1.0 Architecture

4 min read ENCOR 350-401 v1.2 Updated Jul 19, 2026

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

What this domain tests

Domain 1 is 15% of the ENCOR exam. It has five topics: enterprise campus design, high availability, Catalyst SD-WAN, SD-Access, and QoS interpretation.

Each topic asks the same question: what problem does this part of the design solve? For each design choice, learn to name three things:

Control point: the device or system that makes the decision.
Failure domain: the devices that stop when one part fails.
Proof: the command that shows the design works.

Note: Do not memorize product names first. Learn control points, failure domains, and proof commands first. Product names become easy after that.

The five building blocks

2-tier campus: the access layer connects to a collapsed core. The collapsed core does routing and aggregation. Use this design for small and medium sites.
3-tier campus: the access layer connects to the distribution layer. The distribution layer connects to the core layer. Use this design for large sites or sites that grow fast.
Fabric: an overlay runs on top of the physical network. The overlay controls identity, segmentation, and endpoint location. The physical network (the underlay) still moves the packets.
Cloud: a provider owns part of the infrastructure. You still control routing, segmentation, and policy at the edge.
High availability: the network continues to forward traffic when one part fails. This needs redundant links, redundant devices, fast failure detection, and stateful failover.

Domain 1 map:

Campus L2/L3 ---- FHRP + EtherChannel + STP
      |
      +-- WAN overlay (SD-WAN: OMP control + encrypted data tunnels)
      +-- Campus fabric (SD-Access: LISP + VXLAN + SGT policy)
      +-- Edge QoS (classify -> queue -> verify counters)

Example: one site, two designs

Scenario: a site has 400 users. VLAN 10 is users (10.10.10.0/24). VLAN 20 is voice (10.10.20.0/24). Two switches connect the site to the rest of the network.

Item	Design A: 2-tier campus	Design B: SD-Access fabric
Gateway for VLAN 10	HSRP virtual IP 10.10.10.1 on DSW1 and DSW2	Anycast gateway 10.10.10.1 on each edge node
Control point	DSW1 and DSW2 (Layer 3 and STP root)	Control plane node (LISP map server)
Failure domain	Both switches fail = full site down	One edge node fails = only its endpoints down
Proof command	`show standby brief`	`show lisp instance-id <id> ipv4 map-cache`

The same logic applies to the WAN. In Catalyst SD-WAN, the SD-WAN Controller (formerly vSmart) is the control point. OMP distributes routes. IPsec tunnels move the data.

Commands that prove the design

Command	What it proves
`show etherchannel summary`	Both links of the bundle are in use
`show spanning-tree root`	The root bridge is where the design put it
`show standby brief`	The FHRP active gateway is the correct switch
`show redundancy states`	The standby supervisor is ready for SSO
`show sdwan control connections`	The routers have sessions to the controllers
`show sdwan omp peers`	OMP peering is up
`show sdwan bfd sessions`	Data plane tunnels are up
`show lisp instance-id <id> ipv4 map-cache`	The fabric knows where the endpoints are
`show cts role-based permissions`	SGT policy is active
`show policy-map interface`	QoS classes match real traffic (counters increase)

Lab: read a design like the exam

This is a paper lab. No devices are necessary.

Topology:

          [DSW1]====[DSW2]
           |  \    /  |
           |   PC10   |
           |  /    \  |
          [ASW1]  [ASW2]
            |        |
         VLAN 10  VLAN 10
         users     users

Do these steps:

Name the Layer 3 boundary. (Answer: DSW1 and DSW2.)
Name the control point for the default gateway of VLAN 10. (Answer: the FHRP active switch.)
Name the failure domain of ASW1. (Answer: only the endpoints on ASW1.)
Name the command that proves the gateway is redundant. (Answer: show standby brief.)
Add two WAN transports to the drawing. Name the control point if the site uses SD-WAN. (Answer: the SD-WAN Controller.)
Replace DSW1 and DSW2 with fabric edge nodes. Name the new control point for endpoint location. (Answer: the control plane node.)

If you can do these six steps for any topology, you have the correct habit for Domain 1.

Pass check

You are ready for Domain 1 when you can do these things:

Explain why a 3-tier campus is not always better than a 2-tier campus.
Explain why an SD-WAN overlay still depends on the underlay.
Explain why SD-Access still needs routing to leave the fabric.
Show that QoS verification starts with counters, not with the configuration text.