CCNP Practice Question: Which two statements about the Cisco SD-Access…

Which two statements about the Cisco SD-Access fabric roles are true? (Choose two.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The fabric edge node is responsible for connecting end devices and enforcing SGT-based policies.

In SD-Access, the fabric edge node is the switch that connects to end devices and enforces policy, while the fabric border node connects the fabric to external networks (e.g., WAN, data center). The control plane node hosts the LISP map server/map resolver, not the edge. The intermediate node is a simple transit switch that does not perform encapsulation or policy enforcement. The wireless controller in SD-Access is integrated as a fabric WLC, not a separate fabric role.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The fabric edge node is responsible for connecting end devices and enforcing SGT-based policies.
Why this is correct
Correct because the fabric edge is the access-layer switch that applies security group tags (SGTs) and forwards traffic within the fabric.
✓
The fabric border node is responsible for connecting the SD-Access fabric to external Layer 3 networks.
Why this is correct
Correct because the border node provides connectivity outside the fabric, performing NAT, VRF translation, and route exchange.
✗
The control plane node is responsible for encapsulating and forwarding user traffic across the fabric.
Why it's wrong here
Incorrect because encapsulation/forwarding is done by edge and border nodes; the control plane node only maintains endpoint database (LISP) and authentication.
✗
The intermediate node is responsible for policy enforcement and traffic segmentation within the fabric.
Why it's wrong here
Incorrect because intermediate nodes are simple transit switches that forward encapsulated traffic without any policy enforcement.
✗
The wireless controller in SD-Access acts as a dedicated fabric border node for wireless traffic.
Why it's wrong here
Incorrect because the fabric WLC integrates with the fabric as a wireless controller, not as a border node; border functionality remains on a switch or router.

Visual reference

About these practice questions

One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Ready to practise?

Start a scored session and see where you stand.

Start practice session

Timed practice sets

Scored 10-question sessions with instant feedback and explanations.

CCNP Practice Test 3 — 25 Questions→Free CCNP Practice Test 2 — 30 Questions→CCNP Practice Test 5 — 25 Questions→

Domain-focused practice

Domains are weighted differently on the real exam — spend your time where you score lowest.

Network Assurance Architecture Virtualization Security

Filter by question format

Practise a single format at a time: PBQs, exhibits, ACLs, OSPF, drag-and-drop.

Browse scenarios

Practice by topic

Narrow in on a single topic rather than practising the whole bank at once.

Infrastructure practice questions Automation practice questions Security practice questions ENCOR VLANs and trunking practice questions

Continue studying

Study guide All 350-401 questions 350-401 practice test

This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.