CCNP Virtualization Practice Question
A network engineer is deploying a Cisco SD-Access fabric. The design requires that endpoints in the same virtual network can communicate with each other even when they attach to different fabric edge nodes, while endpoints in different virtual networks remain isolated. Which control-plane component is responsible for registering endpoint IP-to-location mappings and answering fabric edge node queries?
⚠ Common exam trap
The trap here is assuming Cisco DNA Center performs the runtime endpoint mapping lookups, when it actually handles design, policy, and automation while the fabric control-plane node owns the LISP mapping database.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fabric control-plane node
In Cisco SD-Access, the fabric control-plane node provides the LISP-based mapping database that stores endpoint ID-to-RLOC associations. Edge nodes register local endpoints and query this node to learn where remote endpoints reside, which enables communication between endpoints in the same virtual network across different edge nodes while preserving isolation between virtual networks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Fabric control-plane node
Why this is correct
The fabric control-plane node runs LISP as the control plane for SD-Access, maintaining the endpoint ID-to-RLOC mapping database. Edge nodes register locally learned endpoints with it and query it to resolve remote endpoint locations before building VXLAN tunnels. This centralized mapping service enables same-virtual-network communication across edge nodes while keeping different virtual networks isolated through separate LISP instance IDs.
- ✗
Fabric intermediate node
Why it's wrong here
Fabric intermediate nodes are underlay devices that provide pure Layer 3 IP transit between fabric edge and border nodes. They forward VXLAN-encapsulated traffic based on outer IP headers without participating in endpoint registration or mapping lookups. Since they do not maintain any endpoint identity database, they cannot answer edge node queries for remote endpoint locations in this deployment.
- ✗
Cisco DNA Center appliance
Why it's wrong here
Cisco DNA Center is the management and automation platform for SD-Access; it defines fabric sites, policies, and virtual networks but does not register endpoint IP-to-location bindings or answer edge node mapping queries at data-plane scale. Endpoint registration and lookup are handled by a dedicated control-plane node, so relying on DNA Center for this function would not provide the required scalable endpoint identity resolution.
- ✗
Fabric edge node
Why it's wrong here
Fabric edge nodes connect wired and wireless endpoints into the fabric and encapsulate traffic in VXLAN, but they query the control plane for endpoint locations rather than serving as the authoritative registry. Each edge node only knows about locally attached endpoints and relies on the control-plane node to resolve remote endpoint mappings, so it cannot independently satisfy cross-node communication requirements in the scenario.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.