CCNP Architecture Practice Question
A network engineer is deploying Cisco SD-Access and needs to ensure that endpoints in the same virtual network (VN) can communicate across fabric sites while endpoints in different VNs remain isolated. Which control plane component is responsible for propagating endpoint reachability information between fabric sites?
⚠ Common exam trap
Test-takers frequently confuse the border node's data plane role in VXLAN encapsulation with the control plane node's LISP responsibility for propagating endpoint reachability between fabric sites.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco DNA Center fabric control plane node
In Cisco SD-Access, the control plane node runs LISP and is responsible for registering endpoint EID-to-RLOC mappings and sharing them with control plane nodes in other fabric sites over the transit network. This allows endpoints in the same virtual network to be reached across sites while VN isolation is preserved through separate LISP instance IDs and VRFs. Border and intermediate nodes forward data plane traffic but do not propagate reachability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cisco DNA Center fabric site border node
Why it's wrong here
The border node handles data plane traffic entering and leaving the fabric site and performs VXLAN encapsulation for external destinations, but it does not propagate endpoint reachability information to other fabric sites. That role belongs to the control plane node, so relying on the border node alone would leave remote sites unaware of local endpoints and break inter-site communication.
- ✗
Cisco DNA Center fabric intermediate node
Why it's wrong here
Intermediate nodes are the access and distribution switches that forward VXLAN-encapsulated traffic within the fabric site based on the SGT and VN. They do not participate in the LISP control plane and therefore cannot advertise endpoint reachability between sites; assigning this role to an intermediate node misidentifies the control plane function in SD-Access.
- ✓
Cisco DNA Center fabric control plane node
Why this is correct
The fabric control plane node runs LISP and maintains the mapping of endpoint EIDs to RLOCs. When a fabric site is connected via a transit network, control plane nodes in each site exchange LISP map-register and map-notify messages so that endpoints in the same VN are reachable across sites while different VNs stay isolated by their respective VRFs and LISP instance IDs.
- ✗
Cisco Identity Services Engine policy node
Why it's wrong here
Cisco ISE provides authentication, authorization, and SGT assignment through pxGrid and RADIUS, but it does not distribute endpoint reachability information across fabric sites. Its role is policy and identity, not LISP EID-to-RLOC mapping, so it cannot satisfy the requirement for cross-site endpoint propagation in an SD-Access fabric.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.