CCIE Enterprise Infrastructure
Cisco
Complete guide to passing the CCIE Enterprise Infrastructure exam on your first attempt.
$2,050 ($450 written + $1,600 lab)
~25% (lab)
3 years
Global
Cisco
$150k-$220k
Are you ready for CCIE Enterprise Infrastructure?
Loading quiz...
Complete Overview
CCIE Enterprise Infrastructure is Cisco's expert-level certification for enterprise networking, earned by passing a written core exam and an eight-hour hands-on lab exam. The written requirement is 350-401 ENCOR at 400 USD, and the CCIE Enterprise Infrastructure Lab Exam v1.1 costs 1,600 USD, so the fee floor is 2,000 USD plus local tax and travel before a single practice rack is rented.
Cisco publishes no formal prerequisites for the certification. The recommended profile is five to seven years of experience designing, deploying, operating and optimising enterprise networking technologies. In practice most candidates already hold CCNP Enterprise, because ENCOR is the same core exam for both certifications.
The lab exam is the part that defines the credential. It runs eight hours in a single day and is delivered in English only, in person, at a Cisco lab location or through the Mobile Lab option where you choose either a Cisco Kit site or a Bring Your Own Device site. Cisco splits the day into two modules. In the Design module you read a customer scenario delivered with requirements and supporting documents and make architectural decisions without touching a command line, and once you move forward you cannot return to an earlier question. In the Deploy, Operate and Optimize module you configure, troubleshoot and tune a live network. The split has run three hours Design against five hours Deploy, Operate and Optimize, but Cisco has announced an updated eight-hour format that adds a dedicated AI Deploy, Operate and Optimize module and cuts Design to two hours, so check Cisco Learning Network's practical exam format article against your own exam date before you book.
The v1.1 lab blueprint weights five domains: Network Infrastructure at 30 percent, Software-Defined Infrastructure at 25 percent, and Transport Technologies and Solutions, Infrastructure Security and Services, and Infrastructure Automation and Programmability at 15 percent each. Cisco tests these across the whole network lifecycle rather than in isolated tasks, and the blueprint says outright that candidates are expected to program and automate the network within the exam.
Security around the lab is heavier than for any written exam. Cisco runs CCTV cameras in the lab room and over the personal item storage area for the entire eight hours, and you must scan yourself with a handheld metal detector before entering. Refusing either ends your appointment. Two forms of signed identification are required, one of them a government-issued photo ID.
Results are pass or fail with no score and appear online within two business days. Cisco states that a failing score report indicates the areas where further study may help, and Cisco's own CCIE exam product manager has written that the Design module scores partial credit at the item level. If you fail, the wait before you may schedule again is 30 calendar days. A re-read, in which a second proctor reloads your configurations onto a rack and rescores the whole exam, costs 1,000 USD plus tax and is refunded only if the result changes from Fail to Pass.
The certification is valid for three years and recertifies with 120 Continuing Education credits, by retaking exams, or by a mix of both.
Why Get CCIE Enterprise Infrastructure Certified?
The lab is eight hours of hands-on work on real equipment. Cisco's blueprint requires you to plan, design, operate and optimise dual-stack IPv4 and IPv6 solutions for complex enterprise networks, and states that candidates are expected to program and automate the network within the exam itself.
ENCOR 350-401 at 400 USD covers the written requirement for CCIE Enterprise Infrastructure, CCIE Enterprise Wireless and CCNP Enterprise at the same time, and passing it earns the Cisco Certified Specialist - Enterprise Core certification immediately.
The blueprint devotes 25 percent to Software-Defined Infrastructure, split across Cisco SD-Access and Catalyst SD-WAN. That is the largest single block of controller-driven networking content in any Cisco expert lab.
Passing an expert-level lab exam is worth 120 Continuing Education credits under Cisco's qualifying options, which is the exact amount needed to recertify a CCIE for another three years.
Automation carries 15 percent of the lab, and it is graded on working output: EEM applets, guest shell Python, vManage and Catalyst Center API calls, and model-driven telemetry with gRPC on-change subscriptions.
CCIEs who stay active for ten consecutive years become eligible for Emeritus status at an 85 USD annual fee, and twenty consecutive years of active or Emeritus status grants Lifetime Emeritus with no further fees.
Cisco schedules lab exams up to six months ahead and lets you hold only one Expert lab booking per track at a time, which forces a hard, dated deadline on a study plan that otherwise drifts.
Exam Format & Structure
Duration
Lab exam: eight hours in one day, split between a Design module and a Deploy, Operate and Optimize module. The split has been three hours Design and five hours Deploy, Operate and Optimize; Cisco has announced an updated eight-hour format that adds an AI Deploy, Operate and Optimize module and shortens Design to two hours. Written core exam 350-401 ENCOR: 120 minutes.
Questions
Not published by Cisco for either component. Cisco publishes the module durations and the domain weights but no item counts.
Passing Score
Not published by Cisco. Cisco's testing policy states passing scores are set through statistical analysis, are subject to change, and are not published. The lab result is reported as Pass or Fail with no score and no further breakdown, beyond the areas a failing report flags for additional study.
Question Types
- Design module: a customer scenario supplied with requirements documents and background, answered as design decisions rather than configuration
- Design module: no return to an earlier question once you move forward, with partial credit scored at item level
- Deploy, Operate and Optimize module: live device configuration on Cisco IOS XE
- Deploy, Operate and Optimize module: fault isolation and repair on a pre-broken topology
- Deploy, Operate and Optimize module: optimisation and verification tasks against stated requirements
- Written core exam: multiple choice single answer, multiple choice multiple answers and drag and drop items, though Cisco publishes no item-type breakdown per exam
Delivery Method
The lab exam is in person only, at a Cisco lab location or at a Mobile Lab site where you select either a Cisco Kit or a Bring Your Own Device option. Booking and payment run through the Cisco Expert Level Certifications Tracker portal. The written core exam is delivered by Pearson VUE at a test centre or through online proctoring.
Exam Domains & Topics
The largest block of the lab, covering switched campus, routing concepts, EIGRP, OSPF v2 and v3, BGP and multicast. This is where the classic CCIE routing and switching material survives in full depth, including VRF-aware routing across BGP, EIGRP, OSPF and static routes, and route leaking between VRFs using route maps and VASI.
Key Topics to Master:
- Spanning Tree Protocol including PVST+, Rapid PVST+ and MST with timer, priority and path cost tuning
- EtherChannel with LACP and static modes, Layer 2 and Layer 3, load balancing and misconfiguration guard
- Redistribution between BGP, EIGRP, OSPF and static, with route filtering and administrative distance control
- Route leaking between VRFs using route maps and VASI
- EIGRP named mode, query propagation boundaries, leak maps and stub with leak map
- OSPF LSA throttling, SPF tuning, stub router and prefix suppression
- BGP path selection, communities, conditional advertisement, outbound route filtering and AS path regular expressions
- PIM sparse mode with static RP, BSR and Auto-RP, plus IPv4 anycast RP using MSDP and PIMv6 anycast RP
- Bidirectional Forwarding Detection and Layer 3 MTU
Cisco SD-Access and Cisco SD-WAN in equal measure. SD-Access covers underlay through overlay through fabric design, deployment, border handoff and segmentation. SD-WAN covers the vManage, vBond and vSmart control architecture, WAN Edge onboarding, Overlay Management Protocol, templates and both centralized and localized policy.
Key Topics to Master:
- SD-Access underlay build by LAN automation and Plug and Play, plus extended and policy extended nodes
- SD-Access overlay: LISP and BGP control planes, VXLAN data plane, TrustSec policy plane, L2 flooding, native multicast
- Fabric border handoff for SDA, SD-WAN and IP transits, fusion router peering and Layer 2 border handoff
- Macro segmentation with virtual networks and micro segmentation with SGTs and SGACLs
- SD-WAN controller architecture: vManage management plane, vBond orchestration plane, vSmart control plane
- WAN Edge deployment in greenfield, brownfield and hybrid scenarios, plus TLOC extension
- Overlay Management Protocol attributes, IPsec key management, route aggregation and redistribution
- CLI templates, feature templates and device templates
- Centralized data, application-aware routing and control policies, plus localized access lists and route policies
MPLS is scoped to operations and L3VPN rather than traffic engineering, and DMVPN appears only as a troubleshooting task on Phase 3 with dual hubs. Static point-to-point GRE tunnels round out the set. Knowing the boundaries here saves weeks of misdirected lab time.
Key Topics to Master:
- Static point-to-point GRE tunnels
- MPLS label stack, LSR and LSP operations
- Label Distribution Protocol
- MPLS ping and MPLS traceroute
- MPLS L3VPN with PE to CE routing using BGP
- Basic MP-BGP VPNv4 and VPNv6
- Troubleshooting DMVPN Phase 3 with dual hub
- NHRP registration and resolution behaviour
- IPsec with IKEv2 using a preshared key
The broadest domain by topic count, spanning device hardening, switch and router security features, IPv6 first-hop security, system management, QoS, network services, optimisation and operations. NAT alone runs to five variants including VRF-aware and VASI NAT, and the QoS section demands end-to-end Layer 3 policy built with MQC.
Key Topics to Master:
- Control plane policing and protection, plus AAA on IOS XE
- Switch security: VACL, PACL, storm control, DHCP snooping with option 82, IP Source Guard, Dynamic ARP Inspection, port security
- IPv6 infrastructure security: RA Guard, DHCP Guard, binding table, device tracking, ND inspection and snooping, Source Guard
- Unicast Reverse Path Forwarding and IPv6 traffic filters
- SNMP v2c and v3, syslog, conditional debugs and configuration change notification and logging
- QoS with DiffServ, NBAR classification, DSCP marking in IPv4 and IPv6, policing, shaping, HQoS and end-to-end MQC
- HSRP, VRRP and IPv6 RS or RA redundancy, NTP client and PTP design considerations
- DHCP client, server and relay, SLAAC and DHCPv6 integration, stateful and stateless DHCPv6, prefix delegation
- Static, dynamic, policy-based, VRF-aware and VASI NAT and PAT
Graded on working automation rather than definitions. You encode data in four formats, script inside the device with EEM and guest shell, and drive vManage and Catalyst Center APIs from Python. Model-driven telemetry appears as a deploy-and-verify task using gRPC on-change subscriptions, so the configuration has to actually stream.
Key Topics to Master:
- Data encoding in JSON, XML, YAML and Jinja
- EEM applets for event-driven configuration and data collection
- Guest shell Linux environment on IOS XE
- The CLI Python module and the EEM Python module
- Interacting with the vManage API using the Python requests library and Postman
- Monitoring endpoints and configuration endpoints on vManage
- Cisco DNA Center, now Catalyst Center, API interaction with GET, PUT and POST requests
- Deploying and verifying model-driven telemetry
- Configuring an on-change subscription using gRPC
Recommended Study Plan
- 1Download the CCIE Enterprise Infrastructure v1.1 blueprint PDF from learningcontent.cisco.com and convert every numbered subtopic into a checklist row
- 2Download the CCIE Enterprise Infrastructure equipment and software list from Cisco and match your practice environment to the listed software versions
- 3Decide your practice platform: Cisco Modeling Labs Personal at 199 USD per year, Personal Plus at 349 USD, or a vendor rack rental
- 4Confirm you already hold a valid 350-401 ENCOR pass, and check its three-year expiry date in the Certification Tracking System
- 5Create your profile in the Cisco Expert Level Certifications Tracker so you can see lab availability and download a visa invitation letter if you need one
- 1Build a four-switch topology and tune PVST+, Rapid PVST+ and MST until you can force any root bridge on demand
- 2Configure EtherChannel misconfiguration guard and deliberately trigger it, then recover
- 3Practise manual VLAN pruning, extended range VLANs, voice VLAN and native VLAN changes under time pressure
- 4Configure UDLD, CDP and LLDP and verify neighbour discovery from both ends
- 5Work errdisable recovery, MAC address table management and Layer 2 MTU changes into a single timed drill
- 1Build EIGRP named mode with wide metrics and prove the difference against classic metrics on the same links
- 2Configure query propagation boundaries with stub and leak maps, then force a stuck-in-active condition and resolve it
- 3Tune OSPF with LSA throttling, SPF timers, stub router advertisement and prefix suppression
- 4Configure VRF-Lite and VRF-aware routing with BGP, EIGRP, OSPF and static in one topology
- 5Leak routes between VRFs using route maps, then repeat the exercise using VASI
- 1Build iBGP with route reflectors and eBGP with peer groups, dynamic neighbours and 4-byte AS numbers
- 2Practise attribute manipulation, conditional advertisement, outbound route filtering and standard and extended communities
- 3Write AS path regular expressions and test them against a multi-AS topology
- 4Redistribute between BGP, EIGRP, OSPF and static in a topology with two redistribution points, then fix the resulting loop
- 5Add Bidirectional Forwarding Detection and measure convergence before and after
- 1Configure PIM sparse mode with static RP, then convert to BSR, then to Auto-RP on the same topology
- 2Build IPv4 anycast RP using MSDP and verify source active messages
- 3Configure PIMv6 anycast RP and compare the mechanism to the MSDP approach
- 4Configure Source Specific Multicast with IGMPv3 and prove the channel join
- 5Apply multicast boundaries, RP announcement filters, IGMP filters and IGMP querier settings
- 1Build an MPLS core with LDP and verify label bindings, then use MPLS ping and MPLS traceroute to prove the LSP
- 2Configure MPLS L3VPN with MP-BGP VPNv4 and VPNv6 and PE to CE routing using BGP
- 3Build DMVPN Phase 3 with dual hubs, then break NHRP and IPsec deliberately and practise isolating each failure
- 4Configure static point-to-point GRE tunnels and route across them
- 5Time yourself: the blueprint gives this domain 15 percent, so cap your effort accordingly
- 1Build a fabric on Catalyst Center: manual underlay first, then LAN automation with Plug and Play
- 2Onboard hosts with authentication templates and port configuration, and add extended nodes
- 3Configure macro segmentation with virtual networks and micro segmentation with SGTs and SGACLs
- 4Practise border handoff for SDA transit, SD-WAN transit and IP transit, plus fusion router peering
- 5Configure Layer 2 border handoff, L2 flooding and native multicast in the fabric
- 1Bring up vManage, vBond and vSmart and onboard WAN Edge routers with system IP, site ID, org name and vBond address
- 2Build CLI templates, feature templates and device templates and understand which overrides which
- 3Configure OMP attributes, route aggregation and redistribution, plus BGP AS path propagation
- 4Write centralized data policies, application-aware routing policies and control policies, then verify the traffic path changes
- 5Configure TLOC extension and localized access lists and route policies
- 1Configure Control Plane Policing and protection, then AAA with a fallback to local authentication
- 2Build the full IPv6 first-hop security set: RA Guard, DHCP Guard, binding table, device tracking, ND inspection, Source Guard
- 3Configure all five NAT variants in the blueprint, ending with VASI NAT
- 4Build end-to-end Layer 3 QoS with MQC including NBAR classification, DSCP marking, policing, shaping and HQoS
- 5Configure DHCPv6 prefix delegation alongside SLAAC and verify address assignment on the client
- 1Write EEM applets that react to syslog patterns, interface events and timers, and verify each fires
- 2Use guest shell with the CLI Python module and the EEM Python module to collect and act on device state
- 3Drive the vManage API from Python requests and from Postman against both monitoring and configuration endpoints
- 4Issue GET, PUT and POST requests to the Catalyst Center API on the free Cisco DevNet Sandbox
- 5Configure a gRPC on-change telemetry subscription and confirm the collector receives updates
- 1Practise design scenarios in which you never touch a command line: choose topologies, justify protocol selection, size failure domains
- 2Rehearse the no-going-back constraint by answering timed question sets without revisiting earlier answers
- 3Work through the CCIE Enterprise Learning Matrix from Cisco to find design-oriented content you have skipped
- 4Take a graded practice lab from a vendor such as INE and score the Design module separately from the configuration module
- 5Write a one-page decision framework for SD-Access versus SD-WAN versus traditional campus and memorise it
- 1Run at least two full eight-hour mock labs on consecutive weekends, three hours design then five hours configuration, with no phone
- 2Practise saving configurations frequently, since Cisco states proctors are under no obligation to save your work
- 3Rehearse a ten-minute troubleshooting cap on any suspected equipment fault before you would escalate to a proctor
- 4Book the lab through the Cisco Expert Level Certifications Tracker, paying by credit card or Cisco Learning Credits, and note that rescheduling within three calendar days is not permitted
- 5If you need a visa, download the visa invitation letter from the tracker and apply at least 10 to 12 weeks before the exam date
Ready to pass CCIE Enterprise Infrastructure?
Get 500+ practice questions, video walkthroughs, and a pass guarantee.
Best Study Resources
CCIE Enterprise Infrastructure v1.1 blueprint
Official lab exam topics PDFCisco's own lab blueprint with the five domain weights and subtopics numbered to four levels. Everything from VASI route leaking to gRPC on-change subscriptions is named explicitly here.
Free
CCIE Enterprise Infrastructure equipment and software list
Official referenceCisco's list of the hardware platforms and software versions the practical exam is built on. Match your practice environment to this list, because feature behaviour differs between releases.
Free
Cisco Expert Level Certifications Tracker
Booking and payment portalWhere you pay the 1,600 USD lab fee, choose a lab location or Mobile Lab site, download a visa invitation letter, request a re-read and check results within two business days.
Free to use
Cisco exam, testing and certification policies
Policy referenceThe page that sets the 30-day retake wait, the 500 USD rescheduling fee, the no-refund cancellation rule, the CCTV and metal detector requirements, the 1,000 USD re-read process and the Emeritus rules.
Free
Cisco Modeling Labs Personal and Personal Plus
Network simulatorCisco's own simulator running real IOS XE images, sold through the Cisco U. store. Personal Plus supports larger topologies, which matters once you are building fabric and MPLS labs at scale.
199 USD per year for Personal, 349 USD per year for Personal Plus
Cisco DevNet Sandbox
Live API lab environmentReservable and always-on environments for Catalyst Center, Catalyst SD-WAN Manager and IOS XE with NETCONF, RESTCONF and gRPC telemetry available. The practical way to rehearse the 15 percent automation domain.
Free
INE CCIE Enterprise Infrastructure training
Video course and graded practice labsLong-running expert-level provider with full-length practice labs and workbooks split into design and configuration components, which mirrors the two-module exam structure.
Subscription
Cisco U. CCIE Enterprise Infrastructure training
Guided learning and hands-on labsCisco's own platform with learning paths, pre- and post-assessments and hands-on labs on real Cisco products. Eligible learning paths also accrue Continuing Education credits toward your next recertification.
Subscription
Cisco Enterprise certifications community
ForumCisco Learning Network's Enterprise community, where lab candidates compare mock lab strategies, module timing and site logistics for specific lab and Mobile Lab locations.
Free
Cisco Continuing Education qualifying options
Recertification referenceThe table showing that an expert-level lab or practical exam is worth 120 CE credits, a professional core exam 80, a concentration 40, and that CCIE Labs performance item authoring earns 12 credits per accepted item.
Free
Common Mistakes to Avoid
Preparing for the lab as though it were the old single configuration exam. A whole module of the eight hours is Design, in which you write no configuration at all.
Split your practice the same way Cisco splits the exam. Rehearse design scenarios separately from configuration drills, and get comfortable committing to an answer you cannot revisit, since Cisco's CCIE exam product manager states you cannot go back to a previous question once you move forward in the Design module.
Studying MPLS to service provider depth. The blueprint scopes MPLS to label stack, LSR, LSP, LDP, MPLS ping and traceroute, and L3VPN with MP-BGP VPNv4 and VPNv6.
Stop at L3VPN. Traffic engineering, segment routing and L2VPN are not on the Enterprise Infrastructure lab blueprint. Redirect the saved hours into SD-Access and SD-WAN, which together carry 25 percent.
Building DMVPN from scratch in practice when the blueprint asks you only to troubleshoot Phase 3 with dual hub.
Practise fault isolation on a pre-built dual-hub Phase 3 topology. Break NHRP registration, break IKEv2 preshared keys, break the tunnel source, and drill on diagnosing each from show output rather than rebuilding.
Not saving configurations during the eight hours. Cisco's policy states plainly that under no circumstance is it the responsibility of the lab proctor to save candidate configurations.
Save after every completed task. Build the habit during mock labs so it survives hour six, when fatigue erodes discipline and a device reload can cost you an entire section.
Burning half an hour troubleshooting suspected equipment failure instead of escalating. Cisco instructs candidates to spend no more than 10 minutes on a suspected equipment problem before reporting it.
Set a ten-minute cap and stick to it. Note that proctors do not troubleshoot candidate configurations, so be sure the fault is in the environment rather than in your own work before you raise it.
Arriving late on lab day. If you arrive more than two hours after the exam start time, Cisco will not allow you to start, and cancellation forfeits the full 1,600 USD.
Arrive the day before, especially for a Mobile Lab site or an overseas booking. Cisco also warns that start times vary by location, and the address is in your confirmation email rather than assumed from the city.
Booking a lab date without checking visa lead time. Cisco recommends applying at least 10 to 12 weeks before the exam date and will not assist with documentation beyond the visa invitation letter.
Download the visa invitation letter from the Visa Invite tab in the Cisco Expert Level Certifications Tracker as soon as you book. If the visa does not arrive, the cancellation policy still applies and the payment is not refunded.
Assuming a re-read is a cheap second opinion. It costs 1,000 USD plus tax, must be requested within 14 days, takes up to three weeks, and is limited to one per attempt.
Request a re-read only when the tracker offers the option, since Cisco makes it available only for exams with the potential to change from Fail to Pass. The 1,000 USD is refunded only if the result actually flips.
Ignoring the automation domain because it is only 15 percent. It carries the same weight as the entire Transport Technologies and Solutions domain, and it is graded on working output rather than on description.
Rehearse EEM applets, guest shell Python, vManage and Catalyst Center API calls and a gRPC on-change telemetry subscription until each runs first time. The DevNet Sandbox costs nothing and mirrors the exam tooling.
Exam Day Tips
- 1
Bring two forms of identification, both bearing your signature, at least one government-issued with a photo. The Expert-level admission process checks both before you enter the lab.
- 2
Expect to scan yourself with a handheld metal detector before entering the room. The proctor demonstrates first, and Cisco states that refusing or failing to clear the self-scan means you will not be allowed to test.
- 3
Assume you are on camera for the whole day. Cisco records the lab room and the personal item storage area before, during and after the eight hours, stores the footage, and does not allow the cameras to be disabled.
- 4
Leave every personal item in the storage area. Cisco's general policy bars notes, documentation, watches, laptops, keyboards, pagers, PDAs and mobile phones from the room, and nothing may be taken out.
- 5
Treat the Design module as a one-way trip. Cisco's CCIE exam product manager states you cannot go back to a previous question once you move forward, so read the whole scenario before committing to the first answer.
- 6
Do not carry the Design module clock into the configuration module. The two modules are timed separately, and finishing Design early does not add time to Deploy, Operate and Optimize.
- 7
Save configurations after every task in the five-hour module. Cisco's policy explicitly places responsibility for saving on you, not on the proctor.
- 8
Cap any suspected equipment problem at ten minutes of your own troubleshooting before reporting it to the proctor, which is the limit Cisco instructs candidates to observe.
- 9
Do not photograph or discuss any part of the exam. Cisco's confidentiality agreement covers questions, answers and diagrams, and penalties extend to a lifetime ban and nullification of all previous certifications.
Career Paths & Salary Ranges
Network architect
Cisco names network architect as a CCIE Enterprise Infrastructure role. The job designs and implements networks for an organisation, which is the exact skill the three-hour Design module is built to measure.
$150k-$220k
Principal or lead network engineer
Owns the enterprise routing, switching and fabric design across sites and is the final escalation point for major incidents. The 30 percent Network Infrastructure domain plus the 15 percent security and services domain map directly onto this remit.
$150k-$220k
SD-Access and SD-WAN solutions engineer
Designs and deploys controller-driven campus and WAN fabrics: LAN automation, fabric border handoff, TLOC extension and centralized policy. The Software-Defined Infrastructure domain at 25 percent is the largest single block on the lab.
$150k-$220k
Business services architect
Cisco lists this role for CCIE Enterprise Infrastructure holders. The work connects business strategy to IT execution, which requires the ability to defend a design decision in commercial terms as well as build it.
$150k-$220k
Network automation lead
Builds the tooling that operates the network: EEM, guest shell Python, vManage and Catalyst Center API integrations and model-driven telemetry pipelines. The lab's automation domain grades on working output, which is a credible signal for this role.
$150k-$220k
Prerequisites & Requirements
- No formal prerequisites. Cisco states this explicitly on the CCIE Enterprise Infrastructure certification page.
- Cisco's recommended profile is five to seven years of experience designing, deploying, operating and optimising enterprise networking technologies and solutions.
- You must pass 350-401 ENCOR as the written core exam before the lab result can be converted into certification.
- The written exam is valid for three years, and all certification requirements must be completed within that window or the written exam must be passed again.
- You may hold only one Expert lab or practical exam booking per track at a time, and double bookings for the same exam are not permitted.
- Payment must clear in full, including taxes, through the Cisco Expert Level Certifications Tracker before the lab is scheduled.
- Residents of embargoed countries and territories listed in Cisco's testing policy are prohibited from testing with Cisco.
Frequently Asked Questions
How much does CCIE Enterprise Infrastructure cost?
2,000 USD plus local tax for a single clean pass: 400 USD for the 350-401 ENCOR written core exam and 1,600 USD for the lab exam. Cisco's pricing table lists CCIE lab and CCDE practical exams at 1,600 USD and CCNP core exams at 400 USD. Travel, accommodation and practice rack time are on top, and a failed lab attempt costs another 1,600 USD.
What happens if I fail the lab exam?
You must wait 30 calendar days, beginning the day after the failed attempt, before scheduling the same exam again. Your result is reported as Fail with no score, though Cisco states that failing score reports indicate the areas where additional study may help. There is no limit on the number of lab attempts within the three-year validity window of your written exam.
What is a re-read and is it worth 1,000 USD?
A re-read is a second proctor loading your saved configurations onto a rack, recreating the test and rescoring the entire exam. It costs 1,000 USD plus taxes, must be requested within 14 days of the exam date through the tracker, is limited to one per attempt, and takes up to three weeks. Cisco offers the option only for exams with the potential to change from Fail to Pass, and refunds the fee only if the result actually changes.
Can I take the CCIE lab exam online?
No. Cisco states that all Expert lab and practical exams are offered in person only. You schedule through the CCIE website and choose a Cisco lab location or a Mobile Lab site, and for Mobile Lab you select either a Cisco Kit site or a Bring Your Own Device site.
What identification do I need for the lab exam?
Two forms of personal identification, both bearing your signature, one of which must be a government-issued photo ID. This is the same requirement as for written exams, but the Expert-level process adds a handheld metal detector self-scan and CCTV recording of the lab room and storage area throughout the eight hours.
Can I bring notes, a calculator or documentation into the lab?
No. Cisco's general policy states that candidates may not bring anything into the exam room or take anything out, naming notes, documentation, watches, laptops, keyboards, pagers, PDAs and mobile phones. Any documentation available to you comes from within the exam environment itself.
Are breaks allowed during the eight-hour lab?
Cisco publishes no break policy for the CCIE lab. What Cisco does publish is that the exam runs eight hours, that cameras record the room and the storage area continuously, and that if you arrive less than two hours after the start time you may begin but must finish with the rest of the group. A Cisco blog written by a CCIE exam product manager tells candidates to eat a real lunch during the break, so a break exists in practice. Confirm the arrangement with your lab site rather than assuming one.
How long do lab results take?
Within two business days, depending on the country where you took the exam. You view them by logging into the Cisco Expert Level Certifications Tracker. Results are recorded as Pass or Fail only, and Cisco provides no further breakdown beyond the areas flagged for further study on a failing report.
How do I recertify a CCIE?
Earn 120 Continuing Education credits before the three-year expiry, retake qualifying exams, or combine the two. Passing any expert-level lab or practical exam, or the CCDE written exam, is worth 120 CE credits on its own. Cisco sends recertification reminders at 2 years, 1 year, 90 days, 60 days and 30 days before expiry, and grants no extensions.
Can I retake the lab exam after I pass it?
No. Cisco's policy states that once you pass any expert-level lab or practical exam you cannot retake it unless your certification status becomes inactive. Recertification therefore runs through Continuing Education credits or through other exams rather than through a repeat lab attempt.
What is CCIE Emeritus and when do I qualify?
Emeritus recognises long-standing CCIEs who have moved away from daily technical work. You need ten consecutive years of active status, and at nine years and nine months Cisco emails eligible holders and enables the purchase option in the Expert portal. The fee is 85 USD plus taxes annually, with a 60-day grace period that carries a 50 USD late fee. Twenty consecutive years of active or Emeritus status grants Lifetime Emeritus with no further renewal fees.
What are the rescheduling and cancellation rules?
Rescheduling is required for any change to date or location, is not allowed within three calendar days of the exam, and carries a non-refundable 500 USD fee plus local taxes. Changing the exam track is not possible. Cancelling forfeits all payments with no refund. A no-show forfeits the full payment and blocks you from scheduling another lab exam for 30 days.
How do I pay for the lab exam?
Through the Cisco Expert Level Certifications Tracker portal, by credit card or, from 4 February 2026, with Cisco Learning Credits. The two cannot be combined in a single transaction. Sales of Expert-level lab exam vouchers ended on 4 February 2026, and existing vouchers may be redeemed until their expiry date but cannot be extended or transferred. An invoice is issued three to five business days after payment and cannot be modified.
Are testing accommodations available for the lab exam?
Yes, and Cisco charges no additional fee for them. For CCIE lab appointments you request the accommodation through the CCIE Portal rather than through the standard exam accommodation route, and a CSCO ID is required. You receive a CSCO ID when you register for your first Cisco exam. Cisco publishes an accessibility contact address for accommodation questions.
How does CCIE Enterprise Infrastructure compare with CCNP Enterprise?
They share the same written core exam, 350-401 ENCOR. CCNP then requires one 90-minute concentration exam at 300 USD, while CCIE requires the eight-hour hands-on lab at 1,600 USD. Cisco recommends three to five years of experience for CCNP and five to seven years for CCIE. Both certifications are valid for three years, but CCNP recertifies on 80 Continuing Education credits and CCIE on 120.
How does it compare with CCDE?
CCDE is Cisco's expert design certification and has no configuration component. Its written exam, 400-007, costs 450 USD against 400 USD for ENCOR, and its practical exam costs 1,600 USD like the CCIE lab. CCDE requires you to select an elective module when scheduling, and the elective cannot be changed if you reschedule. Re-reads are available for all CCIE tracks but not for the CCDE practical exam. Both recertify on 120 Continuing Education credits.
Is the CCIE lab exam changing?
Yes. The CCIE Enterprise Infrastructure certification page carries a banner stating that a new CCIE lab exam module to integrate with AI tools is underway, and Cisco Learning Network has published an updated practical exam format article covering an eight-hour exam that adds a dedicated AI Deploy, Operate and Optimize module, with Design cut from three hours to two and Deploy, Operate and Optimize unchanged at five. Cisco has not published any change to the v1.1 blueprint domain weights alongside it. Check the practical exam format article and the exam topics page against your booked date, since the exam topics document is what Cisco grades against on the day you sit.
What software versions is the lab built on?
Cisco publishes a CCIE Enterprise Infrastructure equipment and software list, which it describes as the equipment and software versions the practical exam solutions can be configured with. Match your practice environment to that list, because feature availability and default behaviour differ between IOS XE releases and between Catalyst Center and SD-WAN Manager versions.
Pass CCIE Enterprise Infrastructure, Guaranteed
94% pass rate on first attempt
One-time • Lifetime access