works.
- How it shows up
- An exhibit shows a record, exporter and monitor but no data at the collector, and you find the missing interface application, wrong destination or wrong transport port.
- Common confusion
- Putting counters under match instead of collect, which turns them into key fields and creates a separate flow for almost every packet.
4.3 Configure SPAN/RSPAN/ERSPANMirroring traffic locally, across a Layer 2 VLAN or across a routed network.
- What it means
- This topic covers configuring local SPAN sessions (source and destination on one switch), RSPAN (mirrored traffic carried across trunks in a dedicated remote-span VLAN) and ERSPAN (mirrored traffic encapsulated in GRE and routed to a remote destination).
- What to understand
- Local SPAN copies traffic from source ports or VLANs, in receive, transmit or both directions, to a destination port that by default stops acting as a normal switch port. RSPAN requires the VLAN to be configured with the remote-span keyword and allowed on every trunk between source and destination switches. ERSPAN uses an erspan-id and IP addresses so the copy can cross Layer 3 boundaries.
- How it shows up
- A scenario places the analyzer on another switch or in another routed site and asks which mirroring method works, or an RSPAN configuration fails because of a missing trunk VLAN.
- Common confusion
- Choosing RSPAN to reach an analyzer that is only reachable through routers; RSPAN needs Layer 2 adjacency, and ERSPAN is the routed option.
4.4 Configure and verify IPSLAActive probes, scheduling, tracking and responders.
- What it means
- This topic covers configuring IP SLA operations such as icmp-echo, udp-jitter and http, scheduling them, verifying results, and linking them to track objects that control static routes or FHRP priorities.
- What to understand
- An operation does nothing until scheduled, for example with ip sla schedule 10 life forever start-time now, and results are checked with show ip sla statistics. udp-jitter operations need ip sla responder on the target device, while icmp-echo does not. A track object (track 1 ip sla 10 reachability) lets a static route with the track keyword or an HSRP priority decrement react to the probe result.
- How it shows up
- A failover scenario requires detecting a remote failure where the local interface stays up, or an exhibit shows an IP SLA configured but never scheduled.
- Common confusion
- Assuming the static route reacts to IP SLA directly; the route references a track object, which references the IP SLA operation.
4.5 Describe how Cisco Catalyst Center (formerly Cisco DNA Center) is used to apply network configuration, monitoring, and management using traditional and AI-powered workflowsDesign, policy, provisioning and assurance workflows in Catalyst Center.
- What it means
- This topic covers how Catalyst Center manages the network through its Design, Policy, Provision and Assurance workflows, including templates, software image management, health scores and issue reporting, and how AI-assisted features such as machine-learning baselining and guided troubleshooting supplement those workflows.
- What to understand
- Traditional device-by-device CLI management configures each box separately, while Catalyst Center applies intent from a central controller using templates and site hierarchies, then validates the result with telemetry-driven assurance. AI-driven analytics learn normal behavior for a network so deviations are flagged as issues with suggested remediation, reducing manual correlation of logs and counters.
- How it shows up
- A scenario asks which Catalyst Center capability provisions a configuration template to many sites, reports client and device health, or highlights an anomaly against a learned baseline.
- Common confusion
- Treating Catalyst Center as a data-plane or fabric component; it is a management and assurance controller, not a device in the forwarding path.
4.6 Configure and verify NETCONF and RESTCONFEnabling model-driven programmatic access on IOS XE and verifying it.
- What it means
- This topic covers enabling NETCONF (netconf-yang, running over SSH on TCP 830 with XML encoding) and RESTCONF (restconf plus the HTTPS server, using HTTP methods with XML or JSON encoding) on IOS XE devices, and verifying that clients can read and change YANG-modeled data.
- What to understand
- Both protocols need AAA with a privilege-15 user, and RESTCONF also needs ip http secure-server. NETCONF uses RPC operations such as get, get-config, edit-config, lock and commit against running, candidate or startup datastores, while RESTCONF maps operations to GET, POST, PUT, PATCH and DELETE on URLs such as /restconf/data/ietf-interfaces:interfaces.
- How it shows up
- An exhibit shows a NETCONF client failing to connect or a RESTCONF request rejected, and you identify the missing enable command, port, user privilege or media type.
- Common confusion
- Assuming NETCONF runs over HTTPS like RESTCONF; NETCONF uses SSH, typically on TCP port 830.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Conditional debugging
debug condition commands limit debug output to traffic or sessions that match an interface, IP address, MAC address or other condition.
- Remember
- Use conditions plus logging buffered so a busy production device is not overloaded, and undebug all to stop everything quickly.
- Tested as
- Topic 4.1 names conditional debugs explicitly.
- Trap
- Enabling a broad debug on a production core and sending it to the console.
-
terminal monitor
Syslog and debug messages are shown on the console by default; an SSH or Telnet session needs terminal monitor to display them.
- Remember
- terminal monitor applies only to the current session and must be re-entered after reconnecting.
- Tested as
- A common reason a remote engineer sees no debug output.
- Trap
- Concluding the debug is broken when the session simply is not monitoring.
-
Syslog severity levels
0 emergencies, 1 alerts, 2 critical, 3 errors, 4 warnings, 5 notifications, 6 informational and 7 debugging.
- Remember
- A configured level captures that level and all lower numbers, which are more severe.
- Tested as
- Questions ask which messages a logging trap or logging buffered level records.
- Trap
- Reading a higher number as more severe.
-
SNMPv2c vs. SNMPv3
SNMPv2c authenticates with a plain-text community string, while SNMPv3 uses users with noAuthNoPriv, authNoPriv or authPriv security levels.
- Remember
- Only SNMPv3 authPriv provides both authentication and encryption; polling uses UDP 161 and traps or informs use UDP 162.
- Tested as
- Security-minded monitoring questions ask for the right SNMP version and level.
- Trap
- Choosing authNoPriv when the requirement says data must be encrypted.
-
Traceroute behavior
Traceroute sends probes with increasing TTL values and lists each router that returns an ICMP time exceeded message; Cisco IOS uses UDP probes to high ports by default.
- Remember
- Asterisks at a hop mean that router did not reply in time, which may be filtering or rate limiting rather than a forwarding failure.
- Tested as
- Output interpretation in topic 4.1.
- Trap
- Concluding the path is broken at the first hop showing asterisks when later hops still respond.
-
Flexible NetFlow building blocks
A flow record defines key (match) and non-key (collect) fields, a flow exporter defines collector address, source, transport and export format, and a flow monitor ties a record and exporter to a cache.
- Remember
- Nothing is collected until the monitor is applied to an interface with a direction; NetFlow v9 and IPFIX are common export formats.
- Tested as
- The core of topic 4.2 configuration and verification.
- Trap
- Applying the exporter or record to the interface instead of the monitor.
-
SPAN destination behavior
A local SPAN destination port receives copies of the monitored traffic and by default does not forward normal traffic or participate in spanning tree.
- Remember
- Sources can be ports or VLANs with rx, tx or both; oversubscription can drop mirrored packets when sources exceed the destination speed.
- Tested as
- Configuration items in topic 4.3.
- Trap
- Using the uplink a host depends on as a SPAN destination.
-
RSPAN VLAN
RSPAN carries mirrored traffic in a VLAN configured with the remote-span keyword to a destination session on another switch.
- Remember
- The VLAN must exist on and be allowed across every intermediate trunk, and MAC learning is disabled on it.
- Tested as
- Exhibits often hide a missing trunk VLAN or missing remote-span keyword.
- Trap
- Using a normal data VLAN, which floods mirrored traffic and learns MAC addresses.
-
ERSPAN
Encapsulated Remote SPAN wraps mirrored frames in GRE so they can be routed to an analyzer or destination switch anywhere on the IP network.
- Remember
- Configure type erspan-source with an erspan-id, the destination IP address and an origin IP address; the receiving side must use the same erspan-id.
- Tested as
- The answer whenever the analyzer is reachable only through routed hops.
- Trap
- Expecting RSPAN to cross a Layer 3 boundary.
-
IP SLA scheduling and tracking
An IP SLA operation defines a probe, ip sla schedule starts it, and a track object turns its result into an up or down state other features can use.
- Remember
- Static routes use the track keyword, and HSRP uses standby track with a decrement; udp-jitter probes need ip sla responder at the target.
- Tested as
- Failover and SLA measurement scenarios in topic 4.4.
- Trap
- Forgetting to schedule the operation, which leaves it configured but never running.
-
Catalyst Center workflows
Design builds the site hierarchy and network settings, Policy defines access and application policy, Provision pushes configuration and images to devices, and Assurance reports health and issues.
- Remember
- Assurance uses telemetry and AI-driven baselining to surface issues with guided remediation rather than raw counters.
- Tested as
- Describe-level questions in topic 4.5 map tasks to workflows.
- Trap
- Expecting to configure each device by CLI after onboarding; the controller pushes intent through templates.
-
NETCONF essentials
NETCONF exchanges XML-encoded RPCs over SSH (TCP 830) to read and edit YANG-modeled data in running, candidate or startup datastores.
- Remember
- Enable with netconf-yang on IOS XE, and use a privilege-15 user with AAA configured.
- Tested as
- Topic 4.6 configure and verify items.
- Trap
- Trying to reach NETCONF over port 22 or HTTPS.
-
RESTCONF essentials
RESTCONF exposes YANG data over HTTPS with standard HTTP methods and XML or JSON payloads.
- Remember
- Enable with restconf and ip http secure-server, and set Accept or Content-Type to application/yang-data+json or +xml.
- Tested as
- Verification exhibits show RESTCONF URLs and response codes.
- Trap
- Sending application/json and receiving an unsupported media type error.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
SPAN vs. RSPAN vs. ERSPAN
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Local SPAN | Mirrors source ports or VLANs to a destination port on the same switch | No transport needed; source and destination on one device | Choosing it for an analyzer on another switch |
| RSPAN | Mirrors traffic into a remote-span VLAN carried over trunks | Requires Layer 2 trunk path for the RSPAN VLAN end to end | Forgetting to allow the RSPAN VLAN on intermediate trunks |
| ERSPAN | Mirrors traffic inside GRE to an IP destination | Crosses routed networks using an erspan-id and IP addressing | Mismatched erspan-id on source and destination |
NETCONF vs. RESTCONF
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| NETCONF | RPC-based protocol for YANG-modeled configuration and state | SSH on TCP 830; XML only; supports candidate datastore, locking and commit | Expecting JSON encoding |
| RESTCONF | HTTP-based protocol for YANG-modeled data | HTTPS; XML or JSON; HTTP methods map to create, read, update and delete | Expecting NETCONF-style locking and candidate commit |
NetFlow vs. SPAN vs. IP SLA
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Flexible NetFlow | Flow metadata: who talked to whom, how much and when | Summarized records, no payloads; good for capacity and security analytics | Choosing it when full packet capture is required |
| SPAN family | Full copies of packets for an analyzer | Complete payload visibility at a point in the network | Choosing it for long-term traffic accounting |
| IP SLA | Active synthetic probes measuring reachability, delay, jitter or loss | Generates its own test traffic instead of observing user traffic | Expecting it to report what real users experienced |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Debug with no output over SSH
- What candidates pick
- Re-enter the debug with a broader scope because nothing appears.
- Why it looks right
- No output looks like the debug is too narrow.
- Why it's wrong
- Debug and log messages go to the console by default; a vty session needs terminal monitor to display them.
Clue to watch for The engineer is connected remotely through SSH.
-
Counters as key fields
- What candidates pick
- Use match counter bytes in the flow record to record traffic volume.
- Why it looks right
- match sounds like 'record this field'.
- Why it's wrong
- match defines key fields that split flows; counters belong under collect as non-key fields.
Clue to watch for The record mixes match and collect statements and the cache shows far more flows than expected.
-
RSPAN over a routed path
- What candidates pick
- Configure RSPAN to deliver traffic to an analyzer in a data center reached through routers.
- Why it looks right
- RSPAN is the 'remote' option.
- Why it's wrong
- RSPAN depends on a Layer 2 VLAN between the switches, which a routed path cannot carry; ERSPAN encapsulates the copy in GRE.
Clue to watch for The path between switches includes Layer 3 hops or a WAN.
-
udp-jitter without a responder
- What candidates pick
- The remote router is overloaded because the udp-jitter probe times out.
- Why it looks right
- Timeouts look like a performance problem.
- Why it's wrong
- udp-jitter needs the target to run ip sla responder to timestamp and reply; without it the operation fails.
Clue to watch for icmp-echo to the same target works, but the jitter operation fails.
-
Static route tied directly to IP SLA
- What candidates pick
- Add the IP SLA operation number to the static route.
- Why it looks right
- The route should react to the probe.
- Why it's wrong
- Static routes reference a track object, which in turn references the IP SLA operation.
Clue to watch for An answer choice includes a track statement linking the two.
-
RESTCONF with generic JSON headers
- What candidates pick
- Send Content-Type application/json to a RESTCONF endpoint.
- Why it looks right
- Most REST APIs accept it.
- Why it's wrong
- RESTCONF expects the YANG media types application/yang-data+json or application/yang-data+xml, and may reject generic types.
Clue to watch for The response is an unsupported media type error, HTTP 415.
Answer framework
Use these steps to pick and verify the right Network Assurance tool for a scenario.
- Decide what evidence is needed: full packets, flow summaries, synthetic performance measurements, event messages or device state.
- Select the matching tool family, then refine by reach, for example local SPAN, RSPAN across trunks or ERSPAN across routed paths.
- Check that every required building block is present, such as record, exporter and monitor, or operation, schedule and track object.
- Confirm prerequisites on the far end and in transit, such as an IP SLA responder, a remote-span VLAN on trunks, or AAA for NETCONF.
- Verify with the specific show command or response, and treat missing output as a configuration gap before assuming a network fault.
Practice question
Want more like this? The CCNP ENCOR practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Treat this domain as a lab checklist, since four of its six topics are configure items. Start with Flexible NetFlow and IP SLA, because both use multi-part configurations that exam exhibits like to break: build a record, exporter and monitor, then an IP SLA with a track object controlling a backup static route, and confirm each with show commands.
Next, configure local SPAN and RSPAN on lab switches and read through ERSPAN syntax, focusing on which design fits which analyzer location. Then enable NETCONF and RESTCONF on an IOS XE router and query interfaces with a client, which also prepares you for the Automation and Artificial Intelligence domain.
Candidates underestimate topic 4.1 because the tools feel basic, yet questions on syslog levels, terminal monitor, SNMPv3 levels and conditional debugs are easy points to lose. Catalyst Center needs a descriptive study of its workflows and assurance features rather than a lab. Finish with practice questions that ask you to pick the right tool for a requirement.
FAQ
How much is Network Assurance worth on ENCOR?
Cisco weights it at 10% of the v1.2 exam. It has six exam topics, so each topic carries a small share of that weight.
Do I need lab practice for this domain?
Yes. Flexible NetFlow, SPAN, RSPAN and ERSPAN, IP SLA, and NETCONF and RESTCONF are all configure items, so practise building and verifying them on IOS XE.
Do I need to know the Catalyst Center GUI in detail?
Topic 4.5 is a describe item. Know what the Design, Policy, Provision and Assurance workflows do and how AI-assisted assurance differs from manual monitoring, not menu-by-menu navigation.
What changed in this domain for v1.2?
Cisco DNA Center is now named Cisco Catalyst Center, and the topic now mentions AI-powered workflows alongside traditional ones. Wireless-specific assurance content left ENCOR with the move of wireless to the CCNP Wireless track.
Why are NETCONF and RESTCONF here and in Automation?
This domain tests enabling and verifying them on devices. Automation and Artificial Intelligence tests YANG models, payloads and response codes when using these interfaces from scripts.
Which is better for troubleshooting, NetFlow or SPAN?
They answer different questions. NetFlow summarizes who talked to whom and how much, while SPAN gives full packets for deep inspection at one point in the network.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 4 knowledge
You have matched visibility needs to NetFlow, SPAN variants and IP SLA, and checked the prerequisites for NETCONF and RESTCONF. See whether you can apply that to exam exhibits.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CCNP ENCOR AI tutor Get any concept explained your way