ENSDWI Part 1: Exam Syllabus & Study Roadmap
The Catalyst SD-WAN deep dive that just finished on this site was written the way I actually think about the platform — architecture first, mechanics second, exam never. This series is the other thing: a systematic walk through the 300-415 ENSDWI v1.2 blueprint, in blueprint order, with the same intent as the NSE4 and NSE5 study series — when you finish Part 12 you should be able to sit the exam without wondering what you haven’t seen.
The two series are deliberately complementary. Where the deep dive explains why OMP is a route reflector wearing a trench coat, this series makes sure you can answer the four ways Cisco will ask you about it under time pressure. I’ll cross-link rather than repeat.
What ENSDWI is
Implementing Cisco SD-WAN Solutions (300-415 ENSDWI) is one of the concentration exams for CCNP Enterprise — pass the ENCOR core plus any one concentration and you hold the CCNP. Passing ENSDWI on its own also earns the standalone Cisco Certified Specialist – Enterprise SD-WAN Implementation badge, which is worth knowing if you’re not chasing the full CCNP: there’s no prerequisite, you can sit ENSDWI cold.
Logistics: 90 minutes, delivered at Pearson VUE or online-proctored, no going back to review answered questions (standard Cisco behaviour — answer it and it’s gone). Question mix is multiple-choice single/multi answer, drag-and-drop, and exhibit-based questions where you’re reading show output or a vManage screen and picking the true statement. There are no live-device labs in ENSDWI, but the exhibit questions punish anyone who has never actually looked at show sdwan control connections output — which is exactly why every part of this series includes verification commands, not just concepts.
The current version is v1.2 (in force since April 2023), and the deltas from v1.0/v1.1 matter if you’re studying from older material: v1.2 added Multi-Region Fabric, configuration groups and feature profiles (the successor to the template model), and expanded Cloud OnRamp coverage including Multicloud and Interconnect. Older study guides that stop at device/feature templates will leave you exposed.
The blueprint, weighed and mapped
Six domains. Percentages are Cisco’s official weightings, and they tell you where the marks are:
| Domain | Weight | Covered in |
|---|---|---|
| 1.0 Architecture | 20% | Parts 2–3 |
| 2.0 Controller Deployment | 15% | Parts 4–5 |
| 3.0 Router Deployment | 20% | Parts 6–7 |
| 4.0 Policies | 20% | Parts 8–9 |
| 5.0 Security and Quality of Service | 15% | Parts 10–11 |
| 6.0 Management and Operations | 10% | Part 12 |
Sixty per cent of the exam sits in three domains — Architecture, Router Deployment, and Policies — and those three are also where the questions get most technical. Controller Deployment and Security/QoS are more descriptive (“describe” verbs in the blueprint rather than “configure”), and Management and Operations is the smallest and most forgiving.
Blueprint verb discipline matters when studying for any Cisco exam: “describe” topics get concept questions; “configure” topics get exhibit and drag-and-drop questions. When the blueprint says configure control policies, expect to read policy CLI and predict what it does. When it says describe Cloud OnRamp Colocation, you need the architecture and the use case, not the CLI.
Part-by-part roadmap
Part 2 — Architecture: planes, components, and Multi-Region Fabric (blueprint 1.1). The four planes, what vBond/vManage/vSmart/WAN Edge each own, OMP’s three route types at describe-level, IPsec vs GRE encapsulation, BFD’s role, and MRF regions/border routers. Heaviest single blueprint section.
Part 3 — Edge platforms and Cloud OnRamp (1.2, 1.3). The cEdge hardware families and vEdge legacy, platform selection, then all four Cloud OnRamp flavours: SaaS (DIA vs gateway vs client access), IaaS (AWS/Azure/GCP), Colocation (CSP + CN-WAN), and Multicloud/Interconnect (Megaport/Equinix).
Part 4 — Controller deployment (2.1, 2.2). Cisco-hosted cloud vs on-prem, hosting platform requirements (ESXi/KVM), installing the trio, and the scalability and redundancy numbers — vManage clustering, vSmart/vBond horizontal scale, affinity.
Part 5 — Certificates, device lists, and control-plane troubleshooting (2.3, 2.4). The certificate trust chain, enterprise CA vs Cisco PKI vs symantec-legacy, WAN Edge authorized serial list, and the systematic show sdwan control connections-and-onwards troubleshooting flow every exhibit question draws from.
Part 6 — WAN Edge deployment (3.1, 3.2). ZTP vs PnP vs bootstrap onboarding, DC/regional-hub design, circuit termination patterns, TLOC extension (a guaranteed exam topic), dynamic tunnels, and underlay-overlay route exchange.
Part 7 — OMP, TLOCs, routing, multicast, and config groups (3.3–3.7). OMP attributes and path selection, TLOC anatomy and colors, VRRP/OSPF/BGP/EIGRP at the service side, multicast support, and the configuration-groups/feature-profiles workflow that v1.2 added.
Part 8 — Control policies (4.1). Where control policy is enforced (vSmart, inbound/outbound), match/action structure, hub-and-spoke and regional topologies built from TLOC and route filtering, and the classic gotchas (default-action reject, sequence ordering).
Part 9 — Data policies, segmentation, AAR, and DIA (4.2–4.5). Centralized data policy vs localized policy, VPN segmentation and topologies per VPN, application-aware routing (SLA classes, app-route policy, BFD measurement), and direct Internet access with NAT fallback.
Part 10 — Security (5.1–5.3). Service insertion/chaining, the embedded security stack (app-aware enterprise firewall, IPS, URL filtering, AMP, SSL/TLS proxy, TrustSec propagation), and cloud security integration — Umbrella DNS security and SIG tunnels.
Part 11 — QoS and App-QoE (5.4, 5.5). The full WAN Edge QoS pipeline — classification, marking, scheduling, queuing, shaping, policing — plus per-tunnel and adaptive QoS, then App-QoE: TCP optimization, DRE, packet duplication, FEC, and AppNav-XE.
Part 12 — Management, operations, and exam day (6.1–6.4). AAA on vManage, monitoring/alarms/reporting, REST API monitoring at describe-level, software image management, and a final-week revision strategy.
Lab options
You cannot pass this exam comfortably on reading alone — the exhibit questions assume you recognise real output. Options, in ascending order of cost:
- Cisco SD-WAN sandbox on DevNet — free, always-on vManage instance. Read-only-ish but perfect for learning the GUI, the monitoring screens, and the REST API for Part 12.
- Cisco Modeling Labs (CML) with the Catalyst SD-WAN images (controllers + Catalyst 8000V). Needs a personal licence and a meaty host — the controller trio plus two edges wants ~32 GB RAM — but it’s a full read-write fabric.
- dCloud — Cisco’s hosted demo environments include scripted SD-WAN labs with full admin. Free with a cisco.com login; sessions are time-boxed but repeatable.
If you already run the Proxmox lab from the FortiManager series, the same host comfortably runs a minimal controller trio + two C8000V edges under KVM — the controllers are distributed as qcow2 and the Part 4 install walk-through uses exactly that path.
How to use this series
One part per day was how these posts will have landed on the site, but that’s a publishing cadence, not a study plan. Realistic pacing for someone working full-time: one domain per week — read the parts, lab the “configure” topics, then answer the blueprint line-by-line out loud before moving on. That’s a six-week runway, plus a revision week with Part 12’s checklist. Faster is possible if SD-WAN is your day job; slower is fine if it isn’t.
Next up, Part 2: the architecture domain — four planes, three controllers, one fabric, and the Multi-Region Fabric topics that v1.2 added and older study material misses.