The Whole CCNP ENCOR Cheat Sheet (Everything, Still Mostly Painless)

How this is different from CCNA (besides the price of the exam)

CCNA asks 'can you configure and verify this.' ENCOR asks 'can you configure it, verify it, AND explain exactly why it broke when it inevitably does.' Same topics in places, meaningfully more depth everywhere.

Infrastructure alone is 30% of this exam — the single largest domain by a wide margin. If you're going to over-prepare on one thing, make it that one.

The brain and the hands (this diagram covers half the Architecture domain)

SD-WAN, SD-Access, and honestly most controller-based networking are all the SAME split: a controller (brain) decides policy and routing, edge devices (hands) just forward based on what they were already told.

If the brain goes offline, the hands typically keep working off the last known policy — that's the entire point of separating the planes, and a favorite exam scenario.

QoS order, said one more time because it's on every exam ever

Classify → Mark → Queue → Police (drop/re-mark instantly, zero delay) or Shape (buffer it, add a little delay, avoid loss). Policing is the bouncer; shaping is the polite line outside the club.

Domain 2: Virtualization — VRF, tunnels, and overlays

VRF-Lite gives one router MULTIPLE independent routing tables. It's Layer 3 isolation — a genuinely different mechanism from a VLAN's Layer 2 isolation, even though both get called 'segmentation' casually.

GRE by itself encrypts NOTHING. It's just encapsulation. 'tunnel protection ipsec profile' is the one line doing all the actual security work — and a tunnel can stay perfectly up/up even if that protection quietly breaks.

VXLAN's whole pitch: a 24-bit segment ID (16 million+ possible segments) instead of VLAN's 12-bit ceiling of 4094. It wraps Layer 2 frames in UDP so they can cross a Layer 3 fabric like it's no big deal.

HSRP failure the exam loves to test

Priority only decides the FIRST election. If the active router comes back after a failover, it stays standby FOREVER unless 'standby preempt' is configured — priority alone does not reclaim active status after the fact.

Domain 4: Network Assurance — see everything, trust nothing you didn't verify

NetFlow is SUMMARIZED METADATA (who talked to whom, how much, what port). It is not a packet capture and cannot show you payload content — that's SPAN's job.

Local SPAN mirrors on the SAME switch. RSPAN crosses switches over a dedicated VLAN (still one Layer 2 domain). ERSPAN wraps it in GRE so it can cross Layer 3 — needed the moment source and destination live on different subnets.

An IP SLA operation needs an explicit schedule to actually run. A perfectly configured but unscheduled operation is a beautifully written letter that never gets mailed.

Domain 5: Security — 20% of the exam, second-biggest domain

A method list ('aaa authentication login X group tacacs+ local') needs that local fallback, or a single AAA server outage locks out literally every administrator relying on it, all at once, at the worst time.

ACLs: top-to-bottom, first-match-wins, invisible deny-all at the bottom. A broad permit placed above a specific deny makes that deny completely unreachable — still there, just never consulted.

CoPP protects the ROUTE PROCESSOR specifically, not general forwarding. Sized too aggressively, it can rate-limit your own routing protocol hellos and cause an outage that LOOKS like a routing problem but is actually self-inflicted.

MACsec is hop-by-hop only, between two directly connected devices. One non-MACsec device anywhere in the path is a real, unencrypted gap — unlike IPsec, which doesn't care how many hops are in between.

Domain 6: Automation & AI — the domain that didn't exist a decade ago

JSON's entire personality: double quotes ONLY (never single), and absolutely no trailing comma after the last item. Both are the most common, most avoidable way to break a payload.

RESTCONF: PUT replaces the ENTIRE resource with exactly what you sent (anything you left out gets reset to default — genuinely destructive if you meant a partial update). PATCH touches only the fields you actually specify. Mixing these two up has ended real configurations early.

NETCONF's candidate datastore does NOTHING to the live config until you explicitly commit. A 'successful' edit-config against candidate just means the staging worked — not that anything real changed yet.

EEM pattern matching needs an EXACT match against the device's real syslog text ('GigabitEthernet0/1' is not 'Gi0/1' as far as EEM is concerned). A plausible-looking abbreviation is a silent, invisible failure to trigger at all.

The night-before survival kit, ENCOR edition

Infrastructure and Security together are HALF the exam by weight. If your remaining study time is limited, that's where it goes.

When a scenario says something 'still works but logs a warning,' that's almost always a native VLAN mismatch or a similarly 'partially broken, still passing traffic' situation — the exam loves testing whether you know the difference between broken and quietly wrong.

You already survived CCNA. This is the same skill, aimed at bigger, more professional-sounding problems. You've got this.