300-420 ENSLD Lab Guide 2026: The Design Exam You Barely Lab
Most CCNP lab guides tell you to build more. This one tells you to build less: ENSLD asks you to justify designs, not configure them.
- 300-420Exam
- 90 minTime
- $300Fee
- 5Domains
- CML-FreeCheapest lab
- 8 GB hostRAM needed
Table of Contents
The minimum lab
ENSLD is the odd one out in the CCNP Enterprise track. Every other concentration rewards a big lab, because every other concentration asks you to configure something. ENSLD asks you to choose - which routing protocol scales here, where the Layer 2 boundary goes, whether this WAN survives a single-circuit failure. You cannot lab a justification. What a lab does give you is intuition about the failure modes the questions are built on, and that takes five nodes, not fifty.
Three routers is the smallest topology that shows you a redundant path, a summarisation boundary and a route you can filter. The switch is there only so you have somewhere to see the Layer 2 to Layer 3 boundary you are being asked to design, and the ISP is a single eBGP peering. Five nodes is not a coincidence: it is the CML free-tier limit, and this is one of the few CCNP exams that fits inside it.
Where to build it
For a design exam the platform decision is easy, because you need very little. Anything that runs a handful of routers is enough, and the free tier of Cisco's own emulator covers it.
| Platform | Good enough? | Cost | What decides it |
|---|---|---|---|
| CML-Free | Yes | $0, 5 nodes | Genuinely enough for this exam. The free ISO ships IOL and IOL-L2, which is exactly what a design lab needs. |
| CML-Personal | Yes | $199/yr, 20 nodes | Nice to have, not needed. Buy it for ENARSI, not for ENSLD. |
| EVE-NG / GNS3 | Entitlement | $0 + your own images | No advantage here, and CML's licence forbids exporting its images into them. |
| No lab at all | Legitimate | $0 | A defensible choice for this exam alone. Time spent drawing topologies beats time spent configuring them. |
The one thing worth spending on for ENSLD is not gear. It is whatever lets you draw a topology quickly, because the exam tests whether you can reason about a diagram under time pressure. You may not move CML's images into EVE-NG or GNS3. The CML end-user licence, revised April 2026, restricts the bundled images to use inside CML. Both emulators are perfectly capable tools - but you have to be separately entitled to whatever you load into them, and that is the real reason people end up paying for CML rather than the software itself.
Images and horsepower
The image list is short, and every item is something the free tier of CML ships or that any emulator can run.
| Component | What it is | Where it comes from |
|---|---|---|
| IOL (IOS XE Router) | The three router nodes | On the CML free-tier ISO, 1 GB each |
| IOL-L2 (IOS XE Switch) | The Layer 2 switch | On the CML free-tier ISO, 1 GB |
| IOSv | A lighter alternative if you have a paid tier | 512 MB rather than 1 GB, so more nodes fit - but not on the free ISO |
| Alpine Linux | A host for reachability tests | Bundled, 512 MB. External connectors do not count against the node limit |
About 4.5 GB of node memory runs this topology, and Cisco's stated host minimum for CML is 8 GB with four physical cores. The free-tier image set is smaller than people expect - it ships IOL, IOL-L2, ASAv and Linux hosts, and nothing else - but IOL and IOL-L2 are precisely what a design lab needs. The free tier has one trap worth knowing. On IOL nodes Cisco disables Layer 1 signalling, so shutting an interface stops forwarding while the node still reports the link UP. Since IOL is all the free tier gives you, free-tier labs cannot reproduce link-failure detection realistically. Paid tiers add IOSv, which behaves properly.
The build list
Work top to bottom. Each step is a thing you build and then break on purpose, and each one is tagged with the blueprint domain it covers, so by the end you have touched the parts of the syllabus a lab can reach.
Two areas and a summarisation boundaryRouting 25%
Run OSPF across R1, R2 and R3 with an area boundary on R3. Summarise, then deliberately break the summary and watch what the routing table does. The exam asks which summarisation is correct far more often than it asks for the command.
Add BGP and make path selection visibleRouting 25%
Peer R3 with the ISP cloud, advertise a couple of prefixes, then move local preference and AS-path around until you can predict the winner before you look. Path attributes for path preference are named explicitly in the blueprint.
Draw the campus, then build only the boundaryCampus 25%
Sketch a three-tier campus on paper. In the lab, build only the piece you are unsure about - usually where Layer 2 stops. Configure a first-hop redundancy protocol on R1 and R2 and fail one of them.
Break the WAN on purposeWAN 20%
Take down the R3-to-ISP link with the routers still converged and time how long the network takes to notice. Then do it again with a tuned timer. Design questions about resiliency are asking you to have felt this difference.
Mark traffic once, at the edgeServices 20%
Apply a simple classification and marking policy at R1 and verify it is trusted downstream. You are not being asked to build a full QoS design in the exam, you are being asked where marking belongs.
Read one YANG model and one telemetry configAutomation 10%
Do not build an automation pipeline. Open a YANG model, look at a NETCONF payload, read a model-driven telemetry subscription. The automation domain is recognition-level and this is an hour of work, not a weekend.
What you can and cannot lab
Cisco publishes the domain weightings but not the number of items or the passing score, so treat the percentages as how the paper is built rather than as a target. The column that matters here is the last one.
| Domain | Weight | Labbable | Notes |
|---|---|---|---|
| Advanced Addressing and Routing Solutions | 25% | Yes | The one domain a lab genuinely sharpens. EIGRP, OSPF, IS-IS and BGP all run in any emulator. |
| Advanced Enterprise Campus Networks | 25% | Partly | Layer 2 and FHRP behaviour labs fine. SD-Access is described, not built - there is no home-lab fabric. |
| WAN for Enterprise Networks | 20% | Partly | DMVPN, IPsec and GRE lab well. SD-WAN is a controller platform and does not. |
| Network Services | 20% | Yes | QoS marking and multicast both run in an emulator, and multicast especially rewards seeing it. |
| Automation and Artificial Intelligence | 10% | Partly | Renamed in the July 2025 refresh. You can read YANG and run NETCONF against a node; cloud on-ramp and the AI additions are reading only. |
The walls you will hit
ENSLD's walls are unusually forgiving, because a design exam does not need you to have built the thing you are designing. The gaps that remain are the platform-shaped ones.
Cannot be labbed at home
- SD-Access fabric. Catalyst Center is not in the CML reference platform list at any tier, so the fabric cannot be built at home. The blueprint knows this: those topics are Describe-level.
- SD-WAN. Same shape, and the controllers alone want roughly 24 GB before you add an edge. Read it for ENSLD; build it only if you are also sitting ENSDWI.
- Campus hardware behaviour. StackWise, StackWise Virtual and supervisor failover are hardware properties. IOL forwards in software, so it can show you the design consequence but never the real failover timing.
- Anything with a cut score attached. Cisco publishes no passing score and no item count, so no amount of lab time tells you how close you are. Only question volume does.
That last one is worth sitting with. For most CCNP exams the honest advice is to lab more. For ENSLD the honest advice is to lab a little, draw a lot, and spend the time you saved on question practice - because the paper rewards recognising a bad design faster than it rewards configuring a good one.
A lab proves you can build it. Questions prove you can pass.
The blueprint is only half the exam — the other half is answering under a clock. Start with the free question sets, then $5.99 unlocks the full 300-420 ENSLD bank.
Free 300-420 ENSLD practice test300-420 ENSLD exam pageFAQ
Do I need a lab to pass 300-420 ENSLD?
Not much of one. ENSLD is a design exam - the objectives say create and design rather than configure, and no question asks you to type a command. A five-node emulated topology is enough to build intuition about convergence and summarisation; beyond that, extra lab time has poor returns compared with question practice.
What is the cheapest way to lab ENSLD?
The free tier of Cisco Modeling Labs. It ships Cisco's own images and its node limit is well above the three routers, one switch and two hosts this exam needs. EVE-NG Community and GNS3 are equally capable but leave you sourcing images yourself.
How many questions are on 300-420 and what is the passing score?
Cisco publishes neither. The exam runs 90 minutes and costs $300, and that is all the official page states. Cut scores are set by statistical analysis and can change without notice, so any specific number you see quoted is a third-party estimate.
Does passing 300-420 give me CCNP Enterprise?
No. It earns Cisco Certified Specialist - Enterprise Design. CCNP Enterprise also requires the core exam, 350-401 ENCOR, which moved to v1.2 in March 2026.
Sources
Exam facts come from Cisco. Lab guidance is marked as official or as practitioner consensus where the two differ:
- https://learningcontent.cisco.com/documents/marketing/exam-topics/300-420-ENSLD-v1.1.pdf
- https://www.cisco.com/site/us/en/learn/training-certifications/exams/ensld.html
- https://www.cisco.com/site/us/en/learn/training-certifications/exams/policies.html
- https://developer.cisco.com/modeling-labs/
Checked September 5, 2026. Cisco revises exam topics and changes image licensing without notice — confirm before you spend anything.