Ask a room of network engineers which part of ENCOR scares them and you'll get the same answer every time. Not OSPF. Not the wireless roaming stuff. It's Domain 6 — Automation. Fifteen percent of the exam, and it's the fifteen percent that makes CLI veterans sweat.
Which is funny, because if you've ever written a Python script or parsed a JSON payload, that domain is the easiest free points on the whole blueprint.
I want to walk through what the 350-401 automation section actually asks you to know — from a developer's angle, not a "memorize this table" angle. If you want to pressure-test yourself as you read, run a few free 350-401 practice questions alongside this and see which of these concepts you can already answer cold.
First, what ENCOR even is
350-401 ENCOR is the core exam for CCNP Enterprise. It's also the qualifying exam for CCIE Enterprise Infrastructure and CCIE Enterprise Wireless — pass it once, it unlocks both tracks. Two hours. Cisco doesn't publish a fixed pass score, so anyone quoting you an exact number is guessing. Fee is around USD 400 (check Cisco for current pricing).
Six domains: architecture, virtualization, infrastructure, network assurance, security, automation. Infrastructure is the fat one. Automation is the one people leave until the night before and then panic about.
Don't do that.
Domain 6 in plain terms
The blueprint wants you to interpret code, not author production software. That distinction matters enormously for how you study. You will be shown a snippet and asked what it does, what's broken, or what the API returns. You will not be asked to write a class hierarchy.
So the skill you're building is reading fluency. Here's the surface area.
1. Python that touches network devices
You need to recognize the shape of a script. Something like this shows up constantly:
import requests
from requests.auth import HTTPBasicAuth
url = "https://10.1.1.1/restconf/data/ietf-interfaces:interfaces"
headers = {
"Accept": "application/yang-data+json",
"Content-Type": "application/yang-data+json",
}
resp = requests.get(
url,
auth=HTTPBasicAuth("admin", "cisco123"),
headers=headers,
verify=False,
)
print(resp.status_code)
for intf in resp.json()["ietf-interfaces:interfaces"]["interface"]:
print(intf["name"], intf["enabled"])
Questions built on this ask things like: what does the Accept header tell the device? (Return YANG-modeled data as JSON.) What status code means the resource doesn't exist? (404.) What happens if you drop verify=False against a device with a self-signed cert? (TLS verification error.)
Know your HTTP verbs and what they mean in a RESTCONF context, because Cisco loves this:
| Verb | RESTCONF meaning |
|---|---|
| GET | Read config or operational state |
| POST | Create a new resource (fails if it exists) |
| PUT | Replace a resource entirely (create or overwrite) |
| PATCH | Merge — change only the fields you send |
| DELETE | Remove the resource |
The POST-vs-PUT-vs-PATCH distinction is a classic trap. PATCH merges. PUT replaces. If you PUT an interface config with only a description field, you've just wiped everything else on that interface. That's a real outage, and it's also a real exam question.
2. JSON, XML, YAML — data formats
You need to look at a payload and answer questions about structure. Given:
{
"device": {
"hostname": "core-sw-01",
"interfaces": [
{ "name": "GigabitEthernet1/0/1", "vlan": 10 },
{ "name": "GigabitEthernet1/0/2", "vlan": 20 }
]
}
}
You should be able to say instantly that device.interfaces is a list of two dictionaries, and that pulling the VLAN off the second interface in Python is data["device"]["interfaces"][1]["vlan"]. Zero-indexed. They will absolutely test whether you know it's zero-indexed.
YAML is the same data, different clothes — indentation-significant, no braces, used by Ansible. XML is the same data again, wrapped in tags, and it's what NETCONF speaks.
3. YANG, NETCONF, RESTCONF — how they relate
This trips people up because the names sound interchangeable. They aren't.
YANG is a modeling language. It describes what configuration and state data exists on a device and what shape it takes. It's a schema, not a protocol. Think of it as the contract.
NETCONF is a protocol. It runs over SSH (port 830), speaks XML, and has an explicit concept of datastores — running, candidate, startup. Because it supports a candidate datastore with commit and confirmed-commit, it can do transactional config changes. That's the killer feature: stage it, commit it, and if you lose reachability, the device rolls back.
RESTCONF is also a protocol. HTTP-based, speaks JSON or XML, maps neatly onto REST verbs, simpler to work with from a script. But no candidate datastore, no transactional rollback.
One line to memorize: YANG is the model, NETCONF and RESTCONF are the transports that carry it.
4. EEM — the automation that lives on the box
Embedded Event Manager is Cisco's on-device automation, and it's very much still on the blueprint. Applets are the readable flavor:
event manager applet WAN-DOWN
event syslog pattern "Interface GigabitEthernet0/1, changed state to down"
action 1.0 cli command "enable"
action 2.0 cli command "configure terminal"
action 3.0 cli command "interface GigabitEthernet0/2"
action 4.0 cli command "no shutdown"
action 5.0 syslog msg "Primary WAN down - backup link enabled by EEM"
Read the structure: one event trigger, numbered actions in ascending order. Exam questions hand you an applet and ask what fires it, or reorder the actions and ask why it breaks. The pattern-matching on syslog strings is regex, so a stray anchor changes the behavior.
5. Controller-based northbound APIs
Cisco DNA Center, vManage (SD-WAN), and Meraki all expose REST APIs. The exam wants you to understand the shape of controller-based operation: you authenticate, you get a token, you use the token on subsequent calls.
# Step 1: authenticate, get a token
token = requests.post(
"https://dnac.example.com/dna/system/api/v1/auth/token",
auth=("apiuser", "apipass"),
verify=False,
).json()["Token"]
# Step 2: reuse the token on every subsequent request
devices = requests.get(
"https://dnac.example.com/dna/intent/api/v1/network-device",
headers={"X-Auth-Token": token},
verify=False,
).json()
Also know the northbound/southbound vocabulary. Northbound = controller talking up to apps and scripts (REST). Southbound = controller talking down to devices (NETCONF, SNMP, CLI, Telnet). Get those backwards and you'll drop easy marks.
6. Config management tools
Puppet, Chef, Ansible — you need the differences, not deep expertise. Ansible is agentless and push-based over SSH, uses YAML playbooks, and is the one you'll see most. Puppet and Chef are agent-based and pull-based. Chef uses Ruby, Puppet uses its own DSL. That's honestly most of what's asked.
How I'd study this domain
Two weeks, part-time, if you already code:
- Days 1–3: JSON/XML/YAML conversions until they're boring. Parse payloads by hand.
- Days 4–7: RESTCONF against a DevNet Always-On sandbox. Real devices, free, no lab gear. Do a GET, then a PATCH, then break something with a PUT so you feel the difference.
-
Days 8–10: NETCONF with
ncclient. Pull a running config, understand the datastore model. - Days 11–12: EEM applets. Write three. Break two on purpose.
- Days 13–14: Drill questions. This is where you find the gaps you didn't know you had — I lean on ExamCert for that pass because the explanations tell you why the wrong answer is wrong, which matters more than the score.
The honest take
Domain 6 is 15% of ENCOR and, for anyone with a scripting background, it's the highest-yield studying you can do. Infrastructure is 30% and takes months to master. Automation is 15% and takes two weeks. Do the math on where your hours go.
Then go take a free 350-401 practice test and find out which half of the blueprint is actually your problem. It's usually not the code.
Top comments (0)