hardMultiple SelectObjective-mapped
350-401 Practice Question: Which three statements about VXLAN in Cisco…
Which three statements about VXLAN in Cisco SD-Access are true? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VXLAN encapsulation uses a 24-bit VNI to identify the virtual network.
VXLAN in Cisco SD-Access uses a 24-bit VNI to identify virtual networks (option A correct). Fabric edge nodes perform VXLAN encapsulation when traffic enters the fabric (option C correct). While VXLAN itself does not provide encryption, MACsec can be used to encrypt VXLAN traffic between fabric nodes (option E correct). The underlay is Layer 3 routed, not Layer 2 (option B false). The control plane is LISP, not VXLAN (option D false).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VXLAN encapsulation uses a 24-bit VNI to identify the virtual network.
Why this is correct
Correct because the VXLAN Network Identifier (VNI) is a 24-bit field that uniquely identifies a Layer 2 or Layer 3 virtual network within the fabric.
- ✗
The underlay network for VXLAN must be a Layer 2 switched network.
Why it's wrong here
Incorrect because the underlay is a Layer 3 routed network (e.g., IS-IS, OSPF) that provides IP connectivity between fabric nodes.
- ✓
VXLAN encapsulation is performed by the fabric edge node when traffic enters the fabric.
Why this is correct
Correct because the fabric edge encapsulates traffic from endpoints into VXLAN packets before sending them across the fabric.
- ✗
VXLAN provides the control plane for endpoint discovery in SD-Access.
Why it's wrong here
Incorrect because VXLAN is only a data plane encapsulation; the control plane is provided by LISP (Locator/ID Separation Protocol).
- ✓
VXLAN traffic between fabric nodes can be encrypted using MACsec.
Why this is correct
Correct because MACsec (IEEE 802.1AE) can be used to encrypt VXLAN traffic on the wire between fabric nodes for additional security.
Go deeper
Related to this question
Learn chapter
Network Access Control and AAA
Key term
Fabric Fundamentals
Fabric Fundamentals is the set of core concepts behind a network fabric, where switches and routers form a single logical system that simplifies traffic forwarding and automation.
Key term
Cisco Virtual Topology System
Cisco Virtual Topology System is a software-defined networking solution that creates and manages virtual network overlays across physical and virtual infrastructure for enterprise networks.
About these practice questions
This 350-401 question is part of Courseiva's 1,175-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which four statements about VXLAN encapsulation in Cisco SD-Access are true? (Choose four.)
hard- ✓ A.VXLAN encapsulation uses a 24-bit VNI to identify the virtual network segment.
- ✓ B.The VXLAN header in SD-Access includes a Group Policy ID field to carry the SGT.
- C.VXLAN encapsulation in SD-Access is an IP-in-IP tunneling mechanism.
- ✓ D.The outer IP destination address in the VXLAN packet is the IP address of the destination fabric node.
- ✓ E.The VNI is mapped to a VLAN at the fabric edge to provide Layer 2 connectivity for endpoints.
Why A: In Cisco SD-Access, VXLAN uses a 24-bit VNI to identify virtual network segments (A). The VXLAN header includes a Group Policy ID field to carry the SGT (B). The outer IP destination address is the IP address of the destination fabric node, as the packet is routed over the underlay (D). VXLAN is MAC-in-UDP encapsulation, not IP-in-IP (C is false). The VNI is mapped to a VLAN at the fabric edge to provide Layer 2 connectivity for endpoints (E is true).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.