350-401 Infrastructure Practice Question
A network engineer is deploying a Cisco SD-Access fabric and needs to ensure that endpoints can communicate with devices outside the fabric. The engineer configures a fabric border node. Which functionality does the border node provide in this architecture?
⚠ Common exam trap
Many candidates confuse the border node with the control plane node or edge node; the border node's primary role is external connectivity, not endpoint registration or authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It provides connectivity between the fabric and external networks, such as data centers or the internet.
In Cisco SD-Access, the fabric border node serves as the gateway between the fabric and external networks. It performs VXLAN-to-traditional network translation, allowing fabric endpoints to communicate with external destinations. It also advertises external routes into the fabric and fabric prefixes to external networks. The border node does not handle endpoint authentication, mapping database services, or control plane functions; those are handled by edge nodes and control plane nodes respectively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It provides connectivity between the fabric and external networks, such as data centers or the internet.
Why this is correct
The fabric border node is responsible for bridging the SD-Access fabric to external networks. It translates fabric VXLAN encapsulation to traditional networking protocols and vice versa, allowing endpoints inside the fabric to reach destinations outside. It also advertises fabric prefixes to external networks. This is the primary role of a border node in Cisco SD-Access.
- ✗
It authenticates endpoints and assigns them to fabric VNs based on policy.
Why it's wrong here
Endpoint authentication and assignment to virtual networks (VNs) is performed by the fabric edge node in conjunction with Cisco Identity Services Engine (ISE). The edge node handles the initial onboarding of endpoints, including 802.1X authentication and SGT assignment. The border node does not perform these functions; its focus is on external connectivity.
- ✗
It acts as the mapping database system that stores endpoint location information.
Why it's wrong here
The mapping database system is provided by the LISP map server/map resolver (MS/MR) function, which is typically hosted on the fabric control plane node. The border node does not store endpoint location information; it focuses on external connectivity. Confusing the border node with the control plane node is a common mistake, but the control plane node handles the mapping database.
- ✗
It encapsulates fabric traffic into VXLAN and forwards it to the control plane node.
Why it's wrong here
Encapsulation of fabric traffic into VXLAN is performed by the fabric edge nodes and border nodes when forwarding traffic across the fabric. However, forwarding to the control plane node is not a function; the control plane node provides mapping services, not data forwarding. The border node encapsulates traffic destined for external networks, not specifically to the control plane node. This option misrepresents the border node's role.
Go deeper
Related to this question
Learn chapter
Network Architecture Fundamentals
Key term
Cisco SD-Access
Cisco Software-Defined Access is a network architecture that uses a central controller to automate and secure user and device access across an enterprise network.
Key term
Cisco Virtual Topology System
Cisco Virtual Topology System is a software-defined networking solution that creates and manages virtual network overlays across physical and virtual infrastructure for enterprise networks.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.