350-401 SD-Access Architecture — 20 Questions

Question 1

A network engineer is deploying Cisco SD-Access in a large enterprise campus. The design requires that all user traffic be segmented by Virtual Network (VN) and that the fabric edge nodes perform SGT-based enforcement. The engineer notices that traffic between two endpoints in the same IP subnet but different VNs is being forwarded directly at the fabric edge without any SGT inspection. What is the most likely cause?

Accepted Answer

The endpoints are in the same IP subnet, so they must be in the same Virtual Network; SGT enforcement only applies to inter-VN traffic.. In Cisco SD-Access, Virtual Networks (VNs) provide Layer 3 segmentation. Traffic between endpoints in the same IP subnet but different VNs is inherently Layer 2 traffic and cannot be routed or inspected by SGT-based enforcement, which only applies to inter-VN (Layer 3) traffic. Since the endpoints are in the same subnet, the fabric edge node forwards the traffic at Layer 2 without SGT inspection, making option B correct.

Answer

The fabric edge nodes have not been configured with the proper SGT mappings.

Answer

The fabric edge nodes are operating in Layer 2 mode and do not support SGT enforcement.

Answer

The control plane node has not been configured with the correct IP-SGT mappings.

Question 2

An enterprise is migrating from a traditional three-tier campus network to Cisco SD-Access. The network engineer has deployed a fabric with a single fabric edge node and a single control plane node. Users in VLAN 10 report that they cannot reach the default gateway, which is a virtual IP on the fabric edge. The fabric edge is configured with a VLAN 10 SVI and the anycast gateway feature is enabled. What is the most likely cause of the problem?

Accepted Answer

The fabric edge node is not configured with the VLAN 10 SVI or the anycast gateway feature is disabled.. Option A is correct because the question states that the fabric edge is configured with a VLAN 10 SVI and anycast gateway is enabled, yet users cannot reach the default gateway. The most likely cause is a misconfiguration: either the SVI is missing or anycast gateway is disabled on the fabric edge. In Cisco SD-Access, the anycast gateway feature must be explicitly enabled under the SVI using the command 'ip virtual-reassembly in' and 'ip local-proxy-arp' along with the 'anycast-gateway' configuration; without it, the fabric edge cannot respond to ARP requests or route traffic for the virtual IP, breaking connectivity to the default gateway.

Answer

The control plane node is not reachable from the fabric edge, causing the fabric edge to drop traffic.

Answer

The endpoints are not configured with the correct IP address for the default gateway.

Answer

The fabric edge node is in Layer 2 mode and cannot route traffic.

Question 3

A network architect is designing an SD-Access fabric for a large enterprise campus. The design must support segmentation at Layer 2 and Layer 3 across the fabric, using a centralized control plane and policy enforcement. Which two protocols are essential for the SD-Access overlay to meet these requirements?

Accepted Answer

LISP and VXLAN. LISP (Locator/ID Separation Protocol) provides the centralized control plane for endpoint identity-to-location mapping and policy-based forwarding, while VXLAN (Virtual Extensible LAN) supplies the data-plane encapsulation needed for Layer 2 and Layer 3 segmentation across the underlay. Together, they enable scalable overlay segmentation with a centralized policy enforcement point in SD-Access.

Answer

MP-BGP and MPLS

Answer

OSPF and GRE

Answer

IS-IS and NVGRE

Question 4

An architect is planning a Cisco SD-Access fabric deployment. The design must support host mobility across multiple fabric edge nodes while ensuring consistent policy enforcement. Which fabric component is responsible for tracking endpoint locations and mapping them to the fabric?

Accepted Answer

Fabric control plane node. In Cisco SD-Access, the fabric control plane node (based on LISP) is responsible for maintaining the endpoint database (EID-to-RLOC mappings). When a host moves between fabric edge nodes, the control plane node updates the mapping, ensuring consistent policy enforcement by providing the correct location information to all edge nodes.

Answer

Fabric border node

Answer

Fabric edge node

Answer

Fabric wireless controller

Question 5

A company is deploying an SD-Access fabric with multiple sites connected via a WAN. The design must allow inter-site traffic to be forwarded without requiring a full mesh of VXLAN tunnels between all edge nodes. Which fabric role should be used to interconnect the sites?

Accepted Answer

Fabric border node. A Fabric Border Node is the correct role because it acts as the gateway between the SD-Access fabric and external networks, including WAN connections. It performs Network-to-Network Interconnection (NNI) by translating VXLAN-encapsulated traffic into the appropriate WAN transport (e.g., IPsec, MPLS) and handles inter-site routing without requiring a full mesh of VXLAN tunnels between all Edge Nodes. This design leverages the Border Node to aggregate traffic and forward it over the WAN, reducing tunnel overhead and simplifying the fabric architecture.

Answer

Fabric control plane node

Answer

Fabric edge node

Answer

Fabric WAN controller

Question 6

An architect is designing an SD-Access fabric for a campus network that requires segmentation of guest, employee, and IoT traffic. The design must use Cisco TrustSec for policy enforcement. Which component is responsible for assigning the Security Group Tag (SGT) to endpoints upon authentication?

Accepted Answer

Cisco ISE. Cisco ISE is the policy decision point in a TrustSec-enabled SD-Access fabric. When an endpoint authenticates via 802.1X, MAB, or web authentication, ISE evaluates the authentication result and the applicable authorization policy, then dynamically assigns a Security Group Tag (SGT) to the endpoint. This SGT is passed to the network access device (e.g., fabric edge node) via RADIUS attributes in the Access-Accept message, enabling consistent policy enforcement throughout the fabric.

Answer

Fabric edge node

Answer

Fabric control plane node

Answer

Cisco DNA Center

Question 7

A network team is designing the underlay for an SD-Access fabric. The design must use a routing protocol that supports fast convergence and is commonly recommended for the fabric underlay. Which routing protocol should be used?

Accepted Answer

IS-IS. IS-IS is the correct choice because it is a link-state routing protocol that provides fast convergence, is highly scalable, and is the most commonly recommended routing protocol for the underlay of an SD-Access fabric. Cisco SD-Access designs frequently use IS-IS to support the fabric's control plane and data plane requirements, leveraging its ability to handle large, flat network topologies with minimal overhead.

Answer

RIP

Answer

EIGRP

Answer

BGP

Question 8

An architect is designing an SD-Access fabric for a campus with multiple buildings. The design must support wireless clients seamlessly roaming across fabric edge nodes. Which technology is used in the fabric to provide mobility for wireless endpoints?

Accepted Answer

LISP. LISP (Locator/ID Separation Protocol) is the correct technology because it decouples the endpoint identifier (EID) from its routing locator (RLOC), enabling seamless roaming across fabric edge nodes. In SD-Access, LISP maintains a mapping database that tracks wireless endpoint locations, allowing traffic to be forwarded to the correct fabric edge without re-anchoring or tunneling changes as clients move between access points.

Answer

VXLAN

Answer

OTV

Answer

MPLS

Question 9

A company is deploying an SD-Access fabric with a centralized policy model. The design must ensure that all traffic between virtual networks (VNs) is inspected by a firewall. Which fabric role should be used to enforce this inter-VN policy?

Accepted Answer

Fabric border node. In a centralized policy model for SD-Access, the fabric border node is the correct role to enforce inter-VN traffic policies because it is the only node that can route traffic between different virtual networks (VNs) while applying firewall inspection. The border node connects the fabric to external networks and, when configured with a firewall, can enforce policies such as IP-based ACLs or zone-based firewalls for traffic crossing VNs. This design ensures that all inter-VN traffic is funneled through the border node for inspection, aligning with the centralized policy model where policy enforcement occurs at the network edge.

Answer

Fabric edge node

Answer

Fabric control plane node

Answer

Fabric WAN router

Question 10

An architect is designing an SD-Access fabric for a campus that requires high availability. The design must ensure that if one fabric edge node fails, endpoints can be re-homed to another edge node without manual intervention. Which feature should be implemented?

Accepted Answer

Anycast Layer 2 gateway. Anycast Layer 2 gateway is the correct feature because it allows multiple fabric edge nodes to share the same anycast IP and MAC address for a given VLAN. If one edge node fails, endpoints simply continue using the same gateway address, and their traffic is automatically forwarded to a surviving edge node via the fabric's underlay routing, requiring no manual intervention or protocol convergence.

Answer

HSRP

Answer

VRRP

Answer

GLBP

Question 11

A network team is designing an SD-Access fabric for a large enterprise. The design must support automated provisioning and policy management. Which management platform is essential for deploying and managing the fabric?

Accepted Answer

Cisco DNA Center. Cisco DNA Center is the essential management platform for deploying and managing an SD-Access fabric because it provides a centralized, intent-based interface for automating the entire fabric lifecycle, including design, provisioning, policy creation, and assurance. It integrates with Cisco ISE for policy enforcement and with network devices via APIs (e.g., NETCONF/YANG) to push configurations such as VXLAN, LISP, and CTS SGTs. Without DNA Center, the automated provisioning and policy management required for SD-Access cannot be achieved at scale.

Answer

Cisco ISE

Answer

Cisco Prime Infrastructure

Answer

Cisco vManage

Question 12

Examine the following configuration snippet:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 100
 spanning-tree portfast
 spanning-tree bpduguard enable

What is the effect of this configuration?

Accepted Answer

The port will immediately transition to forwarding state and will be error-disabled if a BPDU is received.. The configuration enables PortFast and BPDU Guard on an access port. PortFast immediately transitions the port to forwarding state, bypassing the usual STP listening and learning phases. BPDU Guard monitors for incoming BPDUs; if any are received, it error-disables the port to prevent a potential bridging loop from an unauthorized switch connection.

Answer

The port will remain in blocking state until a BPDU is received from the root bridge.

Answer

The port will only forward BPDUs and will not forward data traffic.

Answer

The port will participate in RSTP and will not be affected by BPDU reception.

Question 13

Consider the following configuration:

router eigrp 100
 network 10.0.0.0 0.255.255.255
 passive-interface default
 no passive-interface GigabitEthernet0/0

Which statement is true about this EIGRP configuration?

Accepted Answer

EIGRP will send and receive updates only on GigabitEthernet0/0.. The `passive-interface default` command sets all interfaces to passive by default, preventing EIGRP from sending or receiving hello packets (and thus updates) on them. The `no passive-interface GigabitEthernet0/0` command then overrides this default for that specific interface, allowing EIGRP to send and receive updates only on GigabitEthernet0/0. The network statement 10.0.0.0 0.255.255.255 enables EIGRP on any interface matching the 10.0.0.0/8 range, but the passive-interface logic restricts actual adjacency formation.

Answer

EIGRP will send updates on all interfaces except GigabitEthernet0/0.

Answer

EIGRP will not send any updates because the network statement is incorrect.

Answer

EIGRP will form adjacencies on all interfaces that have an IP address in the 10.0.0.0/8 range.

Question 14

Given this OSPF configuration:

router ospf 1
 router-id 1.1.1.1
 network 192.168.1.0 0.0.0.255 area 0
 network 10.0.0.0 0.255.255.255 area 1
 default-information originate always

What is the effect of the 'default-information originate always' command?

Accepted Answer

OSPF will advertise a default route into all OSPF areas even if no default route is present in the routing table.. The 'default-information originate always' command instructs OSPF to generate and advertise a default route (0.0.0.0/0) into the OSPF domain as a Type 5 External LSA, regardless of whether a default route exists in the router's own routing table. This ensures that all OSPF routers in every area receive the default route, making the advertising router a gateway of last resort.

Answer

OSPF will only advertise a default route if a default route is already in the routing table.

Answer

OSPF will redistribute all connected routes as type 5 LSAs.

Answer

OSPF will generate a default route only for area 0.

Question 15

Examine the following BGP configuration:

router bgp 65001
 bgp log-neighbor-changes
 neighbor 10.1.1.1 remote-as 65002
 neighbor 10.1.1.1 route-map SET_MED out
!
route-map SET_MED permit 10
 set metric 50

What is the purpose of this configuration?

Accepted Answer

It sets the MED value to 50 for all routes sent to the neighbor 10.1.1.1.. The configuration applies a route-map named SET_MED to outbound updates toward neighbor 10.1.1.1. The route-map permits all routes (no match statement) and sets the Multi-Exit Discriminator (MED) to 50. MED is a BGP path attribute that influences inbound traffic from the neighbor AS, making this path less preferred if the neighbor has a lower MED from another entry point. Thus, all routes sent to 10.1.1.1 will carry a MED of 50.

Answer

It sets the local preference to 50 for routes received from the neighbor.

Answer

It filters routes with a metric of 50 from being advertised to the neighbor.

Answer

It sets the weight to 50 for routes learned from the neighbor.

Question 16

Consider this VLAN configuration on a Cisco switch:

vlan 10
 name Sales
vlan 20
 name Engineering
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20

What is missing if the switch needs to carry VLAN 30 traffic on this trunk?

Accepted Answer

VLAN 30 must be created and added to the allowed VLAN list on the trunk.. Option A is correct because a trunk port only forwards traffic for VLANs that exist in the switch's VLAN database and are explicitly permitted in the allowed VLAN list. VLAN 30 is neither created (no 'vlan 30' command) nor added to the trunk's allowed list (missing 'switchport trunk allowed vlan add 30'), so the switch will drop any frames tagged with VLAN 30. Creating the VLAN and updating the allowed list ensures the trunk can forward VLAN 30 traffic.

Answer

The trunk must be configured as an access port for VLAN 30.

Answer

The native VLAN must be changed to VLAN 30.

Answer

The switchport mode must be changed to dynamic desirable.

Question 17

Given the following policy-map:

policy-map QOS_POLICY
 class VOICE
  priority percent 30
 class VIDEO
  bandwidth percent 20
  queue-limit 100 packets
 class class-default
  fair-queue

What is the effect of the 'priority percent 30' command in the VOICE class?

Accepted Answer

Voice traffic is placed in a strict priority queue with a guaranteed bandwidth of 30% of the interface bandwidth.. The 'priority percent 30' command in the VOICE class configures a strict priority queue (LLQ) that guarantees voice traffic up to 30% of the interface bandwidth. During congestion, voice packets are always transmitted before other traffic, but they are policed to ensure they do not exceed the allocated 30%, preventing starvation of other queues.

Answer

Voice traffic is limited to 30% of the interface bandwidth and will be dropped if exceeded.

Answer

Voice traffic is given a weight of 30 in the weighted fair queueing algorithm.

Answer

Voice traffic is re-marked with IP precedence 30.

Question 18

What is the default OSPF hello interval on an Ethernet link?

Accepted Answer

10 seconds. The default OSPF hello interval on an Ethernet link is 10 seconds, as specified in RFC 2328. Ethernet is a broadcast multi-access network type, and OSPF uses a 10-second hello interval on such networks to maintain neighbor adjacencies and detect failures within the dead interval (default 40 seconds, or 4 times the hello interval).

Answer

30 seconds

Answer

40 seconds

Answer

5 seconds

Question 19

Which BGP attribute is preferred when it has the lowest value?

Accepted Answer

MED (Multi-Exit Discriminator). The Multi-Exit Discriminator (MED) is a BGP path attribute used to influence inbound traffic to an AS from multiple entry points. A lower MED value is preferred over a higher one, making it the correct answer among the options where the lowest value is preferred.

Answer

Local Preference

Answer

Weight

Answer

AS Path

Question 20

What is the maximum hop count for EIGRP?

Accepted Answer

255. EIGRP uses a maximum hop count of 255, which is a hard limit encoded in the protocol's metric structure. This high limit allows EIGRP to scale in large enterprise networks without the hop-count restrictions of distance-vector protocols like RIP.

Answer

100

Answer

15

Answer

16