350-401 Architecture Practice Question
A network architect is designing a campus fabric using Cisco SD-Access to centralize policy enforcement and simplify segmentation. The design must support endpoint groups for IoT devices and employees, with traffic policy applied consistently across wired and wireless. Which control plane component is responsible for maintaining the mapping between endpoint identifiers and their location in the fabric?
⚠ Common exam trap
It's easy for candidates to confuse the SD-Access data plane encapsulation (VXLAN) with the control plane protocol (LISP) that actually holds the endpoint-to-location mappings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LISP map-server and map-resolver
In Cisco SD-Access, the LISP control plane maintains the endpoint identifier to routing locator mappings. The map-server registers these mappings from fabric edge nodes, while the map-resolver responds to queries from ingress tunnel routers. This separation of control and data plane allows scalable endpoint mobility and consistent policy enforcement across wired and wireless fabric devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VXLAN tunnel endpoints
Why it's wrong here
VXLAN is the data plane encapsulation in SD-Access, not the control plane. It provides the overlay transport between fabric nodes, but it does not maintain the endpoint-to-location database. The question asks for the component that keeps the EID-to-RLOC mapping, which is handled by LISP, not by the VXLAN tunnel endpoints themselves.
- ✗
Cisco Identity Services Engine
Why it's wrong here
Cisco ISE provides authentication, authorization, and endpoint profiling, and it can assign Scalable Group Tags. However, it does not maintain the real-time endpoint-to-location mapping used for fabric forwarding. That function belongs to the LISP control plane, making ISE an incorrect choice for this specific control plane responsibility.
- ✓
LISP map-server and map-resolver
Why this is correct
LISP is the control plane protocol in SD-Access. The map-server registers endpoint EID-to-RLOC mappings from fabric edge nodes, and the map-resolver answers map requests from ingress tunnel routers. This enables scalable endpoint mobility and policy enforcement based on endpoint groups, exactly as required for IoT and employee segmentation across wired and wireless.
- ✗
Cisco DNA Center fabric controller
Why it's wrong here
Cisco DNA Center is the management and automation platform that defines fabric sites, virtual networks, and policies. It orchestrates configuration but does not participate in the real-time endpoint location mapping. The actual mapping is maintained by the LISP map-server and map-resolver, so the fabric controller is not the correct answer here.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.