hardMultiple SelectObjective-mapped
CCNP Practice Question: Which four statements about VXLAN encapsulation…
Which four statements about VXLAN encapsulation in Cisco SD-Access are true? (Choose four.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VXLAN encapsulation uses a 24-bit VNI to identify the virtual network segment.
In Cisco SD-Access, VXLAN uses a 24-bit VNI to identify virtual network segments (A). The VXLAN header includes a Group Policy ID field to carry the SGT (B). The outer IP destination address is the IP address of the destination fabric node, as the packet is routed over the underlay (D). VXLAN is MAC-in-UDP encapsulation, not IP-in-IP (C is false). The VNI is mapped to a VLAN at the fabric edge to provide Layer 2 connectivity for endpoints (E is true).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VXLAN encapsulation uses a 24-bit VNI to identify the virtual network segment.
Why this is correct
Correct because the VNI (Virtual Network Identifier) is 24 bits, allowing up to 16 million segments.
- ✓
The VXLAN header in SD-Access includes a Group Policy ID field to carry the SGT.
Why this is correct
Correct because SD-Access uses VXLAN-GPO (Group Policy Option) to embed the SGT in the VXLAN header for policy enforcement.
- ✗
VXLAN encapsulation in SD-Access is an IP-in-IP tunneling mechanism.
Why it's wrong here
Incorrect because VXLAN is MAC-in-UDP encapsulation, not IP-in-IP; it encapsulates the original Ethernet frame inside a UDP packet.
- ✓
The outer IP destination address in the VXLAN packet is the IP address of the destination fabric node.
Why this is correct
Correct because the outer header uses the destination node's IP (typically loopback) to route the encapsulated packet across the underlay.
- ✓
The VNI is mapped to a VLAN at the fabric edge to provide Layer 2 connectivity for endpoints.
Why this is correct
Correct. The VNI is mapped to a VLAN at the fabric edge, which allows endpoints in that VLAN to communicate over the VXLAN overlay, providing Layer 2 connectivity across the fabric.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.