mediumMultiple SelectObjective-mapped
350-401 Practice Question: Which two statements about the Cisco SD-Access…
Which two statements about the Cisco SD-Access fabric roles are true? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The fabric edge node is responsible for connecting end devices and enforcing SGT-based policies.
In SD-Access, the fabric edge node is the switch that connects to end devices and enforces policy, while the fabric border node connects the fabric to external networks (e.g., WAN, data center). The control plane node hosts the LISP map server/map resolver, not the edge. The intermediate node is a simple transit switch that does not perform encapsulation or policy enforcement. The wireless controller in SD-Access is integrated as a fabric WLC, not a separate fabric role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The fabric edge node is responsible for connecting end devices and enforcing SGT-based policies.
Why this is correct
Correct because the fabric edge is the access-layer switch that applies security group tags (SGTs) and forwards traffic within the fabric.
- ✓
The fabric border node is responsible for connecting the SD-Access fabric to external Layer 3 networks.
Why this is correct
Correct because the border node provides connectivity outside the fabric, performing NAT, VRF translation, and route exchange.
- ✗
The control plane node is responsible for encapsulating and forwarding user traffic across the fabric.
Why it's wrong here
Incorrect because encapsulation/forwarding is done by edge and border nodes; the control plane node only maintains endpoint database (LISP) and authentication.
- ✗
The intermediate node is responsible for policy enforcement and traffic segmentation within the fabric.
Why it's wrong here
Incorrect because intermediate nodes are simple transit switches that forward encapsulated traffic without any policy enforcement.
- ✗
The wireless controller in SD-Access acts as a dedicated fabric border node for wireless traffic.
Why it's wrong here
Incorrect because the fabric WLC integrates with the fabric as a wireless controller, not as a border node; border functionality remains on a switch or router.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.