Network architecture is the structured method for designing computer networks so they are fast, secure, and scalable. For the 350-401 ENCOR exam, you must understand how network devices fit together in the three-tier hierarchical model because this blueprint is the foundation for every modern enterprise network. Without understanding this structure, you cannot troubleshoot why a network slows down or predict how to add a hundred new employees without breaking anything.
Jump to a section
A simple way to picture Network Architecture Fundamentals
A three-storey office building is a self-contained system for housing a company.
The ground floor is the Access Layer. This is where the main entrance, the reception desk, and individual office doors are located. People arrive here, get signed in, and are directed to the correct department. In a network, the Access Layer is where end-user devices, like laptops and printers, physically connect to the wired network. Switches at this layer provide the port that a device plugs into, enforcing basic rules about who is allowed on the network in the first place.
The first floor is the Distribution Layer. This floor contains the main corridors and stairwells that connect different departments. A security guard sits at the top of the stairs, checking badges and controlling which department a visitor can enter. This floor aggregates traffic from the ground floor below and applies policies, deciding, for example, that the marketing team cannot access the finance server room. This layer is responsible for routing between different groups and for segmenting the network into controlled zones.
The top floor is the Core Layer. This is the building's central spine, containing the main elevator shaft and the utility risers that run up the entire building. Its only job is to move people and services as fast as possible between floors. It does not check badges, it does not direct visitors; it just transports traffic at very high speed from one distribution point to another. In a network, the Core Layer is a high-speed backbone designed for speed and reliability, not for making security decisions.
Network architecture is the blueprint for how hardware and software components are arranged to form a functioning network. The hierarchical network design model, specifically the three-tier model, breaks a network into three distinct layers: the Access Layer, the Distribution Layer, and the Core Layer. This structure was developed by Cisco as a best practice to create networks that are scalable, resilient, and easy to manage.
Before the hierarchical model existed, many networks were built on a flat design. In a flat network, every switch was connected in a single broadcast domain, meaning that if one device sent out a broadcast message, every other device on the network received it. This caused massive slowdowns as the network grew. The hierarchical model solves this by organising devices into layers, each with a specific purpose, which limits the scope of broadcasts and makes the network predictable.
At the bottom is the Access Layer. This is the layer where end-user devices, such as desktop computers, laptops, printers, and IP phones, connect to the network. The primary device used here is a switch, often called an access switch. These switches provide physical ports that devices plug into via Ethernet cables. The Access Layer also performs basic security functions like port security, which restricts which MAC address can connect to a specific port, and VLAN assignment, which groups devices logically even if they are physically in different locations. For example, all the phones in an office might be assigned to a VLAN called Voice, separate from the data network. This layer does not usually perform routing; it is focused on getting traffic from the device to the rest of the network.
The middle layer is the Distribution Layer. This layer aggregates traffic from multiple access switches. Its primary function is to enforce policies. This is where routing decisions are made. A router or a multilayer switch at this layer decides which traffic can move between different VLANs or subnets. For instance, it might block traffic from the guest Wi-Fi VLAN to the internal payroll server VLAN. The Distribution Layer also performs Quality of Service (QoS), which prioritises certain types of traffic, such as voice calls, over less time-sensitive traffic like email. Additionally, it often summarises routes before sending them up to the Core Layer, reducing the amount of routing information the Core must process.
The top layer is the Core Layer. The Core is the high-speed backbone of the network. Its sole purpose is to move data as quickly as possible between distribution layers and to other parts of the network, such as a connection to the internet or a data centre. Core switches and routers are designed for high throughput and redundancy. They do not perform policy enforcement, ACLs, or complex routing manipulations because any processing delay would slow down the entire network. Redundancy is critical here; core devices are typically deployed in pairs so that if one fails, the other immediately takes over without any downtime.
The three-tier model is not the only design. For smaller networks, a collapsed core design is common, where the Distribution and Core layers are combined into a single layer to save cost. However, for large enterprise networks, the full three-tier model is preferred because it isolates problems and makes scaling straightforward. If a new building is added, you simply add more access switches and connect them to the existing distribution layer. If the network becomes too congested, you upgrade the core switches without needing to reconfigure every access port. These layers communicate using standardised protocols, such as Spanning Tree Protocol to prevent loops at Layer 2 and Open Shortest Path First to route traffic at Layer 3.
Identify Physical Locations and Devices
Draw a map of the office or campus. Identify where users sit, where servers are, and where internet access comes in. This determines where to place access switches and core devices.
Design the Access Layer
Select appropriate access switches based on the number of users per area. Configure VLANs for separate traffic types (e.g., data, voice, guest). Enable port security to prevent unauthorised devices. Set up Spanning Tree Protocol to prevent loops between multiple access switches.
Build the Distribution Layer
Choose distribution switches that can aggregate traffic from multiple access switches. Configure VLAN trunking between access and distribution. Enable Inter-VLAN routing using SVIs. Apply ACLs and QoS policies. Summarise routes to minimise the routing table size sent to the core.
Construct the Core Layer
Deploy two redundant core switches or routers for high availability. Connect them to the distribution layer via high-speed uplinks, typically fibre. Configure a dynamic routing protocol like OSPF. Do not apply any security policies or ACLs here. Ensure the core can handle peak traffic without exceeding 50% utilisation.
Validate and Document
Once all layers are connected, test traffic flow from an endpoint to the internet. Verify that inter-VLAN traffic routes correctly and that policies block unauthorised traffic. Document the IP addressing scheme, VLAN IDs, and which ports are used for key links. This documentation is critical for future troubleshooting and scaling.
An IT professional designing a network for a mid-sized company with 500 employees, a headquarters, and two remote branch offices would use the three-tier model as a starting point. The company expects to double in size within three years, so scalability is essential.
The IT professional would first map out the physical locations: the main campus building, the branch offices, and a small data centre. At the headquarters, each floor would have its own wiring closet containing access switches. These would connect end-user devices for that floor. The IT professional would configure VLANs at the Access Layer to separate traffic types, such as data, voice for IP phones, and management traffic for network devices. Each VLAN would be assigned a unique subnet.
Next, the distribution layer would be built using two high-end multilayer switches in the main server room. These switches would aggregate all the access switches from the various floors. The IT professional would configure VLAN trunking so that traffic from all VLANs can travel between the access and distribution switches. They would also set up routing between VLANs using a feature called Switch Virtual Interface (SVI). For security, they would apply Access Control Lists to block inter-VLAN traffic that is not authorised, for example preventing the guest Wi-Fi from accessing internal file servers. They would also configure Quality of Service to give voice traffic priority over web browsing traffic.
The core layer would consist of two redundant core routers or high-speed switches located in the data centre. These core devices would connect to the distribution layer via fibre optic cables for maximum speed. The IT professional would configure dynamic routing protocols, such as OSPF, on the core and distribution devices so that if a link fails, traffic automatically reroutes through the redundant path. The core would also handle the connection to the internet via a firewall and to the WAN for connecting the branch offices.
When the company hires 100 new employees, the IT team simply adds new access switches in the new wing of the building and plugs them into the existing distribution layer. No changes are needed at the core. If a distribution switch fails, the redundant distribution switch takes over, and only the users connected to that specific switch notice a momentary blip. The IT professional would regularly monitor bandwidth utilisation at each layer using tools like SNMP. If utilisation at the core exceeds 60% regularly, they would plan to upgrade the core links, which is a surgical upgrade rather than a full redesign.
For troubleshooting, the IT professional uses the layered model to isolate problems. If a user cannot access the internet, the professional checks: Is the access switch port active? Is the VLAN correct? Then checks the distribution switch for routing to the core, then checks the core for the internet route. This layered approach prevents guessing and speeds up resolution dramatically.
The 350-401 ENCOR exam tests your understanding of network architecture fundamentals through scenario-based multiple-choice questions. You will not be asked to recite definitions. Instead, you will be given a problem and asked to select the correct layer where the issue resides or the correct device to use.
Key exam topics include:
Identifying which layer (Access, Distribution, or Core) performs which specific function.
Knowing that Access Layer switches are not always routers and that routing is typically done at the Distribution Layer.
Understanding that the Core Layer should never have policies that slow it down, such as ACLs.
Recognising the collapsed core model as a valid design for smaller networks.
Differentiating between a three-tier and a two-tier design.
Common traps Cisco sets:
The exam may describe a scenario where a network has hundreds of users and is experiencing broadcast storms. The wrong answer might suggest upgrading core switches. The correct answer is to implement VLANs at the Access Layer and routing at the Distribution Layer to contain broadcasts.
They might ask what to configure to separate voice and data on the same switch, and some will confuse VLANs with routing. VLANs are the correct answer for separation, not routing.
They love testing that the Distribution Layer performs route summarisation and policy enforcement, not the Core.
Another trap is asking which layer provides high-speed transport. The answer is always the Core Layer, but they might include a distracter that says 'the distribution layer does high-speed switching', which is false because distribution still does policy processing.
Key definitions to memorise:
Access Layer: Provides network access to end devices, performs port security and VLAN assignment.
Distribution Layer: Aggregates access switches, enforces policies (ACLs, QoS, routing between VLANs).
Core Layer: High-speed, highly reliable backbone. No policy enforcement.
Collapsed Core: Distribution and Core combined into one layer, used in smaller networks.
You should also be prepared to answer questions about how spanning tree operates at the Access and Distribution layers. The exam will assume you know that loop prevention is critical at Layer 2.
Finally, the exam may present a network diagram and ask you to identify where a bottleneck would occur if a certain link type is used. The correct answer pattern is to identify the slowest link, which is usually at the Access Layer if uplinks are not properly sized.
The three-tier hierarchical model consists of the Access Layer, Distribution Layer, and Core Layer, each with a distinct, non-overlapping role.\n\nThe Access Layer connects end-user devices, the Distribution Layer enforces policies and routes between VLANs, and the Core Layer provides high-speed transport with no policy processing.\n\nIn a properly designed network, the Core Layer should never perform ACLs or complex routing because any delay at this layer affects the entire network.\n\nVLANs operate at the Access Layer and are used to logically segment traffic, such as separating voice from data, without needing separate physical switches.\n\nThe collapsed core design combines Distribution and Core layers into one and is appropriate for smaller networks where cost savings justify reduced scalability.\n\nTraffic flow in the three-tier model is hierarchical: from access to distribution to core and then out to the internet or to other distribution blocks.
These come up on the exam all the time. Here's how to tell them apart.
Access Layer
Connects end-user devices like laptops and printers.
Performs VLAN assignment and port security.
Does not perform routing between different VLANs.
Distribution Layer
Aggregates traffic from multiple access switches.
Enforces policies like ACLs, QoS, and inter-VLAN routing.
Summarises routes before sending to the core.
Core Layer
Designed for high-speed, low-latency forwarding.
Should not enforce ACLs or complex policies.
Focuses on redundancy and fast convergence.
Distribution Layer
Processes policies such as routing and security filters.
Introduces some latency due to processing.
Provides path control between different network segments.
Three-Tier Model
Three separate layers: Access, Distribution, Core.
Best for large, scalable networks.
Each layer has dedicated hardware and functions.
Collapsed Core Model
Combines Distribution and Core into one layer.
Best for small to medium networks with limited growth.
Reduces hardware cost but limits scalability and redundancy.
Mistake
The Access Layer only provides physical connectivity, so it does not need any configuration beyond plugging in cables.
Correct
The Access Layer requires VLAN configuration, port security, and spanning-tree settings to function correctly and securely.
Beginners often think of switches as simple 'dumb' devices, but access switches are intelligent and require careful configuration to prevent security breaches and network loops.
Mistake
The Core Layer must have all the same security policies as the Distribution Layer to be secure.
Correct
The Core Layer should be kept as simple and fast as possible, with no complex policies like ACLs or QoS; those belong at the Distribution Layer.
Beginner IT professionals are often trained to secure everything, but applying security policies at the core would introduce latency and defeat its purpose as a high-speed backbone.
Mistake
A collapsed core design is less secure than a three-tier design because it is simpler.
Correct
Collapsed core is not inherently less secure; it simply combines functions for smaller networks where performance requirements are lower, but security policies can still be enforced at the combined layer.
The misconception arises from thinking that more layers equals more security, but security is about how you configure policies, not just the number of devices.
Mistake
The Distribution Layer is only needed when connecting to the internet or other external networks.
Correct
The Distribution Layer is needed even in internal-only networks to route between VLANs, enforce policies, and summarise routes before traffic reaches the core.
Beginners confuse distribution with a gateway to the internet, but its primary role is internal traffic control and aggregation.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A flat network uses a single broadcast domain and is simple but does not scale. A hierarchical network uses layers (Access, Distribution, Core) to contain broadcasts, enforce policies, and remain manageable as it grows.
Yes, that is called a collapsed core design where the distribution and core functions are combined into one layer. It is common for small businesses but limits scalability for future growth.
The primary device is an access switch. It provides physical Ethernet ports for end devices and can be configured with VLANs, port security, and Spanning Tree Protocol.
Core switches often use routing instead of bridging at Layer 3, so they avoid relying on Spanning Tree. However, if the core is operating at Layer 2 for certain connections, Spanning Tree is still necessary to prevent loops, but it is best to avoid Layer 2 in the core.
Route summarisation reduces the number of routes the Core Layer has to process, which keeps the core fast and stable. It also limits the impact of route flaps in the access layer.
A VLAN (Virtual Local Area Network) logically segments a physical network into separate broadcast domains. VLANs are configured on access switches to group devices, such as putting all IP phones on VLAN 10 and all computers on VLAN 20, even if they are plugged into the same switch.
You've finished Network Architecture Fundamentals. Continue through the 350-401 ENCOR study guide to build a complete picture of the exam.
Done with this chapter?