SD-Access Architecture practice questions

A network engineer is deploying Cisco SD-Access in a large enterprise campus. The design requires that all user traffic be segmented by Virtual Network (VN) and that the fabric edge nodes perform SGT-based enforcement. The engineer notices that traffic between two endpoints in the same IP subnet but different VNs is being forwarded directly at the fabric edge without any SGT inspection. What is the most likely cause?

Trap 1: The fabric edge nodes have not been configured with the proper SGT…

Incorrect because SGT mappings are used for SXP propagation, not for enforcement at the fabric edge. The issue is not about missing mappings.

Trap 2: The fabric edge nodes are operating in Layer 2 mode and do not…

Incorrect. Fabric edge nodes can perform SGT enforcement regardless of Layer 2 or Layer 3 mode. The mode affects how traffic is forwarded but not SGT enforcement capability.

Trap 3: The control plane node has not been configured with the correct…

Incorrect. IP-SGT mappings are used for SXP and policy enforcement, but the scenario describes traffic within the same subnet, which is intra-VN and does not trigger SGT enforcement.

A
The fabric edge nodes have not been configured with the proper SGT mappings.
Why wrong: Incorrect because SGT mappings are used for SXP propagation, not for enforcement at the fabric edge. The issue is not about missing mappings.
B
The endpoints are in the same IP subnet, so they must be in the same Virtual Network; SGT enforcement only applies to inter-VN traffic.
Correct. In SD-Access, endpoints in the same subnet belong to the same VN. SGT enforcement is only performed when traffic crosses VNs (inter-VN). Intra-VN traffic is bridged locally without SGT inspection.
C
The fabric edge nodes are operating in Layer 2 mode and do not support SGT enforcement.
Why wrong: Incorrect. Fabric edge nodes can perform SGT enforcement regardless of Layer 2 or Layer 3 mode. The mode affects how traffic is forwarded but not SGT enforcement capability.
D
The control plane node has not been configured with the correct IP-SGT mappings.
Why wrong: Incorrect. IP-SGT mappings are used for SXP and policy enforcement, but the scenario describes traffic within the same subnet, which is intra-VN and does not trigger SGT enforcement.

Open the full VLAN trunking answer →

Question 2mediummultiple choice

An enterprise is migrating from a traditional three-tier campus network to Cisco SD-Access. The network engineer has deployed a fabric with a single fabric edge node and a single control plane node. Users in VLAN 10 report that they cannot reach the default gateway, which is a virtual IP on the fabric edge. The fabric edge is configured with a VLAN 10 SVI and the anycast gateway feature is enabled. What is the most likely cause of the problem?

Trap 1: The control plane node is not reachable from the fabric edge,…

Incorrect. While the control plane node is needed for endpoint registration, the fabric edge can still forward traffic locally. The default gateway issue is more fundamental.

Trap 2: The endpoints are not configured with the correct IP address for…

Incorrect. The scenario states users cannot reach the default gateway, implying the gateway itself is not responding, not that the endpoints have wrong IPs.

Trap 3: The fabric edge node is in Layer 2 mode and cannot route traffic.

Incorrect. Even in Layer 2 mode, the fabric edge can have an SVI and provide routing. The anycast gateway feature works in both modes.

A
The fabric edge node is not configured with the VLAN 10 SVI or the anycast gateway feature is disabled.
Correct. Without the SVI and anycast gateway enabled, the fabric edge cannot provide the default gateway for VLAN 10 users.
B
The control plane node is not reachable from the fabric edge, causing the fabric edge to drop traffic.
Why wrong: Incorrect. While the control plane node is needed for endpoint registration, the fabric edge can still forward traffic locally. The default gateway issue is more fundamental.
C
The endpoints are not configured with the correct IP address for the default gateway.
Why wrong: Incorrect. The scenario states users cannot reach the default gateway, implying the gateway itself is not responding, not that the endpoints have wrong IPs.
D
The fabric edge node is in Layer 2 mode and cannot route traffic.
Why wrong: Incorrect. Even in Layer 2 mode, the fabric edge can have an SVI and provide routing. The anycast gateway feature works in both modes.

Question 3mediummultiple choice

A network architect is designing an SD-Access fabric for a large enterprise campus. The design must support segmentation at Layer 2 and Layer 3 across the fabric, using a centralized control plane and policy enforcement. Which two protocols are essential for the SD-Access overlay to meet these requirements?

Trap 1: MP-BGP and MPLS

MP-BGP and MPLS are used in MPLS VPN designs, not the SD-Access overlay.

Trap 2: OSPF and GRE

OSPF is an underlay routing protocol and GRE is a generic tunnel; not the primary overlay protocols for SD-Access.

Trap 3: IS-IS and NVGRE

IS-IS can be used in the underlay, but NVGRE is not used in Cisco SD-Access.

A
LISP and VXLAN
LISP provides the control plane and VXLAN provides the data plane encapsulation for the overlay.
B
MP-BGP and MPLS
Why wrong: MP-BGP and MPLS are used in MPLS VPN designs, not the SD-Access overlay.
C
OSPF and GRE
Why wrong: OSPF is an underlay routing protocol and GRE is a generic tunnel; not the primary overlay protocols for SD-Access.
D
IS-IS and NVGRE
Why wrong: IS-IS can be used in the underlay, but NVGRE is not used in Cisco SD-Access.

Question 4mediummultiple choice

An architect is planning a Cisco SD-Access fabric deployment. The design must support host mobility across multiple fabric edge nodes while ensuring consistent policy enforcement. Which fabric component is responsible for tracking endpoint locations and mapping them to the fabric?

Trap 1: Fabric border node

The border node connects the fabric to external networks but does not track internal endpoint mappings.

Trap 2: Fabric edge node

The edge node connects endpoints to the fabric but relies on the control plane for mapping.

Trap 3: Fabric wireless controller

The wireless controller manages wireless access but is not the primary component for endpoint mapping.

A
Fabric control plane node
The control plane node uses LISP to track and map endpoints to their location in the fabric.
B
Fabric border node
Why wrong: The border node connects the fabric to external networks but does not track internal endpoint mappings.
C
Fabric edge node
Why wrong: The edge node connects endpoints to the fabric but relies on the control plane for mapping.
D
Fabric wireless controller
Why wrong: The wireless controller manages wireless access but is not the primary component for endpoint mapping.

Question 5mediummultiple choice

A company is deploying an SD-Access fabric with multiple sites connected via a WAN. The design must allow inter-site traffic to be forwarded without requiring a full mesh of VXLAN tunnels between all edge nodes. Which fabric role should be used to interconnect the sites?

Trap 1: Fabric control plane node

Control plane nodes manage endpoint mappings but do not forward inter-site traffic.

Trap 2: Fabric edge node

Edge nodes connect endpoints but are not designed for inter-site routing.

Trap 3: Fabric WAN controller

There is no dedicated fabric WAN controller in SD-Access; border nodes handle WAN connectivity.

A
Fabric border node
Border nodes act as the gateway between the fabric and external networks, enabling inter-site connectivity.
B
Fabric control plane node
Why wrong: Control plane nodes manage endpoint mappings but do not forward inter-site traffic.
C
Fabric edge node
Why wrong: Edge nodes connect endpoints but are not designed for inter-site routing.
D
Fabric WAN controller
Why wrong: There is no dedicated fabric WAN controller in SD-Access; border nodes handle WAN connectivity.

Question 6mediummultiple choice

An architect is designing an SD-Access fabric for a campus network that requires segmentation of guest, employee, and IoT traffic. The design must use Cisco TrustSec for policy enforcement. Which component is responsible for assigning the Security Group Tag (SGT) to endpoints upon authentication?

Trap 1: Fabric edge node

Edge nodes enforce policies but do not assign SGTs; they rely on ISE for the tag assignment.

Trap 2: Fabric control plane node

Control plane nodes handle LISP mappings, not SGT assignment.

Trap 3: Cisco DNA Center

DNA Center provides management and automation but does not directly assign SGTs.

A
Cisco ISE
ISE authenticates endpoints and assigns SGTs, which are then used for policy enforcement in the fabric.
B
Fabric edge node
Why wrong: Edge nodes enforce policies but do not assign SGTs; they rely on ISE for the tag assignment.
C
Fabric control plane node
Why wrong: Control plane nodes handle LISP mappings, not SGT assignment.
D
Cisco DNA Center
Why wrong: DNA Center provides management and automation but does not directly assign SGTs.

Question 7easymultiple choice

A network team is designing the underlay for an SD-Access fabric. The design must use a routing protocol that supports fast convergence and is commonly recommended for the fabric underlay. Which routing protocol should be used?

Trap 1: RIP

RIP is outdated and not suitable for modern fabric underlays.

Trap 2: EIGRP

EIGRP is a Cisco proprietary protocol but not recommended for SD-Access underlay.

Trap 3: BGP

BGP is used for overlay control plane (LISP) but not typically for the underlay.

A
IS-IS
IS-IS is the preferred underlay routing protocol for SD-Access fabric.
B
RIP
Why wrong: RIP is outdated and not suitable for modern fabric underlays.
C
EIGRP
Why wrong: EIGRP is a Cisco proprietary protocol but not recommended for SD-Access underlay.
D
BGP
Why wrong: BGP is used for overlay control plane (LISP) but not typically for the underlay.

Read the full wireless explanation →

Question 8mediummultiple choice

An architect is designing an SD-Access fabric for a campus with multiple buildings. The design must support wireless clients seamlessly roaming across fabric edge nodes. Which technology is used in the fabric to provide mobility for wireless endpoints?

Trap 1: VXLAN

VXLAN is the data plane encapsulation but does not handle mobility control.

Trap 2: OTV

OTV is used for Layer 2 extension between data centers, not for fabric mobility.

Trap 3: MPLS

MPLS is not used for endpoint mobility in SD-Access.

A
LISP
LISP handles endpoint mobility by updating the EID-to-RLOC mapping when a client roams.
B
VXLAN
Why wrong: VXLAN is the data plane encapsulation but does not handle mobility control.
C
OTV
Why wrong: OTV is used for Layer 2 extension between data centers, not for fabric mobility.
D
MPLS
Why wrong: MPLS is not used for endpoint mobility in SD-Access.

Question 9hardmultiple choice

A company is deploying an SD-Access fabric with a centralized policy model. The design must ensure that all traffic between virtual networks (VNs) is inspected by a firewall. Which fabric role should be used to enforce this inter-VN policy?

Trap 1: Fabric edge node

Edge nodes enforce intra-VN policies but are not designed for inter-VN inspection.

Trap 2: Fabric control plane node

Control plane nodes do not forward traffic and cannot enforce inspection policies.

Trap 3: Fabric WAN router

WAN routers connect to external networks but are not specialized for inter-VN policy enforcement.

A
Fabric border node
Border nodes can apply policy-based routing to steer inter-VN traffic to a firewall.
B
Fabric edge node
Why wrong: Edge nodes enforce intra-VN policies but are not designed for inter-VN inspection.
C
Fabric control plane node
Why wrong: Control plane nodes do not forward traffic and cannot enforce inspection policies.
D
Fabric WAN router
Why wrong: WAN routers connect to external networks but are not specialized for inter-VN policy enforcement.

Question 10mediummultiple choice

An architect is designing an SD-Access fabric for a campus that requires high availability. The design must ensure that if one fabric edge node fails, endpoints can be re-homed to another edge node without manual intervention. Which feature should be implemented?

Trap 1: HSRP

HSRP is a first-hop redundancy protocol but is not used in SD-Access fabric; anycast gateway is preferred.

Trap 2: VRRP

VRRP is similar to HSRP and not used in SD-Access fabric.

Trap 3: GLBP

GLBP is another FHRP not used in SD-Access; anycast gateway is the standard.

A
Anycast Layer 2 gateway
Anycast L2 gateway provides high availability by allowing multiple edge nodes to serve the same gateway.
B
HSRP
Why wrong: HSRP is a first-hop redundancy protocol but is not used in SD-Access fabric; anycast gateway is preferred.
C
VRRP
Why wrong: VRRP is similar to HSRP and not used in SD-Access fabric.
D
GLBP
Why wrong: GLBP is another FHRP not used in SD-Access; anycast gateway is the standard.

Question 11easymultiple choice

A network team is designing an SD-Access fabric for a large enterprise. The design must support automated provisioning and policy management. Which management platform is essential for deploying and managing the fabric?

Trap 1: Cisco ISE

ISE provides authentication and policy enforcement but is not the management platform for the fabric.

Trap 2: Cisco Prime Infrastructure

Prime Infrastructure is a legacy management tool and does not support SD-Access fabric automation.

Trap 3: Cisco vManage

vManage is used for SD-WAN management, not SD-Access.

A
Cisco DNA Center
DNA Center is the management platform for SD-Access, enabling automated fabric deployment and policy control.
B
Cisco ISE
Why wrong: ISE provides authentication and policy enforcement but is not the management platform for the fabric.
C
Cisco Prime Infrastructure
Why wrong: Prime Infrastructure is a legacy management tool and does not support SD-Access fabric automation.
D
Cisco vManage
Why wrong: vManage is used for SD-WAN management, not SD-Access.

Open the full VLAN trunking answer →

Question 12mediummultiple choice

Examine the following configuration snippet:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 100
 spanning-tree portfast
 spanning-tree bpduguard enable

What is the effect of this configuration?

Trap 1: The port will remain in blocking state until a BPDU is received…

PortFast overrides the normal STP state machine; the port goes directly to forwarding.

Trap 2: The port will only forward BPDUs and will not forward data traffic.

PortFast allows data traffic; BPDU Guard disables the port on BPDU reception, not just forward them.

Trap 3: The port will participate in RSTP and will not be affected by BPDU…

BPDU Guard is active and will error-disable the port upon BPDU reception, regardless of STP variant.

A
The port will immediately transition to forwarding state and will be error-disabled if a BPDU is received.
PortFast skips listening/learning; BPDU Guard error-disables the port on BPDU reception.
B
The port will remain in blocking state until a BPDU is received from the root bridge.
Why wrong: PortFast overrides the normal STP state machine; the port goes directly to forwarding.
C
The port will only forward BPDUs and will not forward data traffic.
Why wrong: PortFast allows data traffic; BPDU Guard disables the port on BPDU reception, not just forward them.
D
The port will participate in RSTP and will not be affected by BPDU reception.
Why wrong: BPDU Guard is active and will error-disable the port upon BPDU reception, regardless of STP variant.

Study the full EIGRP explanation →

Question 13mediummultiple choice

Consider the following configuration:

router eigrp 100
 network 10.0.0.0 0.255.255.255
 passive-interface default
 no passive-interface GigabitEthernet0/0

Which statement is true about this EIGRP configuration?

Trap 1: EIGRP will send updates on all interfaces except GigabitEthernet0/0.

The passive-interface default makes all interfaces passive; the 'no passive-interface' overrides that for Gi0/0, so only Gi0/0 sends updates.

Trap 2: EIGRP will not send any updates because the network statement is…

The network statement is valid (wildcard mask 0.255.255.255 matches 10.0.0.0/8).

Trap 3: EIGRP will form adjacencies on all interfaces that have an IP…

The passive-interface default prevents adjacencies on all interfaces except those with 'no passive-interface'.

A
EIGRP will send and receive updates only on GigabitEthernet0/0.
All interfaces are passive by default, but Gi0/0 is explicitly enabled for EIGRP updates.
B
EIGRP will send updates on all interfaces except GigabitEthernet0/0.
Why wrong: The passive-interface default makes all interfaces passive; the 'no passive-interface' overrides that for Gi0/0, so only Gi0/0 sends updates.
C
EIGRP will not send any updates because the network statement is incorrect.
Why wrong: The network statement is valid (wildcard mask 0.255.255.255 matches 10.0.0.0/8).
D
EIGRP will form adjacencies on all interfaces that have an IP address in the 10.0.0.0/8 range.
Why wrong: The passive-interface default prevents adjacencies on all interfaces except those with 'no passive-interface'.

Review the full OSPF breakdown →

Question 14mediummultiple choice

Given this OSPF configuration:

router ospf 1

router-id 1.1.1.1

network 192.168.1.0 0.0.0.255 area 0
 network 10.0.0.0 0.255.255.255 area 1

default-information originate always

What is the effect of the 'default-information originate always' command?

Trap 1: OSPF will only advertise a default route if a default route is…

Without 'always', OSPF would require a default route in the RIB; with 'always', it is unconditional.

Trap 2: OSPF will redistribute all connected routes as type 5 LSAs.

The command specifically injects a default route, not all connected routes.

Trap 3: OSPF will generate a default route only for area 0.

The default route is injected into OSPF and advertised to all areas, not just area 0.

A
OSPF will advertise a default route into all OSPF areas even if no default route is present in the routing table.
The 'always' keyword forces injection of a default route into OSPF regardless of existence in the RIB.
B
OSPF will only advertise a default route if a default route is already in the routing table.
Why wrong: Without 'always', OSPF would require a default route in the RIB; with 'always', it is unconditional.
C
OSPF will redistribute all connected routes as type 5 LSAs.
Why wrong: The command specifically injects a default route, not all connected routes.
D
OSPF will generate a default route only for area 0.
Why wrong: The default route is injected into OSPF and advertised to all areas, not just area 0.

Open the full BGP breakdown →

Question 15mediummultiple choice

Examine the following BGP configuration:

router bgp 65001

bgp log-neighbor-changes

neighbor 10.1.1.1 remote-as 65002
 neighbor 10.1.1.1 route-map SET_MED out

! route-map SET_MED permit 10 set metric 50

What is the purpose of this configuration?

Trap 1: It sets the local preference to 50 for routes received from the…

Local preference is set with 'set local-preference', not 'set metric'. Also, the route-map is applied outbound.

Trap 2: It filters routes with a metric of 50 from being advertised to the…

The route-map permits all routes and sets the metric; it does not filter based on metric.

Trap 3: It sets the weight to 50 for routes learned from the neighbor.

Weight is set with 'set weight', and the route-map is applied outbound, not inbound.

A
It sets the MED value to 50 for all routes sent to the neighbor 10.1.1.1.
The route-map is applied outbound, and the set metric command sets the MED attribute.
B
It sets the local preference to 50 for routes received from the neighbor.
Why wrong: Local preference is set with 'set local-preference', not 'set metric'. Also, the route-map is applied outbound.
C
It filters routes with a metric of 50 from being advertised to the neighbor.
Why wrong: The route-map permits all routes and sets the metric; it does not filter based on metric.
D
It sets the weight to 50 for routes learned from the neighbor.
Why wrong: Weight is set with 'set weight', and the route-map is applied outbound, not inbound.

Open the full VLAN trunking answer →

Question 16mediummultiple choice

Consider this VLAN configuration on a Cisco switch:

vlan 10

name Sales

vlan 20

name Engineering

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20

What is missing if the switch needs to carry VLAN 30 traffic on this trunk?

Trap 1: The trunk must be configured as an access port for VLAN 30.

An access port can only carry a single VLAN; a trunk is required for multiple VLANs.

Trap 2: The native VLAN must be changed to VLAN 30.

The native VLAN is used for untagged traffic; it does not need to be changed to carry VLAN 30.

Trap 3: The switchport mode must be changed to dynamic desirable.

Dynamic trunking protocols (DTP) are not required; the trunk mode is already set correctly.

A
VLAN 30 must be created and added to the allowed VLAN list on the trunk.
Without VLAN 30 created and allowed on the trunk, traffic for VLAN 30 will not be forwarded.
B
The trunk must be configured as an access port for VLAN 30.
Why wrong: An access port can only carry a single VLAN; a trunk is required for multiple VLANs.
C
The native VLAN must be changed to VLAN 30.
Why wrong: The native VLAN is used for untagged traffic; it does not need to be changed to carry VLAN 30.
D
The switchport mode must be changed to dynamic desirable.
Why wrong: Dynamic trunking protocols (DTP) are not required; the trunk mode is already set correctly.

Study the full QoS explanation →

Question 17mediummultiple choice

Given the following policy-map:

policy-map QOS_POLICY

class VOICE

priority percent 30

class VIDEO

bandwidth percent 20 queue-limit 100 packets

class class-default

fair-queue

What is the effect of the 'priority percent 30' command in the VOICE class?

Trap 1: Voice traffic is limited to 30% of the interface bandwidth and will…

While it limits bandwidth, the priority queue is not a policer; it shapes but does not drop within the limit.

Trap 2: Voice traffic is given a weight of 30 in the weighted fair queueing…

Priority is not weighted fair queueing; it uses a strict priority queue.

Trap 3: Voice traffic is re-marked with IP precedence 30.

The priority command does not mark packets; it only provides QoS treatment.

A
Voice traffic is placed in a strict priority queue with a guaranteed bandwidth of 30% of the interface bandwidth.
The priority command provides a low-latency queue with a bandwidth guarantee.
B
Voice traffic is limited to 30% of the interface bandwidth and will be dropped if exceeded.
Why wrong: While it limits bandwidth, the priority queue is not a policer; it shapes but does not drop within the limit.
C
Voice traffic is given a weight of 30 in the weighted fair queueing algorithm.
Why wrong: Priority is not weighted fair queueing; it uses a strict priority queue.
D
Voice traffic is re-marked with IP precedence 30.
Why wrong: The priority command does not mark packets; it only provides QoS treatment.

Review the full OSPF breakdown →

Question 18easymultiple choice

What is the default OSPF hello interval on an Ethernet link?

Trap 1: 30 seconds

30 seconds is the default hello interval for OSPF on NBMA networks.

Trap 2: 40 seconds

40 seconds is not a standard OSPF hello interval.

Trap 3: 5 seconds

5 seconds is not the default; it can be configured but is not default.

A
10 seconds
The default hello interval for OSPF on Ethernet (broadcast) is 10 seconds.
B
30 seconds
Why wrong: 30 seconds is the default hello interval for OSPF on NBMA networks.
C
40 seconds
Why wrong: 40 seconds is not a standard OSPF hello interval.
D
5 seconds
Why wrong: 5 seconds is not the default; it can be configured but is not default.

Open the full BGP breakdown →

Question 19easymultiple choice

Which BGP attribute is preferred when it has the lowest value?

Trap 1: Local Preference

Local Preference is higher-is-better.

Trap 2: Weight

Weight is Cisco-proprietary and higher-is-better.

Trap 3: AS Path

AS Path is shorter-is-better, not lower value.

A
MED (Multi-Exit Discriminator)
The MED attribute is used to indicate the preferred path into an AS; lower MED is better.
B
Local Preference
Why wrong: Local Preference is higher-is-better.
C
Weight
Why wrong: Weight is Cisco-proprietary and higher-is-better.
D
AS Path
Why wrong: AS Path is shorter-is-better, not lower value.

Study the full EIGRP explanation →

Question 20easymultiple choice

What is the maximum hop count for EIGRP?

Trap 1: 100

100 is the default hop count, but the maximum is 255.

Trap 2: 15

15 is the maximum hop count for RIP, not EIGRP.

Trap 3: 16

16 is used by RIP as infinity (unreachable), not EIGRP.

A
255
EIGRP supports up to 255 hops, configurable with the 'metric maximum-hops' command.
B
100
Why wrong: 100 is the default hop count, but the maximum is 255.
C
15
Why wrong: 15 is the maximum hop count for RIP, not EIGRP.
D
16
Why wrong: 16 is used by RIP as infinity (unreachable), not EIGRP.