350-401 Architecture Practice Question
A network architect is designing a Cisco SD-Access fabric. The customer requires that the fabric support both IPv4 and IPv6 traffic natively without the use of any translation mechanisms. Which statement describes the correct configuration approach?
⚠ Common exam trap
The trap here is assuming that native IPv6 support requires an IPv6-only underlay or translation, when in fact the overlay can be dual-stack over an IPv4 underlay.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The fabric overlay can be configured as dual-stack, supporting both IPv4 and IPv6, while the underlay remains IPv4.
Cisco SD-Access supports a dual-stack overlay, allowing both IPv4 and IPv6 to be carried natively over an IPv4 underlay. The VXLAN data plane encapsulates Layer 2 frames, which can carry either IPv4 or IPv6 packets. The underlay can remain IPv4, as it only needs to route the VXLAN tunnel endpoints. This design meets the requirement for native IPv6 without translation. No translation mechanisms like NAT64 are needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The fabric underlay must be configured with IPv6 only, and the overlay can be dual-stack.
Why it's wrong here
The SD-Access underlay uses an IGP such as IS-IS or OSPF, which can be IPv4 or IPv6, but the underlay itself does not need to be IPv6-only to support dual-stack overlay. In fact, the underlay is typically IPv4, while the overlay (VXLAN) can carry both IPv4 and IPv6. Requiring an IPv6-only underlay is unnecessary and not a standard design recommendation for dual-stack support.
- ✗
IPv6 is not supported in SD-Access; only IPv4 is supported in the overlay.
Why it's wrong here
This statement is incorrect. Cisco SD-Access supports IPv6 in the overlay, including dual-stack configurations. The fabric can carry IPv6 traffic natively, and there are specific configurations for IPv6 multicast and anycast gateway. Claiming that IPv6 is not supported is a false limitation. The architecture has evolved to support IPv6, so this option is definitively wrong.
- ✗
IPv6 traffic must be translated to IPv4 at the fabric edge using NAT64.
Why it's wrong here
NAT64 is a translation mechanism and is not required for native IPv6 support in SD-Access. The fabric can encapsulate IPv6 packets directly in VXLAN, so no translation is needed. Using NAT64 would add complexity and is not the correct approach when the requirement is native dual-stack support. Therefore, this option is incorrect.
- ✓
The fabric overlay can be configured as dual-stack, supporting both IPv4 and IPv6, while the underlay remains IPv4.
Why this is correct
Cisco SD-Access supports a dual-stack overlay, meaning that both IPv4 and IPv6 packets can be encapsulated in VXLAN and transported over an IPv4 underlay. This allows native IPv6 communication without translation. The underlay can remain IPv4, as the fabric data plane uses VXLAN with an IPv4 transport. This is the recommended approach for supporting both protocols natively.
Go deeper
Related to this question
Learn chapter
EIGRP: Basics and Advanced Configuration
Key term
Cisco SD-Access
Cisco Software-Defined Access is a network architecture that uses a central controller to automate and secure user and device access across an enterprise network.
Key term
Fabric Fundamentals
Fabric Fundamentals is the set of core concepts behind a network fabric, where switches and routers form a single logical system that simplifies traffic forwarding and automation.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.