Free CCNP practice test — 1,923+ CCNP practice questions with detailed explanations across all 6 official CCNP exam domains. Every 350-401 ENCOR practice test set is scored, timed, and drawn from the live question bank — so you practise exactly what the exam tests, not outdated dumps.
Courseiva includes 1,923+ ENCOR 350-401 practice questions across the official exam domains.
Feature
Courseiva
This free CCNP practice test mirrors the structure and difficulty of the real ENCOR 350-401 exam. Every question is written against the official 2026 exam blueprint published by Cisco, ensuring you practise exactly what the exam tests — not last year's objectives.
The CCNP blueprint is divided into 6weighted domains. Questions on this page are distributed proportionally across each domain, so the mix you see here reflects the same weighting you'll face on exam day. High-weight domains like Infrastructure and Security contribute the most questions, meaning focused practice on these areas gives you the highest return on study time.
CCNP Exam Blueprint — 6 Domains
Architecture
Virtualization
Infrastructure
Network Assurance
Security
Automation
102 numbered sets, 6 domain question banks, and targeted sessions — every page is a unique set of questions.
… and 6 more sets up to Practice Test 102
Choose all correct answers
Match concepts to definitions
Arrange steps in the correct order
Each chapter page covers one topic in depth — theory, key concepts, and focused practice questions. Use these to close knowledge gaps before returning to full practice tests.
Getting the most from practice questions requires more than just clicking through answers. Here is the study method used by candidates who pass CCNP on their first attempt:
Answer before revealing
Read each CCNP question fully, eliminate obviously wrong choices, then commit to an answer before clicking to reveal. This active recall process is what builds lasting knowledge.
Read every explanation
Even when you answer correctly, read the full explanation. Knowing WHY the right answer is correct — and why the distractors are wrong — is what separates a 750 score from a 900 score.
Track weak domains
Note which CCNP domains you get wrong most often. Then do a targeted 20-30 question session focused only on that domain until your accuracy improves.
Simulate exam pacing
The real CCNP gives you roughly 1.3 minutes per question. Use the 60 or 120-question sessions to practise hitting that pace comfortably.
Most candidates who pass CCNP on their first attempt report doing between 400 and 800 practice questions over 4–8 weeks of preparation. With 1,923+ questions in the Courseiva bank, you have more than enough material to build that repetition without seeing the same question twice.
Answer each question to reveal the full explanation and correct answer. This starter set is drawn from all 6 exam domains in blueprint proportion. Use the session selector to start a longer focused practice run.
A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?
Select an answer to reveal the explanation
A network administrator is deploying Cisco Application Centric Infrastructure (ACI) and needs to allow two endpoint groups (EPGs) in different bridge domains to communicate while applying a contract that permits only TCP port 443. Which ACI construct provides the policy enforcement point where the contract is applied?
Select an answer to reveal the explanation
A network engineer is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance for a guest network. The engineer wants to ensure that traffic from the guest VRF cannot leak into the corporate VRF. Which configuration step is required to maintain isolation between VRFs?
Select an answer to reveal the explanation
A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?
Select an answer to reveal the explanation
A network engineer is implementing QoS on a WAN link to prioritize voice traffic. Which queuing mechanism provides the lowest latency for real-time traffic?
Select an answer to reveal the explanation
A network engineer runs the following command on Switch SW1:
SW1# show etherchannel summary
Flags: D - down P - bundled in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator
M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port
Number of channel-groups in use: 1 Number of aggregators: 1
Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------------- 1 Po1(SU) LACP Gi0/1(P) Gi0/2(P) Gi0/3(D)
Based on this output, what can be concluded?
Select an answer to reveal the explanation
A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE router. The VRF CUSTOMER_C has route-target import 300:1 and export 300:1. The PE receives VPNv4 routes from the route reflector, but the CE router connected to the PE cannot ping any remote site IP addresses. The PE can ping the remote site IP addresses from the VRF. What is the most likely cause?
Select an answer to reveal the explanation
A network engineer is troubleshooting an STP issue in a network that uses Rapid PVST+. The network has a root bridge (SW1) and a secondary root bridge (SW2). The engineer notices that after a link failure between SW1 and SW2, the network takes longer than expected to converge. The engineer checks the configuration and finds that SW2 has the 'spanning-tree uplinkfast' command enabled. The engineer also notices that SW2 has a lower priority than SW1. What is the most likely cause of the slow convergence?
Select an answer to reveal the explanation
A network engineer is configuring EIGRP on a router that connects to a service provider network. The engineer wants to advertise a default route to internal routers. The engineer configures 'ip default-network 0.0.0.0' and redistributes a static default route into EIGRP. However, internal routers are not receiving the default route. The engineer checks the EIGRP topology table and sees the default route with a metric of 1. What is the most likely reason?
Select an answer to reveal the explanation
Examine the following IPsec configuration snippet:
crypto ikev2 proposal IKEV2_PROP
encryption aes-cbc-256 integrity sha256 group 14 !
crypto ikev2 policy IKEV2_POL
proposal IKEV2_PROP !
crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
mode tunnel !
crypto ipsec profile IPSEC_PROF
set transform-set TSET set ikev2-profile IKEV2_POL
Which statement about this configuration is true?
Select an answer to reveal the explanation
An organization uses Ansible to manage network device configurations. They have a playbook that uses the ios_command module to execute 'show ip route' on multiple routers and then uses the 'debug' module to print the output. Recently, the playbook started failing with 'Timeout (12s) waiting for privilege escalation prompt'. The routers are reachable and SSH credentials are correct. What is the most likely cause?
Select an answer to reveal the explanation
A network engineer configures IP SLA 20 to monitor the response time of a DNS server at 10.1.1.1 using DNS query for 'example.com'. The operation is used to influence routing decisions. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 50 ms', but the DNS server is actually down and not responding to any queries. What is the most likely reason?
Select an answer to reveal the explanation
A company is deploying a new Cisco wireless LAN controller (WLC) and wants to use RADIUS for authenticating wireless users. The WLC is configured with the RADIUS server IP, shared secret, and authentication port 1812. However, users are unable to authenticate. The network engineer checks the RADIUS server logs and sees that the server is receiving authentication requests from the WLC but is responding with an 'Access-Reject' message. The WLC logs show 'RADIUS server not responding' for the same server. What is the most likely cause?
Select an answer to reveal the explanation
An engineer configures IP SLA 100 to monitor the jitter and latency of a VoIP call path between two branch routers. The configuration uses UDP jitter with a target of 192.168.2.2 on port 16384. The engineer notices that the IP SLA operation shows 'State: Active' but no jitter or latency statistics are collected. The router is generating the probe packets, but the remote router does not respond. What is the most likely reason?
Select an answer to reveal the explanation
An engineer is configuring RSPAN to monitor traffic from multiple switches in a data center. The monitoring station is connected to a central switch. The engineer has configured an RSPAN VLAN (VLAN 999) on all switches and set up the source sessions on the remote switches. However, the monitoring station receives no traffic. On the central switch, the engineer verifies that the RSPAN VLAN is active and that the destination session is configured. What is a likely missing configuration?
Select an answer to reveal the explanation
Consider the following SPAN configuration on a Cisco IOS-XE switch:
monitor session 2 source interface GigabitEthernet1/0/3 rx monitor session 2 destination interface GigabitEthernet1/0/4
What is the effect of this configuration?
Select an answer to reveal the explanation
A network engineer is troubleshooting a DHCP issue where a client is not receiving an IP address from a Cisco router configured as a DHCP server. The engineer checks the DHCP pool configuration and sees that the network command is configured with the correct subnet. The engineer also verifies that the ip dhcp excluded-address command is not blocking any addresses. However, the client's DHCP discover message is not reaching the router. What is the most likely cause?
Select an answer to reveal the explanation
A network engineer is configuring a Cisco switch for 802.1X port-based authentication. The switch is configured with a RADIUS server for authentication. The engineer wants to allow devices that fail 802.1X authentication to still access a limited guest VLAN. The engineer configures 'authentication port-control auto' and 'authentication host-mode multi-host' on the interface. However, when a non-802.1X-capable device is connected, the port remains in the unauthorized state and does not fall into the guest VLAN. What is missing?
Select an answer to reveal the explanation
interface GigabitEthernet0/2 spanning-tree link-type point-to-point
end
What is the effect of this configuration?
Select an answer to reveal the explanation
Given the following SNMPv3 configuration on a Cisco IOS-XE router:
snmp-server group ADMIN v3 priv write ADMINVIEW snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456 snmp-server view ADMINVIEW iso included
What is missing or incorrect in this configuration?
Select an answer to reveal the explanation
Answer all 20 questions to see your domain score breakdown
A structured study plan dramatically increases your chances of passing CCNP on the first attempt. The most effective approach combines reading the official Cisco documentation or a study guide, watching video explanations for difficult concepts, and then reinforcing everything with daily practice questions.
We recommend the following weekly structure for CCNP preparation:
Cover each CCNP domain systematically. Read the exam objectives, watch explanatory content, and do 10–20 practice questions per domain to test understanding as you go.
Run full 50–60 question mixed sessions daily. Review every wrong answer in detail. Identify which domains are consistently scoring below 70% and revisit those study materials.
Do 100–120 question timed sessions to simulate real exam conditions. Aim for consistent scores above 80% before booking your exam date. A score above 80% in practice typically translates to a passing CCNP score.
On exam day, the CCNP tests your ability to apply knowledge to realistic scenarios — not just recall definitions. This is why reading explanations and understanding the reasoning behind every answer matters more than simply grinding question volume. Use the high-count sessions (100, 120) in the final weeks as your confidence benchmark.
Questions
90
On the real exam
Time limit
120 min
1.3 min per question
Passing score
Variable
See vendor page
Cisco passing scores vary by exam version and are not always publicly listed.
CLI output, topology diagrams, routing protocols (OSPF, BGP, EIGRP), switching, SD-WAN, SD-Access, and automation scenario questions.
Yes. Courseiva provides free ENCOR 350-401 practice questions with explanations across the official exam domains. Start with a quick practice test, then continue with topic-based practice, mock exams, missed-question review, bookmarked questions, weak-topic recommendations, and readiness tracking. No account required. Create a free account to unlock per-domain analytics and progress tracking across every certification on the platform. Courseiva is free forever, supported by advertising.
Every question is written against the official CCNP exam blueprint published by Cisco. Our questions follow the same wording style, scenario complexity, and answer structure as the actual exam. They are original questions — not brain dumps — so you learn the underlying concepts and reasoning, not just memorised answers. Candidates who study with brain dumps often pass but have no transferable knowledge; Courseiva questions make you genuinely competent.
Most candidates who pass CCNP on their first attempt do 30–60 questions per day. Use the Quick 10 session for daily warm-ups when you are short on time. On study days, run a 50 or 60-question session to build stamina. Reserve 100 and 120-question sessions for the final two weeks when you want to simulate real exam conditions and benchmark your readiness.
The CCNP covers 6 domains: Architecture (15%), Virtualization (10%), Infrastructure (30%), Network Assurance (10%), Security (20%), Automation (15%). Each domain carries a different weight, so allocate your study time accordingly. The highest-weighted domains — Infrastructure and Security — should receive the most attention.
Exam dumps are memorised question-and-answer lists taken from actual exam papers, often obtained illegally and shared without Cisco's authorisation. Using them violates your NDA and Cisco's certification agreement, and can result in certification revocation. Courseiva questions are original — AI-assisted, checked against the official exam objectives, and published under the editorial oversight of an engineer with 12+ years' experience. They test the same knowledge areas using new scenarios and wording. You learn the material, not just the answers.
Per-domain analytics, spaced repetition, daily challenges — and every other certification on the platform.
Sign Up FreeFree forever · Every certification included