CCNP Infrastructure Practice Question
A network administrator is deploying a Cisco SD-Access fabric and needs to ensure that the underlay network is properly configured. Which two statements about the underlay network in SD-Access are true? (Choose two.)
⚠ Common exam trap
The trap here is conflating the underlay with the overlay, assuming the underlay carries endpoint prefixes or uses VXLAN, when it only provides IP transport.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The underlay must support MTU sizes large enough to accommodate VXLAN encapsulation overhead.
The underlay in SD-Access provides IP connectivity between fabric nodes using a routing protocol like IS-IS or OSPF, and it must support a larger MTU to accommodate VXLAN encapsulation overhead. The underlay does not carry endpoint subnet information; that is the role of the overlay. It is a Layer 3 network, not Layer 2, and it does not use VXLAN for encapsulation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The underlay can be configured as a Layer 2 network with VLANs to simplify deployment.
Why it's wrong here
Cisco SD-Access underlay is typically a Layer 3 network. While it is possible to have Layer 2 segments for certain legacy devices, the fabric underlay itself requires IP routing to support VXLAN and LISP. A pure Layer 2 underlay would not provide the necessary scalability and loop prevention. The underlay is designed as a routed network, often using IS-IS, to ensure fast convergence and simplicity.
- ✗
The underlay network carries endpoint subnet information and is used for endpoint-to-endpoint communication.
Why it's wrong here
Endpoint subnet information is carried in the overlay network, specifically via LISP in the control plane. The underlay only provides transport between fabric nodes; it does not carry endpoint prefixes. Endpoint-to-endpoint communication occurs over VXLAN tunnels in the overlay. Confusing the roles of underlay and overlay is a common mistake; the underlay is purely the transport network.
- ✓
The underlay must support MTU sizes large enough to accommodate VXLAN encapsulation overhead.
Why this is correct
VXLAN adds 50 bytes of overhead (outer IP, UDP, VXLAN header). The underlay must support an MTU of at least 1550 bytes (typically 1600 or higher) to avoid fragmentation of VXLAN-encapsulated packets. If the underlay MTU is too small, large packets may be dropped or fragmented, causing performance issues. Therefore, configuring jumbo frames on the underlay is a best practice for SD-Access.
- ✓
The underlay uses a routing protocol such as IS-IS or OSPF to provide IP connectivity between fabric nodes.
Why this is correct
In Cisco SD-Access, the underlay network is responsible for IP reachability between all fabric nodes (control plane, border, edge). It typically runs a dynamic routing protocol like IS-IS or OSPF to exchange routes. This ensures that VXLAN tunnels can be established between fabric nodes. The underlay is independent of the overlay and does not carry endpoint subnet information; it only provides transport.
- ✗
The underlay uses VXLAN to encapsulate traffic between fabric nodes.
Why it's wrong here
VXLAN is used in the overlay network to encapsulate endpoint traffic between fabric edge nodes. The underlay does not use VXLAN; it forwards native IP packets. VXLAN tunnels are established over the underlay, but the underlay itself is not VXLAN-encapsulated. This distinction is important: the underlay provides the IP transport that carries the VXLAN-encapsulated packets.
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.