Question 1,022 of 2,015

SD-Access Architecture →hardMultiple SelectObjective-mapped

Quick Answer

The correct answer identifies that SGT information is carried in the VXLAN header using the Group Policy Option (GPO). This is true because Cisco SD-Access policy enforcement relies on Scalable Group Tags (SGTs) for micro-segmentation, with policies defined in Cisco ISE and enforced at the fabric edge node. The fabric edge applies SGT-based ACLs to traffic, while the control plane (LISP) distributes SGT mappings but does not enforce policies—that role belongs solely to the edge. On the ENCOR 350-401 exam, this concept tests your understanding of where policy enforcement actually occurs, with a common trap being to assume the border node or underlay handles SGT enforcement. Remember: the underlay is completely SGT-unaware, and the border only manages external connectivity. A useful memory tip is “Edge enforces, border exits”—the fabric edge is where SGT-based policy decisions happen, and the SGT tag rides inside the VXLAN Group Policy Option header.

350-401 SD-Access Architecture Practice Question

This 350-401 practice question tests your understanding of sd-access architecture. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Which three statements about Cisco SD-Access policy enforcement are true? (Choose three.)

Question 1hardmulti select

Study the full SD-Access breakdown →

A
Policy enforcement in SD-Access is based on Scalable Group Tags (SGTs) assigned to endpoints.
Correct because SGTs are the foundation for group-based policy, allowing dynamic segmentation.
B
Cisco ISE is used to define and manage SGT-to-policy mappings in the SD-Access fabric.
Correct because ISE acts as the policy server, authenticating endpoints and assigning SGTs based on user/device identity.
C
The fabric border node enforces all intra-fabric policies between different virtual networks.
Why wrong: Incorrect because intra-fabric policy enforcement is done at the edge nodes; the border node only handles traffic leaving or entering the fabric.
D
The SGT information is carried in the VXLAN header using the Group Policy Option (GPO).
Correct because VXLAN-GPO embeds the SGT in the header, allowing the edge to enforce policies without inspecting the inner packet.
E
The underlay network devices must be aware of SGTs to forward traffic correctly.
Why wrong: Incorrect because the underlay is IP-only and does not need to understand SGTs; the overlay (VXLAN) carries the SGT transparently.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Policy enforcement in SD-Access is based on Scalable Group Tags (SGTs) assigned to endpoints.

SD-Access uses Scalable Group Tags (SGTs) for micro-segmentation, and policies are defined in Cisco ISE (Identity Services Engine). The fabric edge enforces policies by applying SGTs to traffic and using SGT-based ACLs. The control plane (LISP) distributes SGT mappings, but policy enforcement is done at the edge. The border node does not enforce policies for internal fabric traffic; it only handles external connectivity. The SGT is carried in the VXLAN header using the Group Policy Option. The underlay network is unaware of SGTs.

Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Policy enforcement in SD-Access is based on Scalable Group Tags (SGTs) assigned to endpoints.
Why this is correct
Correct because SGTs are the foundation for group-based policy, allowing dynamic segmentation.
Related concept
Standard ACLs match source addresses.
✓
Cisco ISE is used to define and manage SGT-to-policy mappings in the SD-Access fabric.
Why this is correct
Correct because ISE acts as the policy server, authenticating endpoints and assigning SGTs based on user/device identity.
Related concept
Standard ACLs match source addresses.
✗
The fabric border node enforces all intra-fabric policies between different virtual networks.
Why it's wrong here
Incorrect because intra-fabric policy enforcement is done at the edge nodes; the border node only handles traffic leaving or entering the fabric.
✓
The SGT information is carried in the VXLAN header using the Group Policy Option (GPO).
Why this is correct
Correct because VXLAN-GPO embeds the SGT in the header, allowing the edge to enforce policies without inspecting the inner packet.
Related concept
Standard ACLs match source addresses.
✗
The underlay network devices must be aware of SGTs to forward traffic correctly.
Why it's wrong here
Incorrect because the underlay is IP-only and does not need to understand SGTs; the overlay (VXLAN) carries the SGT transparently.

Common exam traps

Common exam trap: ACLs stop at the first match

ACLs are processed top to bottom. The first matching entry wins, and an implicit deny usually exists at the end.

Detailed technical explanation

How to think about this question

ACL questions test precision: source, destination, protocol, port and direction. A generally correct ACL can still fail if it is applied on the wrong interface or in the wrong direction.

KKey Concepts to Remember

Standard ACLs match source addresses.
Extended ACLs can match source, destination, protocol and ports.
The first matching ACL entry is used.
There is usually an implicit deny at the end.

TExam Day Tips

Check inbound versus outbound direction.
Read the ACL from top to bottom.
Look for a broader permit or deny above the intended line.

Key takeaway

ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.

Real-world example

How this comes up in practice

A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.

What to study next

Got this wrong? Here's your next step.

Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related 350-401 ACL questions on filtering logic and placement.

Related 350-401 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Architecture practice questions

Practise 350-401 questions linked to Architecture.

Enterprise Network Design practice questions

Practise 350-401 questions linked to Enterprise Network Design.

SD-Access Architecture practice questions

Practise 350-401 questions linked to SD-Access Architecture.

SD-WAN Architecture practice questions

Practise 350-401 questions linked to SD-WAN Architecture.

QoS Architecture practice questions

Practise 350-401 questions linked to QoS Architecture.

Virtualization practice questions

Practise 350-401 questions linked to Virtualization.

Network Function Virtualization practice questions

Practise 350-401 questions linked to Network Function Virtualization.

Virtual Machines and Hypervisors practice questions

Practise 350-401 questions linked to Virtual Machines and Hypervisors.

VRF and Path Isolation practice questions

Practise 350-401 questions linked to VRF and Path Isolation.

Infrastructure practice questions

Practise 350-401 questions linked to Infrastructure.

OSPF practice questions

Practise 350-401 questions linked to OSPF.

BGP practice questions

Practise 350-401 questions linked to BGP.

Practice this exam

Start a free 350-401 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

350-401 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this 350-401 question test?

SD-Access Architecture — This question tests SD-Access Architecture — Standard ACLs match source addresses..

What is the correct answer to this question?

The correct answer is: Policy enforcement in SD-Access is based on Scalable Group Tags (SGTs) assigned to endpoints. — SD-Access uses Scalable Group Tags (SGTs) for micro-segmentation, and policies are defined in Cisco ISE (Identity Services Engine). The fabric edge enforces policies by applying SGTs to traffic and using SGT-based ACLs. The control plane (LISP) distributes SGT mappings, but policy enforcement is done at the edge. The border node does not enforce policies for internal fabric traffic; it only handles external connectivity. The SGT is carried in the VXLAN header using the Group Policy Option. The underlay network is unaware of SGTs.

What should I do if I get this 350-401 question wrong?

What is the key concept behind this question?

Standard ACLs match source addresses.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on 350-401

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Which three statements about Cisco SD-Access policy enforcement are true? (Choose three.)

hard

✓ A.Scalable Group Tags (SGTs) are used to enforce micro-segmentation and policy in the fabric.
B.SGTs are assigned to endpoints based on their IP address only.
C.The fabric border node enforces all policies for traffic within the fabric.
✓ D.Cisco ISE is used to define and manage policy in SD-Access.
✓ E.The fabric edge node applies policy based on SGTs in the VXLAN header.

Why A: SD-Access uses Scalable Group Tags (SGTs) to enforce micro-segmentation and policy. SGTs are assigned to endpoints based on identity (e.g., user, device type) and are carried in the VXLAN header. The fabric edge applies policy based on SGTs, not IP addresses. The Cisco ISE provides centralized policy management and authentication. The control plane node does not enforce policy; it only maintains mappings. Policy enforcement is done at the fabric edge, not the border, for traffic within the fabric.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.