Question 1,817 of 1,420
hardMultiple SelectObjective-mapped
350-401 Practice Question: Which four statements about VXLAN encapsulation…
Which four statements about VXLAN encapsulation in Cisco SD-Access are true? (Choose four.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VXLAN encapsulation uses a 24-bit VNI to identify the virtual network segment.
In Cisco SD-Access, VXLAN uses a 24-bit VNI to identify virtual network segments (A). The VXLAN header includes a Group Policy ID field to carry the SGT (B). The outer IP destination address is the IP address of the destination fabric node, as the packet is routed over the underlay (D). VXLAN is MAC-in-UDP encapsulation, not IP-in-IP (C is false). The VNI is mapped to a VLAN at the fabric edge to provide Layer 2 connectivity for endpoints (E is true).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VXLAN encapsulation uses a 24-bit VNI to identify the virtual network segment.
Why this is correct
Correct because the VNI (Virtual Network Identifier) is 24 bits, allowing up to 16 million segments.
- ✓
The VXLAN header in SD-Access includes a Group Policy ID field to carry the SGT.
Why this is correct
Correct because SD-Access uses VXLAN-GPO (Group Policy Option) to embed the SGT in the VXLAN header for policy enforcement.
- ✗
VXLAN encapsulation in SD-Access is an IP-in-IP tunneling mechanism.
Why it's wrong here
Incorrect because VXLAN is MAC-in-UDP encapsulation, not IP-in-IP; it encapsulates the original Ethernet frame inside a UDP packet.
- ✓
The outer IP destination address in the VXLAN packet is the IP address of the destination fabric node.
Why this is correct
Correct because the outer header uses the destination node's IP (typically loopback) to route the encapsulated packet across the underlay.
- ✓
The VNI is mapped to a VLAN at the fabric edge to provide Layer 2 connectivity for endpoints.
Why this is correct
Correct. The VNI is mapped to a VLAN at the fabric edge, which allows endpoints in that VLAN to communicate over the VXLAN overlay, providing Layer 2 connectivity across the fabric.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 18, 2026
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.