hardMultiple SelectObjective-mapped
SD-Access Policy Enforcement
Which three statements about Cisco SD-Access policy enforcement are true? (Choose three.)
Quick Answer
The correct answer identifies that SGT information is carried in the VXLAN header using the Group Policy Option (GPO). This is true because Cisco SD-Access policy enforcement relies on Scalable Group Tags (SGTs) for micro-segmentation, with policies defined in Cisco ISE and enforced at the fabric edge node. The fabric edge applies SGT-based ACLs to traffic, while the control plane (LISP) distributes SGT mappings but does not enforce policies—that role belongs solely to the edge. On the ENCOR 350-401 exam, this concept tests your understanding of where policy enforcement actually occurs, with a common trap being to assume the border node or underlay handles SGT enforcement. Remember: the underlay is completely SGT-unaware, and the border only manages external connectivity. A useful memory tip is “Edge enforces, border exits”—the fabric edge is where SGT-based policy decisions happen, and the SGT tag rides inside the VXLAN Group Policy Option header.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policy enforcement in SD-Access is based on Scalable Group Tags (SGTs) assigned to endpoints.
SD-Access uses Scalable Group Tags (SGTs) for micro-segmentation, and policies are defined in Cisco ISE (Identity Services Engine). The fabric edge enforces policies by applying SGTs to traffic and using SGT-based ACLs. The control plane (LISP) distributes SGT mappings, but policy enforcement is done at the edge. The border node does not enforce policies for internal fabric traffic; it only handles external connectivity. The SGT is carried in the VXLAN header using the Group Policy Option. The underlay network is unaware of SGTs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Policy enforcement in SD-Access is based on Scalable Group Tags (SGTs) assigned to endpoints.
Why this is correct
Correct because SGTs are the foundation for group-based policy, allowing dynamic segmentation.
- ✓
Cisco ISE is used to define and manage SGT-to-policy mappings in the SD-Access fabric.
Why this is correct
Correct because ISE acts as the policy server, authenticating endpoints and assigning SGTs based on user/device identity.
- ✗
The fabric border node enforces all intra-fabric policies between different virtual networks.
Why it's wrong here
Incorrect because intra-fabric policy enforcement is done at the edge nodes; the border node only handles traffic leaving or entering the fabric.
- ✓
The SGT information is carried in the VXLAN header using the Group Policy Option (GPO).
Why this is correct
Correct because VXLAN-GPO embeds the SGT in the header, allowing the edge to enforce policies without inspecting the inner packet.
- ✗
The underlay network devices must be aware of SGTs to forward traffic correctly.
Why it's wrong here
Incorrect because the underlay is IP-only and does not need to understand SGTs; the overlay (VXLAN) carries the SGT transparently.
Go deeper
Related to this question
Learn chapter
Network Architecture Fundamentals
Key term
Cisco SD-Access
Cisco Software-Defined Access is a network architecture that uses a central controller to automate and secure user and device access across an enterprise network.
Key term
Fabric Fundamentals
Fabric Fundamentals is the set of core concepts behind a network fabric, where switches and routers form a single logical system that simplifies traffic forwarding and automation.
About these practice questions
One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which three statements about Cisco SD-Access policy enforcement are true? (Choose three.)
hard- ✓ A.Scalable Group Tags (SGTs) are used to enforce micro-segmentation and policy in the fabric.
- B.SGTs are assigned to endpoints based on their IP address only.
- C.The fabric border node enforces all policies for traffic within the fabric.
- ✓ D.Cisco ISE is used to define and manage policy in SD-Access.
- ✓ E.The fabric edge node applies policy based on SGTs in the VXLAN header.
Why A: SD-Access uses Scalable Group Tags (SGTs) to enforce micro-segmentation and policy. SGTs are assigned to endpoints based on identity (e.g., user, device type) and are carried in the VXLAN header. The fabric edge applies policy based on SGTs, not IP addresses. The Cisco ISE provides centralized policy management and authentication. The control plane node does not enforce policy; it only maintains mappings. Policy enforcement is done at the fabric edge, not the border, for traffic within the fabric.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.