350-401 Architecture Practice Question
A network architect is designing a Cisco SD-Access fabric for a large campus. The architect needs to ensure that the fabric can scale to support thousands of endpoints and that the control plane uses a dedicated protocol for endpoint registration and location. Which component of the SD-Access architecture provides this control plane function?
⚠ Common exam trap
Many exam-takers confuse the management platform (DNA Center) with the control plane protocol (LISP), or assuming that VXLAN handles endpoint registration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LISP map server and map resolver
The SD-Access fabric uses LISP as its control plane protocol. The map server and map resolver maintain the endpoint ID-to-routing locator mappings, allowing fabric edge nodes to register endpoints and query for their locations. This design eliminates the need for flooding and supports large-scale deployments. DNA Center, VXLAN VTEPs, and ISE serve different roles: management, data forwarding, and policy/identity, respectively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cisco Identity Services Engine
Why it's wrong here
Cisco Identity Services Engine (ISE) provides authentication, authorization, and accounting (AAA) services, including 802.1X and TrustSec policy enforcement. While ISE integrates with SD-Access for policy, it does not provide the control plane for endpoint location and registration. That function is performed by LISP map servers and resolvers within the fabric.
- ✗
Cisco DNA Center
Why it's wrong here
Cisco DNA Center is the management and automation platform for SD-Access, providing policy definition, fabric provisioning, and assurance. It does not act as the control plane for endpoint registration; that role is handled by the fabric's control plane nodes using LISP. DNA Center orchestrates the fabric but does not participate in the data or control plane forwarding decisions.
- ✗
VXLAN tunnel endpoints
Why it's wrong here
VXLAN tunnel endpoints (VTEPs) are responsible for encapsulating and de-encapsulating data plane traffic in the SD-Access fabric. They forward user data between fabric edge nodes, but they do not maintain the endpoint-to-location database. The control plane function of registering endpoints and resolving their locations is separate and is handled by LISP components.
- ✓
LISP map server and map resolver
Why this is correct
In Cisco SD-Access, the control plane is based on LISP (Locator/ID Separation Protocol). The map server and map resolver (often co-located on control plane nodes) maintain the mapping of endpoint identifiers (EIDs) to routing locators (RLOCs). This enables scalable endpoint registration and location without flooding, which is essential for large fabrics supporting thousands of endpoints.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Architecture Fundamentals
Key term
Cisco SD-Access
Cisco Software-Defined Access is a network architecture that uses a central controller to automate and secure user and device access across an enterprise network.
Key term
Cisco Virtual Topology System
Cisco Virtual Topology System is a software-defined networking solution that creates and manages virtual network overlays across physical and virtual infrastructure for enterprise networks.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.