350-401 Architecture Practice Question
A network architect is designing a new branch office that must support wired and wireless users on the same Layer 2 segment while enforcing consistent security policy regardless of where a user connects. The design must minimize the number of VLANs and IP subnets that must be provisioned as users move between floors. Which Cisco architecture feature should be used to meet these requirements?
⚠ Common exam trap
The trap here is assuming that a high-availability feature such as StackWise Virtual also solves address and policy mobility across floors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco SD-Access fabric with VXLAN overlay and policy-based segmentation
The requirement is location-independent identity with consistent policy and minimal VLAN/subnet provisioning across wired and wireless. SD-Access uses a VXLAN overlay with a LISP control plane and Cisco TrustSec group tags, allowing users to retain the same subnet and policy anywhere in the fabric. StackWise Virtual, standalone TrustSec, and VLAN trunking to a WLC all remain tied to physical VLAN boundaries and cannot deliver the same outcome.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cisco StackWise Virtual on the distribution switches
Why it's wrong here
StackWise Virtual combines two physical switches into one logical switch for control-plane and management simplification, but it does not decouple user identity from location or reduce VLAN and subnet provisioning across floors. Users still need VLANs and subnets tied to their access ports, so this does not satisfy the stated design requirement.
- ✗
Cisco Software-Defined Access with traditional VLAN trunking to the WLC
Why it's wrong here
Trunking VLANs to a wireless controller keeps the wireless traffic tied to physical VLAN and subnet boundaries, which is exactly the sprawl the design is trying to avoid. Although SD-Access is mentioned, pairing it with legacy VLAN trunking defeats the overlay model and does not provide location-independent identity or consistent policy across wired and wireless.
- ✓
Cisco SD-Access fabric with VXLAN overlay and policy-based segmentation
Why this is correct
SD-Access decouples identity from location by using a VXLAN overlay, so a user keeps the same IP subnet and security group tag whether wired or wireless. This eliminates per-floor VLAN/subnet sprawl and enforces consistent group-based policy through the fabric, which directly matches the stated requirement for unified wired/wireless policy with minimal VLAN provisioning.
- ✗
Cisco TrustSec with static SGACL enforcement on access ports
Why it's wrong here
TrustSec provides group-based policy using security group tags, which addresses consistent policy, but it does not by itself eliminate VLAN and subnet sprawl or unify wired and wireless access into one logical segment. Without an overlay fabric, the branch still requires separate VLANs and subnets for each floor, so it only partially meets the requirement.
Visual reference
Go deeper
Related to this question
Learn chapter
SDN Controllers and Cisco ACI
Key term
Cisco Virtual Topology System
Cisco Virtual Topology System is a software-defined networking solution that creates and manages virtual network overlays across physical and virtual infrastructure for enterprise networks.
Key term
VLAN Trunking
VLAN Trunking is a method to carry traffic for multiple VLANs over a single network link between switches or between a switch and a router.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.