CCNP Infrastructure Practice Question
A network engineer is deploying a new branch office that uses Cisco SD-Access. The fabric must support both wired and wireless clients, with a single control plane that provides host tracking, location, and policy enforcement. Which fabric component is responsible for these functions?
⚠ Common exam trap
The trap here is assuming that DNA Center or ISE provides the fabric control plane, when in fact they are management and policy components that rely on the control plane node for endpoint tracking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fabric control plane node
The fabric control plane node in Cisco SD-Access runs LISP map-server and map-resolver, providing a centralized database for endpoint-to-RLOC mappings. This enables host tracking, location services, and a single control plane for both wired and wireless clients. DNA Center and ISE are supporting components for management and policy, but they do not provide the runtime control-plane functions described in the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cisco Identity Services Engine (ISE)
Why it's wrong here
Cisco ISE is a policy and identity server that integrates with SD-Access for authentication and authorization, but it does not provide the fabric's control-plane functions such as host tracking or location services. ISE supplies policy intent through pxGrid and external policy integration, while the actual fabric control plane is handled by a dedicated node. Therefore, ISE alone cannot fulfill the requirement for a single control plane in this scenario.
- ✓
Fabric control plane node
Why this is correct
In Cisco SD-Access, the fabric control plane node runs the LISP map-server and map-resolver functions, maintaining the endpoint identifier (EID) to routing locator (RLOC) mappings for all fabric endpoints. This provides host tracking, location, and a unified control plane for both wired and wireless clients. The control plane node is essential for scalable fabric operations and policy enforcement through group-based policies.
- ✗
Fabric edge node
Why it's wrong here
Fabric edge nodes connect endpoints to the fabric and perform VXLAN encapsulation/decapsulation. They register endpoint information with the control plane node but do not maintain the central database or provide fabric-wide host tracking. The edge node is responsible for policy enforcement at the point of attachment, but the control plane node is the central component for location and mapping. Thus, the edge node alone does not satisfy the requirement.
- ✗
Cisco DNA Center
Why it's wrong here
Cisco DNA Center is the management and orchestration platform for SD-Access, used to design, provision, and monitor the fabric. It does not participate directly in the data or control plane forwarding of client traffic. The question asks for the component that tracks hosts and enforces policy at the fabric level, which is not DNA Center. DNA Center automates deployment but does not provide the runtime control-plane functions described.
Visual reference
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.