350-401 Infrastructure Practice Question
A network engineer is deploying Cisco SD-Access and wants to ensure that traffic from employee endpoints is tunneled to a fabric border node for external connectivity. Which component is responsible for encapsulating endpoint traffic into VXLAN and forwarding it to the border?
⚠ Common exam trap
The trap here is assuming that the border node encapsulates traffic, when in fact it decapsulates traffic leaving the fabric and edge nodes perform encapsulation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fabric edge node
Fabric edge nodes are the VTEPs that encapsulate endpoint traffic into VXLAN and forward it toward the border for external connectivity. They handle the mapping and tunneling of endpoint traffic, ensuring that employee endpoints can reach external networks through the fabric border. Control plane nodes manage mapping, border nodes decapsulate, and intermediate nodes only forward encapsulated packets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Fabric edge node
Why this is correct
Fabric edge nodes are responsible for encapsulating endpoint traffic into VXLAN and forwarding it to the border. They act as VTEPs, mapping endpoint IP addresses to fabric locators and tunneling traffic across the underlay. This design provides policy enforcement and segmentation, ensuring that employee traffic destined for external networks is properly encapsulated and sent to the border for routing.
- ✗
Fabric border node
Why it's wrong here
The border node connects the SD-Access fabric to external networks and performs VXLAN decapsulation for traffic leaving the fabric. It does not encapsulate endpoint traffic for transit within the fabric; that function belongs to the edge node. The border node receives encapsulated traffic from edge nodes, decapsulates it, and routes it externally, but it does not originate the encapsulation for endpoint traffic.
- ✗
Fabric intermediate node
Why it's wrong here
Intermediate nodes are part of the underlay network and simply forward VXLAN-encapsulated packets based on outer IP headers. They do not perform encapsulation or decapsulation of endpoint traffic. Their role is to provide high-speed transport between fabric edge and border nodes, ensuring reachability, but they do not participate in the VXLAN tunneling process itself.
- ✗
Fabric control plane node
Why it's wrong here
The control plane node in SD-Access runs LISP and maintains the mapping database of endpoint identifiers to fabric locators. It does not encapsulate or forward endpoint data traffic; that is the role of the edge nodes. While the control plane node provides critical mapping information, it does not directly handle the VXLAN encapsulation of user traffic to the border.
Go deeper
Related to this question
Learn chapter
Network Access Control and AAA
Key term
Cisco Virtual Topology System
Cisco Virtual Topology System is a software-defined networking solution that creates and manages virtual network overlays across physical and virtual infrastructure for enterprise networks.
Key term
Cisco SD-Access
Cisco Software-Defined Access is a network architecture that uses a central controller to automate and secure user and device access across an enterprise network.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.