350-401 Architecture Practice Question
A network architect is evaluating Cisco SD-Access fabric deployment options for a large campus. The design team wants to understand the roles that fabric nodes play in forwarding traffic and in connecting the fabric to external networks. Which two statements accurately describe Cisco SD-Access fabric node roles? (Choose two.)
⚠ Common exam trap
The trap here is mixing up the control-plane node's LISP map-server duties with the forwarding duties of intermediate and edge nodes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fabric border nodes connect the SD-Access fabric to external networks and perform route redistribution between the fabric and external routing domains.
In Cisco SD-Access, fabric edge nodes encapsulate endpoint traffic in VXLAN and register EIDs with the control-plane node, while fabric border nodes connect the fabric to external networks and redistribute routes. Those two roles match the accurate statements, whereas intermediate and control-plane responsibilities are assigned incorrectly elsewhere.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Fabric intermediate nodes maintain the LISP map database and answer EID-to-RLOC queries from edge nodes.
Why it's wrong here
Intermediate nodes are Layer 3 underlay devices that forward VXLAN-encapsulated traffic between edge and border nodes. They do not hold the LISP map database or answer map requests; that is the role of the control-plane node. This statement misassigns the control-plane function, so it is incorrect.
- ✗
Fabric border nodes are responsible for registering wired endpoint EIDs and building VXLAN tunnels to access switches.
Why it's wrong here
Registering wired endpoints and building VXLAN tunnels to access switches is the job of fabric edge nodes, not border nodes. Border nodes focus on external connectivity and route redistribution. This statement swaps the roles, making it inaccurate for the described SD-Access fabric.
- ✗
Fabric edge nodes run the LISP map-server and map-resolver functions for the entire fabric.
Why it's wrong here
Edge nodes register endpoints with the control plane but do not host the map-server or map-resolver themselves. Those functions belong to the control-plane node. Assigning them to edge nodes would mean every edge maintains a full endpoint database, which is not how SD-Access operates, so this statement is wrong.
- ✓
Fabric border nodes connect the SD-Access fabric to external networks and perform route redistribution between the fabric and external routing domains.
Why this is correct
Fabric border nodes provide the handoff between the fabric and external networks such as data center, WAN, or legacy campus. They run routing adjacencies and redistribute or leak routes between the fabric's VXLAN domain and outside domains, which is exactly what the scenario describes.
- ✓
Fabric edge nodes encapsulate traffic from wired endpoints into VXLAN and register endpoint EIDs with the control-plane node.
Why this is correct
Fabric edge nodes connect wired endpoints, learn their identities, register EIDs with the control-plane node, and encapsulate traffic into VXLAN toward other fabric nodes. This matches the SD-Access architecture and is one of the two accurate statements in this scenario.
Go deeper
Related to this question
Learn chapter
Network Access Control and AAA
Key term
Fabric Fundamentals
Fabric Fundamentals is the set of core concepts behind a network fabric, where switches and routers form a single logical system that simplifies traffic forwarding and automation.
Key term
Cisco SD-Access
Cisco Software-Defined Access is a network architecture that uses a central controller to automate and secure user and device access across an enterprise network.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.