350-401 Architecture Practice Question
A network architect is designing a Cisco SD-Access fabric for a large enterprise. The fabric will use VXLAN encapsulation and a Layer 3 underlay. The architect must ensure that the fabric supports the separation of policy from topology and allows endpoints to be assigned to virtual networks. Which Cisco SD-Access component is responsible for maintaining the mapping between endpoint IP addresses and their fabric locators, and for providing the control plane that enables fabric edge nodes to resolve endpoint locations?
⚠ Common exam trap
Many exam-takers confuse the control plane node with the fabric border node, because both are central fabric components, but only the control plane node maintains the endpoint mapping database and provides LISP-based resolution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Control plane node
In Cisco SD-Access, the control plane node hosts the LISP map-server and map-resolver functions, maintaining the endpoint-to-locator mapping database. Fabric edge nodes query this node to resolve endpoint locations. This design separates policy from topology and supports virtual network assignment. The other components either connect endpoints, handle external traffic, or forward underlay packets, but none maintain the mapping database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Fabric border node
Why it's wrong here
Fabric border nodes handle traffic entering and leaving the fabric, including connectivity to external networks and shared services. They do not maintain the endpoint-to-locator mapping database or provide the control plane for endpoint resolution. Their function is to translate VXLAN to external protocols, not to act as the mapping authority.
- ✗
Fabric intermediate node
Why it's wrong here
Fabric intermediate nodes are part of the underlay and simply forward VXLAN-encapsulated packets based on the outer IP header. They do not participate in the control plane for endpoint mapping or maintain any endpoint database. Their role is purely transport, so they do not fulfill the described requirement.
- ✗
Fabric edge node
Why it's wrong here
Fabric edge nodes are responsible for connecting endpoints to the fabric and encapsulating traffic into VXLAN. They query the control plane node for endpoint location information but do not maintain the authoritative mapping database themselves. The scenario asks for the component that maintains the mapping and provides the control plane, which is not the edge node's primary role.
- ✓
Control plane node
Why this is correct
The control plane node in Cisco SD-Access maintains the mapping database of endpoint IP addresses to fabric locators (such as VTEP addresses) and provides the control plane that fabric edge nodes use to resolve endpoint locations. It uses LISP to register and query endpoint information, enabling separation of policy from topology. This directly matches the requirement described.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Access Control and AAA
Key term
Cisco SD-Access
Cisco Software-Defined Access is a network architecture that uses a central controller to automate and secure user and device access across an enterprise network.
Key term
Fabric Fundamentals
Fabric Fundamentals is the set of core concepts behind a network fabric, where switches and routers form a single logical system that simplifies traffic forwarding and automation.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.