CCNP Practice Question: An architect is designing an SD-Access fabric for…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Cisco ISE for policy management, LISP for control plane, VXLAN for data plane, and Cisco TrustSec for SGT-based enforcement

  Why this is correct

  In Cisco SD-Access, ISE authenticates users and assigns Scalable Group Tags (SGTs) to define policy; LISP serves as the overlay control plane, decoupling routing from endpoint location to support host mobility and scale. VXLAN is the data plane encapsulation that transparently carries traffic and embeds the SGT in its header for group-based enforcement at fabric edge nodes. TrustSec uses those SGTs rather than IP addresses to enforce security policies consistently across the fabric, which is exactly the intended role of each protocol in the architecture.

• ✗

  Cisco ISE for policy management, OSPF for control plane, GRE for data plane, and ACLs for enforcement

  Why it's wrong here

  OSPF is an underlay IGP that only builds the IP routing table between fabric devices; it cannot act as a control plane for overlay endpoint discovery or host tracking, which LISP performs in SD-Access. GRE tunnels are simple stateless encapsulations that lack VXLAN's scalability, multicast support, and ability to carry SGT information in the outer header, so they are unsuitable for fabric data plane. ACLs enforce policy based on static IP addresses or subnets, not on dynamically assigned SGTs, so this combination would not provide the identity-based, group-aware enforcement SD-Access requires. Thus, while OSPF and GRE could exist in an underlay, they are not the fabric overlay protocols.

• ✗

  Cisco ISE for policy management, BGP for control plane, MPLS for data plane, and VLANs for enforcement

  Why it's wrong here

  BGP is not used as the SD-Access control plane; LISP is required for endpoint-to-location mapping and host mobility, while BGP is more appropriate for WAN routing or EVPN in other environments. MPLS is a WAN transport technology that relies on label switching and does not provide the Ethernet encapsulation or VXLAN header extension needed to carry SGTs and segment traffic in a campus fabric. VLANs only partition broadcast domains at Layer 2 and do not enforce SGT-based security policies, so they cannot replace TrustSec enforcement. In short, this stack confuses campus fabric requirements with service-provider MPLS VPN principles and lacks the overlay and group-based policy capabilities of SD-Access.

• ✗

  Cisco ISE for policy management, LISP for data plane, VXLAN for control plane, and 802.1X for enforcement

  Why it's wrong here

  This option reverses the roles of the two overlay protocols: LISP is the control plane that resolves endpoint IDs to routing locators (RLOC) to locate hosts, whereas VXLAN is the data plane encapsulation that carries packets across the fabric between VTEPs. 802.1X performs port-based network access control during the authentication phase, but it does not apply per-packet security policies after a session is established; that enforcement is done by TrustSec using SGTs. Swapping LISP and VXLAN would leave no protocol to encapsulate data and no mechanism to track endpoint locations, making the fabric nonfunctional. Therefore the protocol functions are mismatched and would not support SD-Access operations.