- Exam Overview: How the Domains Fit Together
- Domain 1: Business Strategy Design (15%)
- Domain 2: Control, Data, Management Plane, and Operational Design (25%)
- Domain 3: Network Design (30%)
- Domain 4: Service Design (15%)
- Domain 5: Security Design (15%)
- Question Style and Exam Mechanics
- Allocating Study Time Across Domains
- Who Hires for These Domains
- Frequently Asked Questions
- Network Design is the largest domain at 30% of the CCDE 400-007 written exam.
- Control, Data, Management Plane, and Operational Design follows closely at 25%.
- Business Strategy Design, Service Design, and Security Design each carry 15%.
- The written exam runs 90-110 questions in 120 minutes, closed book, at a Pearson VUE test center.
Exam Overview: How the Domains Fit Together
The 400-007 CCDE written exam (version 3.1) is built around five weighted content areas that together test whether a candidate can translate business requirements into a defensible network architecture. Unlike certifications that reward memorized configuration syntax, CCDE domains are scenario-driven: you're handed a business constraint, a set of technical requirements, and asked to justify a design decision against trade-offs. Understanding the exact weighting of each domain is the single most useful planning tool you have, because it tells you where to spend your limited study hours.
This guide breaks down all five domains as Cisco weights them on the current blueprint, explains what each domain actually tests, and shows how they interact. If you haven't yet reviewed the full mechanics of registration, retake rules, and fees, pair this with our CCDE Certification Cost breakdown and the broader CCDE Study Guide for a complete prep roadmap.
| Domain | Weight | Core Focus |
|---|---|---|
| Business Strategy Design | 15% | Aligning architecture with organizational goals, constraints, risk |
| Control, Data, Management Plane, and Operational Design | 25% | Routing/forwarding design, telemetry, operations at scale |
| Network Design | 30% | Topology, WAN/campus/DC architecture, scalability, resiliency |
| Service Design | 15% | Application delivery, QoS, multicast, transport services |
| Security Design | 15% | Segmentation, policy enforcement, secure architecture patterns |
Domain 1: Business Strategy Design (15%)
Business Strategy Design is where CCDE separates itself most sharply from lower-level Cisco certifications. This domain doesn't test whether you know a protocol - it tests whether you can reason about why a design choice makes sense given budget, risk tolerance, M&A activity, regulatory pressure, or an organization's appetite for operational complexity.
Business Strategy Design
Candidates must understand how to extract technical requirements from ambiguous business narratives and translate stakeholder priorities into architectural constraints.
- Identifying business drivers hidden inside a scenario (cost reduction, agility, compliance)
- Balancing CapEx vs. OpEx implications of a design
- Assessing organizational and operational risk tolerance
- Justifying design trade-offs in business terms, not just technical ones
Questions in this domain often present a paragraph of business context before any technical detail appears. Candidates who jump straight to protocol selection without first identifying the business constraint tend to select technically "correct" but contextually wrong answers.
Domain 2: Control, Data, Management Plane, and Operational Design (25%)
This is the second-largest domain and arguably the most technically dense. It covers how routing and forwarding decisions are made and monitored across a distributed network, plus how that network is operated day to day once it's live.
Control, Data, Management Plane, and Operational Design
Expect scenarios that ask you to design for scale, convergence, and observability simultaneously - often with conflicting requirements.
- Control plane scaling: route summarization, policy control, protocol interaction at scale
- Data plane forwarding behavior under failure and steady-state conditions
- Management plane and telemetry design, including modern streaming telemetry approaches
- Operational models: change management, automation touchpoints, and lifecycle design
Because this domain and Network Design together make up 55% of the exam, many candidates find it useful to map out how their CCDE requirements preparation timeline dedicates extra weeks specifically to control-plane failure scenarios rather than treating "routing" as a single generic topic.
Key Takeaway
Study control-plane and data-plane behavior together, not separately - CCDE scenarios almost always test how a forwarding decision changes when the control plane experiences a failure or policy change.
Domain 3: Network Design (30%)
Network Design is the single largest domain on the blueprint, and it functions as the backbone connecting every other domain. This is where candidates demonstrate mastery of end-to-end architecture: campus, WAN, data center, and cloud interconnection, along with the IPv4/IPv6 coexistence strategies that Cisco's v3.1 exam topics explicitly call out.
Network Design
This domain tests architectural judgment across the full network lifecycle - from greenfield topology selection to redesigning an existing network under real-world constraints.
- Topology selection and scalability limits (hub-and-spoke, full mesh, hierarchical models)
- Resiliency and redundancy design across WAN, campus, and data center domains
- IPv4/IPv6 dual-stack and transition strategy design
- AI-related design considerations now embedded in the current core technology list
- Multi-site and cloud-edge integration patterns
Because this domain carries the most weight, it deserves the most rigorous self-testing. Our CCDE Cheat Sheet condenses the topology and scalability trade-offs most frequently tested here into a fast pre-exam review.
Domain 4: Service Design (15%)
Service Design focuses on how applications and traffic types are actually delivered across the architecture you've built in the Network Design domain. It's the layer where quality of experience, transport efficiency, and service-level guarantees get designed in.
Service Design
Candidates need to reason about traffic behavior, not just transport mechanics.
- QoS design across heterogeneous transport (WAN, wireless, data center)
- Multicast design for distributed application delivery
- Application performance and SLA-driven design decisions
- Service chaining and overlay/underlay service interaction
Service Design questions frequently combine with Network Design scenarios - you may be asked to select a transport architecture and then justify the QoS policy that makes it viable for a specific application profile.
Domain 5: Security Design (15%)
Security Design tests architectural security judgment rather than product-specific configuration. Expect scenarios involving segmentation strategy, policy enforcement points, and how security controls interact with the rest of the design without breaking scalability or operational simplicity.
Security Design
The emphasis is on where and how security is architected into the network, not on memorizing feature sets.
- Segmentation strategies across campus, WAN, and data center boundaries
- Policy enforcement placement and its effect on scalability
- Secure architecture patterns for hybrid and multi-site environments
- Trade-offs between security posture and operational complexity
Because Security Design overlaps heavily with both Network Design and the Control/Data/Management Plane domain, candidates rarely study it in isolation successfully. It's more effective to revisit security constraints every time you review a topology scenario.
Question Style and Exam Mechanics
All five domains are assessed through a single written exam delivered under consistent, well-documented conditions. Knowing these mechanics in advance removes avoidable exam-day friction.
- Format: 90-110 multiple-choice questions across all five domains, delivered in English
- Time: 120 minutes, closed book, no reference material permitted
- Delivery: Pearson VUE testing centers only - the 400-007 exam is excluded from online proctoring
- Prerequisites: None required to sit the written exam
- Fee: USD 450 for the written exam
- Scoring: Reported as pass/fail, with no domain-by-domain score breakdown published
- Validity: The written qualifying exam result is valid for three years
- Retakes: A five calendar-day wait applies before retesting, beginning the day after a failed attempt
It's worth repeating a point that trips up many candidates: passing this written exam qualifies you for the separate eight-hour practical exam (priced at USD 1,600), but it does not by itself earn the full CCDE certification. For a complete cost picture across both exams, see CCDE Certification Cost 2026, and for the exact score mechanics behind pass/fail reporting, review CCDE Passing Score 2026.
If you're still mapping out testing windows and scheduling logistics around these domains, our CCDE Exam Dates guide covers registration timing in detail.
Allocating Study Time Across Domains
Given the fixed weighting of each domain, the most defensible study plan allocates time roughly in proportion to exam weight, with extra buffer time for the two largest domains where scenario complexity tends to be highest.
Network Design (30%)
- Topology trade-offs, resiliency patterns, IPv4/IPv6 transition design, AI-related design topics
Control, Data, Management Plane, and Operational Design (25%)
- Routing/forwarding scale scenarios, telemetry, operational lifecycle design
Business Strategy Design (15%) + Service Design (15%)
- Practice extracting business drivers; pair with QoS and multicast service scenarios
Security Design (15%) + Integrated Review
- Segmentation and policy placement; full-length scenario practice across all five domains
This isn't a rigid template - it's a weighting-based starting point. If your background is heavier in security than in strategic business analysis, shift hours toward Business Strategy Design accordingly. For a broader methodology on pacing multi-week prep, see our CCDE Study Guide, and if you want a candid assessment of how difficult each domain tends to feel in practice, How Hard Is the CCDE Exam? breaks that down further.
Running full scenario simulations through a structured practice environment on the main practice platform is one of the most reliable ways to test whether your domain-by-domain knowledge holds up under exam-style time pressure.
Who Hires for These Domains
The five-domain structure exists because employers hiring for principal architect, network design lead, and senior consulting engineering roles need evidence that a candidate can reason across business, technical, and operational layers simultaneously - not just configure devices. Organizations running large multi-site WANs, complex data center fabrics, or hybrid cloud architectures tend to value the Network Design and Control/Data/Management Plane domains most heavily, since those map directly to day-to-day architectural responsibilities.
If you're evaluating whether pursuing this credential aligns with your career trajectory, our analyses on CCDE Jobs, CCDE Salary Guide 2026, and Is the CCDE Certification Worth It? go deeper into how these domains translate into hiring signals.
Frequently Asked Questions
Network Design is the largest domain at 30% of the 400-007 written exam, followed by Control, Data, Management Plane, and Operational Design at 25%.
The domain weighting described here applies to the 400-007 written exam. The separate eight-hour practical exam is a distinct assessment required to earn the full CCDE certification.
No. Results are reported as pass/fail only, with no published breakdown of performance by individual domain.
The written qualifying exam is valid for three years, giving candidates a defined window to schedule and complete the practical exam.
No. The 400-007 exam is excluded from online proctoring and must be taken at a Pearson VUE testing center.