350-401 Architecture Practice Question
A network engineer is deploying Cisco SD-Access and needs to ensure that endpoint traffic is encapsulated and forwarded between fabric edge nodes. The design uses an overlay that carries Layer 2 and Layer 3 traffic over a Layer 3 underlay. Which protocol does Cisco SD-Access use for the data plane encapsulation in this fabric?
⚠ Common exam trap
Many candidates confuse the control plane protocol (LISP) with the data plane encapsulation (VXLAN), since both are central to SD-Access but serve different roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VXLAN with a Group Policy Option (GPO) header
Cisco SD-Access fabric data plane uses VXLAN encapsulation, enhanced with a Group Policy Option header. This header carries the source group tag, enabling scalable group-based policy enforcement. The control plane uses LISP for endpoint location mapping, but the actual packet encapsulation for endpoint traffic is VXLAN, making it the correct choice for the data plane.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
LISP with a locator/ID separation header
Why it's wrong here
LISP is used in SD-Access for the control plane to map endpoint identifiers to routing locators, but it is not the data plane encapsulation. The question specifically asks about encapsulation of endpoint traffic, which is handled by VXLAN, not LISP.
- ✓
VXLAN with a Group Policy Option (GPO) header
Why this is correct
Cisco SD-Access uses VXLAN as the data plane encapsulation, and it adds a Group Policy Option header to carry security group tag information. This allows the fabric to enforce group-based policies without requiring traditional ACLs on every device, which is a core part of the SD-Access architecture.
- ✗
OTV with an adjacency server
Why it's wrong here
OTV is a Cisco technology for extending Layer 2 across data centers over a Layer 3 infrastructure, but it is not used in SD-Access. SD-Access uses VXLAN for overlay encapsulation, and OTV does not provide the group policy or fabric integration required here.
- ✗
GRE with a fabric header
Why it's wrong here
GRE is a generic tunneling protocol, but it is not the encapsulation used in Cisco SD-Access. SD-Access specifically uses VXLAN with a Group Policy Option header to support scalable policy enforcement across the fabric, so GRE would not meet the design requirements.
Go deeper
Related to this question
Learn chapter
Network Access Control and AAA
Key term
VXLAN
VXLAN is a network overlay technology that encapsulates Layer 2 Ethernet frames in UDP packets to extend VLANs across Layer 3 networks.
Key term
Cisco Virtual Topology System
Cisco Virtual Topology System is a software-defined networking solution that creates and manages virtual network overlays across physical and virtual infrastructure for enterprise networks.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.