CCNP Enterprise ENCC Practice Exams

The 300-440 ENCC exam — Designing and Implementing Secure Cloud Connectivity — is a CCNP Enterprise concentration exam that, combined with the 350-401 ENCOR core exam, earns the CCNP Enterprise certification; passing it alone also earns the Cisco Certified Specialist – Cloud Connectivity designation. It is the newest concentration in the enterprise track and sits at the boundary between enterprise networking and public cloud, which is where most enterprise WAN work has moved. The blueprint covers architecture models (15%) — internet-based connectivity to AWS, Azure and Google Cloud, private connectivity through Direct Connect, ExpressRoute, Cloud Interconnect, colocation and software-defined cloud interconnect, and SaaS connectivity patterns; design (15%) — high availability and resiliency, bandwidth, QoS and multihoming requirements, regulatory compliance, and cloud security policy; IPsec cloud connectivity (25%) — GRE and IPsec tunnels between on-premises and cloud endpoints, IKEv2 negotiation and transform selection, virtual tunnel interfaces, and BGP and OSPF routing integration over the tunnels; SD-WAN cloud connectivity (25%) — Cisco Catalyst SD-WAN secure cloud connectivity, Cloud OnRamp for IaaS, SaaS and multicloud, cloud gateways and transit constructs, and security, routing and application-aware policy; and operation (20%) — diagnosing IPsec negotiation and tunnel failures, troubleshooting routing across cloud boundaries, and SD-WAN diagnostics. The exam runs 90 minutes.

• 1Completes CCNP Enterprise when paired with the 350-401 ENCOR core exam
• 2Passing it alone earns the Cisco Certified Specialist – Cloud Connectivity designation
• 3Covers the cloud-to-enterprise boundary, which is where most enterprise WAN redesign work now happens
• 4Vendor-neutral enough to be useful across AWS, Azure, and Google Cloud rather than tied to one provider
• 5Pairs naturally with cloud provider networking certifications for engineers working hybrid and multicloud

• ✓Compare internet-based and private connectivity models for reaching public cloud providers
• ✓Select between AWS Direct Connect, Azure ExpressRoute, and Google Cloud Interconnect for a stated requirement
• ✓Evaluate colocation and software-defined cloud interconnect as alternatives to a direct circuit
• ✓Design SaaS connectivity including direct internet access, backhaul, and proxy or gateway patterns
• ✓Choose between hub-and-spoke, transit, and mesh cloud network topologies
• ✓Design high availability and resiliency across circuits, devices, availability zones, and regions
• ✓Size bandwidth and apply QoS where the transport permits it, and design multihoming
• ✓Account for data residency, sovereignty, and regulatory compliance in a connectivity design
• ✓Apply cloud security policy including segmentation, inspection placement, and egress control
• ✓Configure GRE and IPsec tunnels between on-premises devices and cloud VPN endpoints
• ✓Select IKEv2 proposals, transform sets, and authentication methods appropriate to a cloud endpoint
• ✓Implement virtual tunnel interfaces and route-based VPN toward cloud providers
• ✓Integrate BGP and OSPF routing across cloud tunnels including route advertisement and filtering
• ✓Handle MTU and MSS correctly across encapsulated and encrypted cloud paths
• ✓Design redundant cloud VPN with multiple tunnels, ECMP, and failover behavior
• ✓Deploy Cisco Catalyst SD-WAN secure connectivity into cloud environments
• ✓Implement Cloud OnRamp for IaaS, SaaS, and multicloud including gateway placement
• ✓Configure SD-WAN security, routing, and application-aware policy for cloud destinations
• ✓Integrate SD-WAN with a secure internet gateway for cloud and internet egress
• ✓Diagnose IPsec failures including proposal mismatch, authentication, NAT traversal, and rekey issues
• ✓Troubleshoot routing problems across cloud boundaries including propagation and path selection
• ✓Use SD-WAN diagnostics for control connections, data plane tunnels, and policy application