350-401 Architecture Practice Question
A network architect is designing a fabric that must support Layer 2 and Layer 3 connectivity for endpoints across multiple sites without stretching VLANs between them. The design requires a control plane that separates the endpoint identifier from the routing locator, allowing traffic to be tunneled over a routed underlay. Which Cisco architecture component provides this separation in an SD-Access fabric?
⚠ Common exam trap
The trap here is assuming that any overlay technology that tunnels Layer 2 traffic, such as OTV or EVPN, satisfies the SD-Access fabric requirement, when the specific identifier/locator separation is provided by LISP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LISP control plane with VXLAN data plane
The Cisco SD-Access fabric uses LISP as its control plane to separate endpoint identity from routing location, and VXLAN as the data plane to tunnel overlay traffic across a routed underlay. This combination lets endpoints remain in their Layer 2 or Layer 3 virtual networks without extending VLANs between sites, which is precisely what the architect requires.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MP-BGP EVPN with MPLS L3VPN VRFs
Why it's wrong here
MP-BGP EVPN with MPLS L3VPN provides scalable Layer 3 segmentation and VPN isolation, and it can carry MAC/IP routes. However, this is a service provider or data center VPN design, not the SD-Access fabric control plane. The scenario calls for the Cisco SD-Access fabric component, which uses LISP as its control plane, not EVPN over MPLS.
- ✗
Cisco TrustSec with SGT Exchange Protocol
Why it's wrong here
TrustSec and SXP propagate security group tags for policy enforcement; they do not perform endpoint identifier-to-routing locator mapping or tunnel traffic across a routed underlay. While TrustSec can be integrated with SD-Access for group-based policy, it is not the fabric component that separates EID from RLOC, so it does not satisfy this design need.
- ✗
OTV with IS-IS adjacency over the WAN
Why it's wrong here
OTV is a Cisco Data Center Interconnect technology that does stretch Layer 2 VLANs between data centers over an IP transport. The scenario explicitly requires avoiding VLAN stretching and needs an identifier/locator split for endpoints. OTV also uses IS-IS for MAC reachability, not EID-to-RLOC mapping, so it does not meet the stated design requirement.
- ✓
LISP control plane with VXLAN data plane
Why this is correct
LISP separates endpoint identity (EID) from routing locator (RLOC), which is exactly the identifier/locator split the scenario demands. VXLAN provides the tunneling data plane over the routed underlay, and the fabric border and edge nodes register EIDs to the map server. Together they deliver Layer 2 and Layer 3 overlay connectivity without stretching VLANs across sites.
Visual reference
Go deeper
Related to this question
Learn chapter
SDN Controllers and Cisco ACI
Key term
Cisco Virtual Topology System
Cisco Virtual Topology System is a software-defined networking solution that creates and manages virtual network overlays across physical and virtual infrastructure for enterprise networks.
Key term
VXLAN
VXLAN is a network overlay technology that encapsulates Layer 2 Ethernet frames in UDP packets to extend VLANs across Layer 3 networks.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.