300-420 Designing Cisco Enterprise Networks Exam Topics and Questions

This topic sets the technical foundation for everything that follows. At 25%, it is the single largest slice of the exam, and it demands design thinking, not just protocol knowledge. You are expected to reason about why a particular addressing scheme or routing protocol choice holds up under scale, failure, and security constraints. Gaps here will cost you more marks than anywhere else on the paper.

– Structured addressing for IPv4 and IPv6

Addressing design questions test whether you can produce a plan that survives growth and simplifies routing, not just one that fits the current node count. For IPv4 that means hierarchical summarisation aligned to topology boundaries. For IPv6 it means understanding how prefix delegation, address types, and allocation policies interact with your routing design. The examinable edge is where an addressing decision forces a routing consequence, for example a poorly chosen boundary that prevents clean summarisation and forces route leakage. Know how to size and allocate prefixes so that summarisation is possible at every tier, and know what breaks when it is not.

– IS-IS, EIGRP, and OSPF design

Each of these three interior protocols has its own stability levers, and the exam tests whether you can match the lever to the problem. For OSPF, area design and LSA types are the design variables: know which area types suppress which LSAs and what that does to reachability. For IS-IS, understand why it is often preferred in very large provider-style topologies and what adjacency and level design look like at scale. For EIGRP, feasibility conditions and stub routing are the points where design decisions directly affect convergence and loop prevention. Security for all three comes down to neighbour authentication and controlling redistribution boundaries. Mixing protocols through redistribution is a common trap: metric translation errors and routing loops are the failure modes the exam will probe.

– BGP path control and scalability

BGP carries more sub-topic weight here than any other protocol, and the exam reflects that depth. Address families determine what BGP carries; getting the wrong family configured means the right prefixes never appear in the right table. Route filtering with prefix lists and route maps is the mechanism; attribute manipulation with LOCAL_PREF, MED, and AS_PATH is the policy layer on top. Know which attributes are locally significant and which cross AS boundaries, because that distinction drives path preference questions. Route reflectors and confederations both solve iBGP full-mesh scaling, but they do it differently and each introduces its own design constraints around cluster IDs and loop prevention. Load sharing across multiple paths requires understanding both the equal-cost and unequal-cost cases, and what has to be configured to enable each.

– IPv6 migration strategies

Migration strategy questions are framed as design choices, not configuration tasks. Overlay approaches, primarily tunnelling mechanisms such as 6in4 and GRE, let IPv6 traffic traverse an IPv4 core without touching every device. Dual-stacking runs both protocol families natively and is the cleanest long-term state, but it requires every node in the path to support both. Translation mechanisms at IPv4/IPv6 boundaries, including NAT64 and its variants, are the option of last resort when endpoints cannot be updated. The exam will present scenarios where one approach is clearly better given the constraints, and you need to identify which constraint rules out the alternatives. Focus on the conditions under which each strategy fails or becomes operationally unmanageable.

How Advanced Addressing and Routing Solutions is tested

At 25% of the exam, this topic generates more items than any other, and they skew toward multi-variable scenario questions. You will be given a topology with specific constraints, such as a summarisation requirement, a scalability ceiling, or a security policy, and asked which design decision satisfies all of them. Items reward candidates who can eliminate options by finding the one that violates a stated constraint, rather than candidates who simply recall protocol features.

BGP questions in particular tend to layer attributes, so a path preference scenario may involve LOCAL_PREF, MED, and AS_PATH simultaneously. Candidates lose marks by treating each attribute in isolation. IPv6 migration questions reward matching the strategy to the scenario constraints; selecting dual-stack when the scenario states legacy devices cannot run IPv6 is a common miss. OSPF and IS-IS items often hinge on area or level boundary placement. Know the design rule, not just the configuration command.

Where the previous topic dealt with protocol mechanics across the wide network, this one narrows to the campus: a bounded, high-density environment where availability and scale pull in opposite directions. At 25%, it matches the routing topic in weight, and it covers a wider surface. The risk here is breadth: candidates who know STP or FHRP in isolation often miss the questions that combine Layer 2 stability with Layer 3 design, or that place SD-Access architecture alongside traditional campus decisions.

– High availability at the campus edge and core

First Hop Redundancy Protocols, HSRP, VRRP, and GLBP, are the most visible HA tool at the access layer, but the exam tests the design trade-offs between them, not just their configuration. GLBP load-shares; HSRP and VRRP do not by default. Know when that distinction changes the design recommendation. Platform abstraction techniques such as VSS and StackWise reduce the logical complexity of the network by making redundant hardware appear as a single device, which simplifies spanning tree and routing adjacencies. Graceful restart and non-stop forwarding keep the control plane alive during a supervisor switchover while the forwarding plane continues. BFD sits underneath all of this as a fast failure-detection mechanism that is protocol-agnostic. The design question is always which combination of these tools meets the recovery time objective without over-engineering the platform.

– Layer 2 infrastructure design

Spanning tree questions at this level are about design, not troubleshooting. STP scalability means knowing where to place root bridges, how many VLANs a topology can support before it becomes unmanageable, and which STP variants reduce convergence time. Rapid PVST+ and MST are the relevant variants; know the operational difference. Loop-free technologies such as BPDU Guard, Root Guard, and Loop Guard each protect a different boundary in the topology; placing them correctly is the examinable skill. Fast convergence mechanisms including PortFast and RSTP edge ports matter at the access layer. PoE design involves power budgeting across switches, and Wake-on-LAN has specific forwarding requirements that affect VLAN design. Layer 2 security, spanning tree protection, port security, and VACLs, is tested as a design choice: which mechanism belongs at which boundary and why.

– Multicampus Layer 3 infrastructure

When campuses connect, the Layer 3 design variables multiply. Convergence time, load sharing, route summarisation, and route filtering all interact, and the exam tests whether you can hold all of them in mind simultaneously. VRFs are the segmentation tool at Layer 3, and the design question is where VRF boundaries go and how routes leak between them when they need to. Redistribution between routing domains is a persistent source of exam difficulty because metric translation and potential loops require careful policy design. Optimal topology questions ask you to weigh redundancy against the complexity of maintaining consistent routing policy across multiple sites. Route summarisation is only possible if the addressing design from the previous topic was done correctly: this is where a poor addressing decision from Topic 1 produces a visible failure in Topic 2.

– SD-Access architecture and fabric design

SD-Access questions are descriptive rather than configuration-based, but descriptive does not mean easy. The exam expects you to map each function, underlay, overlay, control plane, data plane, automation, and security, to its role in the fabric. LISP handles the control plane; VXLAN carries the data plane. The fabric border connects to external networks and is where policy enforcement crosses the SD-Access boundary. Segmentation through virtual networks and scalable group tags is the SD-Access answer to the VRF and VLAN sprawl problem in traditional campus designs. Wireless integration runs either over the top, using existing wireless infrastructure, or natively inside the fabric, and the design trade-offs between those two modes are testable. Multicast behaviour inside the fabric differs from traditional campus multicast and is worth specific attention.

How Advanced Enterprise Campus Networks is tested

Items in this topic frequently present a campus topology with a stated availability or scalability requirement and ask which design change satisfies it. The trap is that multiple options may appear technically valid; the item rewards the one that meets the requirement without introducing a new problem, such as a loop risk or a single point of failure.

SD-Access questions reward candidates who understand the function of each plane rather than those who can recall marketing descriptions. Expect to distinguish between what the control plane does and what the data plane does, and to identify which component handles a specific function such as policy enforcement or host mobility.

Layer 2 security items are often written as scenarios where a specific attack vector, such as BPDU spoofing or MAC flooding, is described. The item rewards selecting the mechanism that addresses that specific vector at the appropriate boundary. Candidates lose marks by selecting a mechanism that is real and relevant but positioned at the wrong layer or the wrong port type.

Campus design optimises within a controlled boundary. WAN design starts where that boundary ends, and the constraints change completely: you are working with carrier services, variable latency, cost trade-offs, and connectivity models that span from dedicated private circuits to internet-based overlays to cloud on-ramps. At 20%, this topic rewards candidates who can match a connectivity or VPN technology to a specific scenario requirement, and who understand how SD-WAN changes the design calculus.

– WAN connectivity options

The connectivity layer covers a range of technologies with very different cost, latency, and bandwidth profiles. Layer 2 VPN services hand you an Ethernet segment across a provider network; MPLS Layer 3 VPN hands you a routed interface with provider-managed PE routing. Metro Ethernet sits at the boundary between those two models depending on the service variant. DWDM operates at the optical layer and is relevant when bandwidth density and distance are the primary constraints. 4G and 5G matter as backup or primary connectivity for sites where fibre is unavailable or cost-prohibitive. SD-WAN customer edge changes the model again by abstracting the underlay transport and centralising policy. The exam tests whether you can identify which option fits a given set of constraints: SLA requirements, provider availability, cost ceiling, and whether the customer or the provider manages the routing.

– Site-to-site VPN design

VPN design questions focus on which technology fits the topology and security requirements of the scenario. DMVPN solves the spoke-to-spoke scaling problem that static point-to-point GRE tunnels create; know the three phases and what each one enables for spoke-to-spoke traffic. GRE on its own provides encapsulation without encryption; IPsec provides encryption without native multicast support. Combining them is common and the design trade-offs of doing so are testable. GET VPN is the option for MPLS environments where the provider network is trusted and you want encryption without tunnelling overhead, because it preserves the original IP header for MPLS routing. Layer 2 VPN and MPLS Layer 3 VPN appear again here in the context of site-to-site design, and the distinction between them in terms of customer routing control is the examinable point.

– WAN high availability design

HA design across the WAN is about eliminating single points of failure at the right cost. Single-homed designs have one connection to one provider and are the baseline against which everything else is measured. Dual-homing to a single provider removes the CE-to-PE link as a single point of failure but leaves the provider itself as one. Multihoming across two providers removes the provider as a single point of failure but introduces BGP policy complexity. Backup connectivity using a secondary transport, such as 4G or broadband internet, is cheaper than full multihoming but has a lower SLA. Failover design questions ask you to identify the recovery mechanism, whether that is IP SLA tracking, BFD, or floating static routes, and to match it to the failure scenario. The exam rewards candidates who can identify which failure mode a given HA design does not protect against.

– Cisco SD-WAN architecture and design

SD-WAN architecture questions follow the same plane-based framing as SD-Access: orchestration, management, control, and data planes each have a distinct role. The vBond orchestrator handles onboarding; vSmart manages the control plane through OMP; vManage is the management plane. The data plane runs on vEdge or IOS XE SD-WAN devices. Onboarding and provisioning are testable because the sequence matters and errors in the trust chain prevent devices from joining the fabric. Design considerations span control plane topology, overlay design across multiple transport types, LAN-side design, redundancy, and scalability. QoS and multicast over the SD-WAN fabric are specific design problems because the overlay abstracts the underlay, and policies must account for transport variability. Security design in SD-WAN covers segmentation through VPNs and the placement of security policy enforcement.

How WAN for Enterprise Networks is tested

WAN items are heavily scenario-driven. You will be given a site profile, a connectivity requirement, and a set of constraints, and asked to select the design that meets all three. The most common candidate error is selecting a technology that solves the primary requirement while violating a secondary constraint, such as choosing a solution that does not support multicast when the scenario requires it.

SD-WAN architecture questions reward precise mapping of function to component. Candidates who blur the boundary between what vSmart does and what vManage does will lose marks on items that hinge on that distinction.

VPN technology questions reward understanding of what each protocol does and does not provide natively. GET VPN questions in particular reward knowing the specific deployment context that makes it appropriate. HA questions reward identifying the residual single point of failure in a proposed design, not just confirming that redundancy exists. Items in this topic tend to have two options that both add redundancy, and the item rewards the one that addresses the specific failure mode described in the scenario.

WAN design gets traffic to the right place. Network services design determines what happens to that traffic along the way. QoS, network management, and multicast each operate across the full path, and each one requires policy decisions that span multiple devices and domains. At 20%, this topic tests whether you can translate a service requirement into a coherent end-to-end design, not just configure a single feature on a single box.

– QoS strategy and policy selection

DiffServ and IntServ represent two fundamentally different approaches to quality of service, and the exam tests when each is appropriate. IntServ provides per-flow guarantees through RSVP signalling, which scales poorly across large networks. DiffServ classifies traffic into behaviour aggregates at the edge and applies per-hop behaviours throughout the network, making it the practical choice for enterprise and service provider scale. The design question is where to classify and mark traffic, because reclassification at a trust boundary can undo upstream policy. Knowing which DSCP markings map to which per-hop behaviours, and which markings are commonly used for voice, video, and critical data, is the baseline. The exam rewards candidates who can identify the correct classification boundary and the correct marking strategy for a given traffic type and network topology.

– End-to-end QoS mechanisms

End-to-end QoS design requires understanding how classification, marking, shaping, policing, and queuing interact across a path. Classification and marking happen at the ingress edge; everything downstream depends on getting that right. Shaping smooths traffic to a rate, buffering bursts; policing drops or re-marks traffic that exceeds a rate without buffering. The difference matters for voice and video: shaping introduces delay, which is worse for real-time traffic than policing-induced drops in some designs. Queuing determines what leaves the interface when congestion occurs. CBWFQ allocates bandwidth by class; LLQ adds a strict priority queue for latency-sensitive traffic. The exam tests whether you can identify the queuing mechanism that meets a stated latency or drop requirement, and whether you can spot a design where a downstream device's policy contradicts the upstream marking.

– Network management design

Management design questions are less glamorous than QoS, but they appear consistently. In-band management uses the production network to carry management traffic; out-of-band uses a separate path, typically through console servers or a dedicated management network. The design choice hinges on whether you can reach a device when the production network is impaired. Segmented management networks, often implemented as a dedicated VRF or a physically separate OOB network, prevent management traffic from being affected by production events or from being used as an attack path. Prioritising management traffic with QoS markings ensures that SSH sessions and SNMP polling are not dropped during congestion on the production network. The exam rewards candidates who can identify which management architecture is appropriate given the availability and security requirements of the scenario.

– Multicast routing and services design

Multicast questions cover both conceptual understanding and design choices. Source trees build the shortest path from each source to all receivers; shared trees root at the rendezvous point and trade optimality for simplicity. Reverse Path Forwarding is the loop-prevention mechanism that makes multicast forwarding work; understanding why RPF checks fail, typically because of asymmetric routing, is more useful than knowing the check itself. Rendezvous point placement and redundancy are design decisions: a poorly placed or single RP is a single point of failure for all shared-tree traffic. SSM eliminates the RP for source-specific applications. PIM bidirectional uses the shared tree in both directions and scales better for many-to-many applications. MSDP connects multiple PIM-SM domains. Service reflection addresses specific deployment scenarios where multicast sources and receivers are separated by a unicast-only segment.

How Network Services is tested

QoS items dominate this topic and tend to be the most calculation-adjacent questions on the exam. You will not be asked to perform arithmetic, but you will need to reason about bandwidth allocation, queue priority, and the downstream effects of marking decisions. Items reward candidates who can trace a packet's treatment from ingress classification through to egress queuing and identify where a stated service requirement is violated.

Multicast items reward understanding the conditions under which each design choice, SSM versus ASM, shared tree versus source tree, applies. The trap is selecting a mechanism that works in a simple topology but fails when the scenario adds asymmetric routing or multiple domains.

Management design items are often written as security or availability scenarios. Candidates lose marks by selecting in-band management when the scenario describes a condition where the production network may be unavailable. Identifying the specific vulnerability or failure mode that the management architecture must address is the skill these items test.

After four topics built on protocol design and topology decisions, this one shifts to the programmatic and cloud layer. At 10%, it is the lightest topic by weight, but do not treat it as optional revision. The questions here test conceptual precision: the differences between standards, protocols, and data models are small on paper and large in exam terms. Candidates who have worked primarily with CLI-based network management often find this topic the least familiar and lose marks they did not expect to lose.

– Data models and configuration protocols

YANG is the data modelling language; NETCONF and RESTCONF are the protocols that carry YANG-modelled data between a client and a network device. The exam tests whether you can keep those layers distinct. IETF YANG models are vendor-neutral and standardised; OpenConfig models are also vendor-neutral but are developed by a separate operator-led working group with a focus on operational consistency across vendors; Cisco YANG models are vendor-specific and expose Cisco-proprietary features. Knowing which model type to select for a given interoperability requirement is the examinable skill. NETCONF uses SSH as its transport and operates on full configuration datastores; RESTCONF uses HTTP and exposes individual resources. The operational difference matters when the scenario specifies a transport constraint or a granularity requirement.

– Telemetry, gRPC, and cloud connectivity

Model-driven telemetry replaces polling-based monitoring by pushing data from network devices to a collector. Periodic publication sends data on a fixed timer regardless of whether values have changed; on-change publication sends data only when a monitored value changes. The design trade-off is volume versus latency: periodic publication is predictable but generates data even when nothing is happening; on-change is efficient but requires the device to support change detection for the relevant model path. gRPC is the transport protocol underlying gNMI, which is the interface used to configure subscriptions and retrieve data in a model-driven telemetry deployment. Cloud connectivity options, direct connect, cloud on-ramp, MPLS direct connect, and WAN integration, connect enterprise networks to cloud providers with different latency, cost, and traffic engineering characteristics. The IaaS, PaaS, and SaaS service model distinctions determine what the customer is responsible for designing and managing in private, public, and hybrid deployments.

How Automation and Artificial Intelligence is tested

Items in this topic reward precise distinctions between things that look similar. NETCONF versus RESTCONF questions reward knowing the transport and operational scope of each, not just that both carry YANG data. YANG model questions reward knowing which organisation produces each model type and what that means for portability across vendors.

Telemetry questions reward understanding the operational difference between periodic and on-change publication, and which one is appropriate for a given monitoring requirement. Candidates lose marks by treating both publication modes as interchangeable.

Cloud service model questions reward mapping the customer's design responsibility to the correct model layer. In IaaS the customer designs the operating system and above; in PaaS the platform is managed and the customer designs the application; in SaaS the customer designs neither. Items will present a scenario and ask which model applies, or which connectivity option is appropriate given the traffic pattern and provider relationship. The 10% weight means fewer items, but each one tests a specific distinction that is easy to blur under time pressure.