CCNP Virtualization Practice Question
A network engineer is deploying a Cisco SD-Access fabric using Cisco DNA Center. The design requires that wired users authenticate via 802.1X and be assigned to a specific overlay segment based on their department. Which Cisco SD-Access fabric component is responsible for authenticating the endpoint and assigning the endpoint to the correct overlay?
⚠ Common exam trap
The trap here is assuming that Cisco DNA Center performs the authentication, when it only defines policy and the edge node enforces it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fabric edge node
In Cisco SD-Access, the fabric edge node is the device where endpoints connect and are authenticated. It uses 802.1X, MAC authentication bypass, or web authentication to verify identity and then assigns the endpoint to a virtual network based on the policy defined in Cisco DNA Center. The control plane node handles LISP mappings, and the border node handles external connectivity, so they do not perform the authentication and assignment role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cisco DNA Center
Why it's wrong here
Cisco DNA Center is the management and automation platform that defines policies and provisions the fabric. It does not directly authenticate endpoints at the data plane. While it configures the edge nodes with policies, the actual authentication and assignment happen on the fabric edge node, not on the controller itself.
- ✗
Fabric border node
Why it's wrong here
The border node provides connectivity between the SD-Access fabric and external networks, such as the data center or the internet. It handles VXLAN-to-VLAN or VXLAN-to-VXLAN handoff but does not authenticate endpoints or assign them to virtual networks. Therefore, it is not responsible for the described function.
- ✓
Fabric edge node
Why this is correct
The fabric edge node is the first-hop device that connects wired endpoints to the fabric. It runs the host tracking database and acts as the authenticator for 802.1X, mapping the endpoint to the appropriate virtual network based on the Cisco DNA Center policy. When a user connects, the edge node performs authentication and assigns the endpoint to the correct overlay segment.
- ✗
Fabric control plane node
Why it's wrong here
The control plane node runs the LISP map server and map resolver, which maintain the endpoint-to-routing-locator mappings. It does not authenticate users or assign them to overlay segments. Authentication and policy enforcement occur at the edge node, not the control plane node, so this device would not fulfill the requirement.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.