How should I use these Sd Access Architecture practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Sd Access Architecture questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Sd Access Architecture domain.

350-401 · topic practice

Sd Access Architecture practice questions

Practise ENCOR 350-401 Sd Access Architecture practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

5 questionsDomain: Sd Access Architecture

Practice 10 questions Browse domain →

What the exam tests

What to know about Sd Access Architecture

Sd Access Architecture questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Sd Access Architecture exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Sd Access Architecture questions

5 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Study the full SD-Access breakdown →

A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?

Trap 1: Implement PIM-SM for multicast routing in the underlay.

PIM-SM is unnecessary and even harmful in an SD-Access underlay because multicast traffic is handled in the overlay via VXLAN encapsulation, typically with head-end replication. The underlay is intentionally an IP-only fabric that must not maintain multicast group state, since doing so adds control-plane complexity and introduces a dependency on a multicast Rendezvous Point. In a properly designed fabric, the overlay control plane (LISP) maps multicast receivers and sources, and the underlay simply forwards the encapsulated unicast copies, so enabling PIM-SM in the underlay would violate the architecture's scalability principles.

Trap 2: Preserve existing VLANs across the fabric to minimize changes.

Preserving existing VLANs across the fabric is a misunderstanding of the underlay/overlay boundary in SD-Access. The underlay is a routed L3 fabric where no L2 broadcast domain exists; VLANs are only locally relevant at each Fabric Edge node. Attempting to stretch VLANs across the fabric would force spanning-tree into the path, reintroduce L2 loops, and cap the fabric's scale at the size of a broadcast domain. In SD-Access, VLANs are mapped to overlay VNIs, and Layer 2 extension happens only where explicitly required, not as a default mode.

Trap 3: Deploy VRF-lite on all edge nodes to isolate tenants.

Deploying VRF-lite on all edge nodes is a throwback to a manual, device-centric segmentation model that does not align with SD-Access intent. The overlay uses LISP to maintain VRFs centrally and VXLAN VNIs to segregate tenants, providing end-to-end segmentation without requiring per-device VRF provisioning. VRF-lite would also be unable to span sites or enforce network-wide policy consistently, and it adds operational overhead precisely where SD-Access aims to eliminate it. Thus, VRF-lite should not be substituted for the fabric's overlay segmentation.

Study all Sd Access Architecture common traps →

A
Configure a routed access layer with a link-state routing protocol (IS-IS or OSPF).
A routed access layer with IS-IS or OSPF is the required foundation for an SD-Access underlay. Link-state protocols offer rapid convergence, loop-free topology, and hierarchical scalability, which are essential when building a large leaf-and-spine fabric. The underlay is a pure L3 network, and all devices carry only unique loopback/p2p addresses, allowing the overlay (LISP/VXLAN) to run independently of L2 constraints. Without this routed design, the fabric cannot propagate reachability efficiently and may revert to spanning-tree, which is explicitly contrary to SD-Access best practices.
B
Implement PIM-SM for multicast routing in the underlay.
Why it fails: PIM-SM is unnecessary and even harmful in an SD-Access underlay because multicast traffic is handled in the overlay via VXLAN encapsulation, typically with head-end replication. The underlay is intentionally an IP-only fabric that must not maintain multicast group state, since doing so adds control-plane complexity and introduces a dependency on a multicast Rendezvous Point. In a properly designed fabric, the overlay control plane (LISP) maps multicast receivers and sources, and the underlay simply forwards the encapsulated unicast copies, so enabling PIM-SM in the underlay would violate the architecture's scalability principles.
C
Preserve existing VLANs across the fabric to minimize changes.
Why it fails: Preserving existing VLANs across the fabric is a misunderstanding of the underlay/overlay boundary in SD-Access. The underlay is a routed L3 fabric where no L2 broadcast domain exists; VLANs are only locally relevant at each Fabric Edge node. Attempting to stretch VLANs across the fabric would force spanning-tree into the path, reintroduce L2 loops, and cap the fabric's scale at the size of a broadcast domain. In SD-Access, VLANs are mapped to overlay VNIs, and Layer 2 extension happens only where explicitly required, not as a default mode.
D
Deploy VRF-lite on all edge nodes to isolate tenants.
Why it fails: Deploying VRF-lite on all edge nodes is a throwback to a manual, device-centric segmentation model that does not align with SD-Access intent. The overlay uses LISP to maintain VRFs centrally and VXLAN VNIs to segregate tenants, providing end-to-end segmentation without requiring per-device VRF provisioning. VRF-lite would also be unable to span sites or enforce network-wide policy consistently, and it adds operational overhead precisely where SD-Access aims to eliminate it. Thus, VRF-lite should not be substituted for the fabric's overlay segmentation.

Full breakdown with real-world context →

Question 2easymultiple choice

Study the full SD-Access breakdown →

A company is deploying Cisco DNA Center and wants to use streaming telemetry from its network devices to provide real-time visibility. The network consists of Cisco Catalyst 9000 switches running IOS-XE. The engineer needs to configure the devices to stream telemetry data to DNA Center. Which protocol should the engineer use for the telemetry transport?

Trap 1: NetFlow v9.

NetFlow v9 is incorrect because it is a flow-export protocol designed specifically for recording and exporting IP traffic statistics, such as source/destination addresses, ports, and byte counts. It does not carry device health information like interface counters, CPU load, or memory usage, which are central to system telemetry. DNA Center's streaming telemetry is based on YANG-modeled data over gRPC, not NetFlow's UDP-based flow records.

Trap 2: SNMPv3.

SNMPv3 is incorrect because it operates on a pull-based model where a management station must poll device OIDs to retrieve data, making it inefficient for high-frequency, real-time telemetry. While SNMP supports traps/informs for notifications, these are limited in structure and frequency compared to the continuous, subscription-based streaming that DNA Center requires. Modern telemetry pushes data proactively via gRPC, whereas SNMP always relies on a request-response exchange or sparse trap events.

Trap 3: Syslog.

Syslog is incorrect because it is designed for unstructured or semi-structured event messages, primarily for logging and troubleshooting, not for structured, high-frequency numerical telemetry. Syslog messages are typically sent via UDP without guaranteed delivery, and there is no subscription mechanism to receive continuous updates of interface counters or system health. DNA Center's telemetry solution depends on YANG-defined data models and gRPC's reliable, ordered streaming, which syslog cannot provide.

Study all Sd Access Architecture common traps →

A
gRPC (Google Remote Procedure Call).
gRPC (Google Remote Procedure Call) is the correct answer because Cisco DNA Center leverages model-driven telemetry, and gRPC is the standard transport for that telemetry. It uses protocol buffers to encode structured YANG data and supports high-frequency, push-based subscriptions over HTTP/2. This allows DNA Center to stream interface counters, CPU/memory utilization, and other operational state from devices in near real-time, eliminating the need for repeated polling.
B
NetFlow v9.
Why it fails: NetFlow v9 is incorrect because it is a flow-export protocol designed specifically for recording and exporting IP traffic statistics, such as source/destination addresses, ports, and byte counts. It does not carry device health information like interface counters, CPU load, or memory usage, which are central to system telemetry. DNA Center's streaming telemetry is based on YANG-modeled data over gRPC, not NetFlow's UDP-based flow records.
C
SNMPv3.
Why it fails: SNMPv3 is incorrect because it operates on a pull-based model where a management station must poll device OIDs to retrieve data, making it inefficient for high-frequency, real-time telemetry. While SNMP supports traps/informs for notifications, these are limited in structure and frequency compared to the continuous, subscription-based streaming that DNA Center requires. Modern telemetry pushes data proactively via gRPC, whereas SNMP always relies on a request-response exchange or sparse trap events.
D
Syslog.
Why it fails: Syslog is incorrect because it is designed for unstructured or semi-structured event messages, primarily for logging and troubleshooting, not for structured, high-frequency numerical telemetry. Syslog messages are typically sent via UDP without guaranteed delivery, and there is no subscription mechanism to receive continuous updates of interface counters or system health. DNA Center's telemetry solution depends on YANG-defined data models and gRPC's reliable, ordered streaming, which syslog cannot provide.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full wireless explanation →

A network engineer is designing a Cisco SD-Access fabric for a campus network. The fabric must support both wired and wireless clients, and the engineer wants to ensure that traffic from wired endpoints is encapsulated and forwarded through the fabric without requiring the endpoints to change their IP addresses. Which component of the SD-Access architecture is responsible for encapsulating traffic from wired endpoints and forwarding it to the fabric edge?

Trap 1: Control plane node

The control plane node maintains the mapping of endpoint identities to fabric edge nodes using LISP. It does not encapsulate or forward data traffic from wired endpoints. Its role is to provide the control plane database for endpoint location, not to perform VXLAN encapsulation of user traffic.

Trap 2: Fabric intermediate node

The fabric intermediate node is a Layer 3 underlay device that forwards VXLAN-encapsulated traffic between fabric edge and border nodes. It does not encapsulate traffic from wired endpoints; it only transports the encapsulated packets based on the outer IP header. It has no knowledge of endpoint identities or fabric encapsulation functions.

Trap 3: Fabric border node

The fabric border node connects the SD-Access fabric to external networks such as the data center or WAN. It does not encapsulate traffic from wired endpoints; instead, it handles traffic entering or leaving the fabric. While it may de-encapsulate VXLAN traffic for external destinations, it is not the first point of encapsulation for wired endpoints.

Study all Sd Access Architecture common traps →

A
Control plane node
Why it fails: The control plane node maintains the mapping of endpoint identities to fabric edge nodes using LISP. It does not encapsulate or forward data traffic from wired endpoints. Its role is to provide the control plane database for endpoint location, not to perform VXLAN encapsulation of user traffic.
B
Fabric edge node
The fabric edge node is responsible for encapsulating traffic from wired endpoints using VXLAN and forwarding it to the fabric. It acts as the first-hop router for endpoints and registers them with the control plane node. This component is essential for wired client integration in SD-Access, as it provides the anycast gateway and encapsulation functions.
C
Fabric intermediate node
Why it fails: The fabric intermediate node is a Layer 3 underlay device that forwards VXLAN-encapsulated traffic between fabric edge and border nodes. It does not encapsulate traffic from wired endpoints; it only transports the encapsulated packets based on the outer IP header. It has no knowledge of endpoint identities or fabric encapsulation functions.
D
Fabric border node
Why it fails: The fabric border node connects the SD-Access fabric to external networks such as the data center or WAN. It does not encapsulate traffic from wired endpoints; instead, it handles traffic entering or leaving the fabric. While it may de-encapsulate VXLAN traffic for external destinations, it is not the first point of encapsulation for wired endpoints.

Full breakdown with real-world context →

Question 4mediummultiple choice

Open the full VLAN trunking answer →

A network architect is designing a new branch office that must support wired and wireless users on the same Layer 2 segment while enforcing consistent security policy regardless of where a user connects. The design must minimize the number of VLANs and IP subnets that must be provisioned as users move between floors. Which Cisco architecture feature should be used to meet these requirements?

Trap 1: Cisco StackWise Virtual on the distribution switches

StackWise Virtual combines two physical switches into one logical switch for control-plane and management simplification, but it does not decouple user identity from location or reduce VLAN and subnet provisioning across floors. Users still need VLANs and subnets tied to their access ports, so this does not satisfy the stated design requirement.

Trap 2: Cisco Software-Defined Access with traditional VLAN trunking to the…

Trunking VLANs to a wireless controller keeps the wireless traffic tied to physical VLAN and subnet boundaries, which is exactly the sprawl the design is trying to avoid. Although SD-Access is mentioned, pairing it with legacy VLAN trunking defeats the overlay model and does not provide location-independent identity or consistent policy across wired and wireless.

Trap 3: Cisco TrustSec with static SGACL enforcement on access ports

TrustSec provides group-based policy using security group tags, which addresses consistent policy, but it does not by itself eliminate VLAN and subnet sprawl or unify wired and wireless access into one logical segment. Without an overlay fabric, the branch still requires separate VLANs and subnets for each floor, so it only partially meets the requirement.

Study all Sd Access Architecture common traps →

A
Cisco StackWise Virtual on the distribution switches
Why it fails: StackWise Virtual combines two physical switches into one logical switch for control-plane and management simplification, but it does not decouple user identity from location or reduce VLAN and subnet provisioning across floors. Users still need VLANs and subnets tied to their access ports, so this does not satisfy the stated design requirement.
B
Cisco Software-Defined Access with traditional VLAN trunking to the WLC
Why it fails: Trunking VLANs to a wireless controller keeps the wireless traffic tied to physical VLAN and subnet boundaries, which is exactly the sprawl the design is trying to avoid. Although SD-Access is mentioned, pairing it with legacy VLAN trunking defeats the overlay model and does not provide location-independent identity or consistent policy across wired and wireless.
C
Cisco SD-Access fabric with VXLAN overlay and policy-based segmentation
SD-Access decouples identity from location by using a VXLAN overlay, so a user keeps the same IP subnet and security group tag whether wired or wireless. This eliminates per-floor VLAN/subnet sprawl and enforces consistent group-based policy through the fabric, which directly matches the stated requirement for unified wired/wireless policy with minimal VLAN provisioning.
D
Cisco TrustSec with static SGACL enforcement on access ports
Why it fails: TrustSec provides group-based policy using security group tags, which addresses consistent policy, but it does not by itself eliminate VLAN and subnet sprawl or unify wired and wireless access into one logical segment. Without an overlay fabric, the branch still requires separate VLANs and subnets for each floor, so it only partially meets the requirement.

Full breakdown with real-world context →

Question 5hardmultiple choice

Study the full SD-Access breakdown →

A network engineer is designing a network that uses Cisco SD-Access with a fabric that includes a border node and control plane node. The engineer must ensure that traffic from external networks can reach endpoints within the fabric. Which function does the border node provide in this architecture?

Trap 1: It maintains the mapping of endpoint IP addresses to fabric edge…

The control plane node, not the border node, maintains the endpoint-to-edge node mappings using LISP. The border node handles external connectivity and does not perform the mapping function. This option describes the control plane node's role.

Trap 2: It enforces security policies between endpoints within the same…

Security policy enforcement within a virtual network is performed by fabric edge nodes using SGTs, not by the border node. The border node focuses on external connectivity and may apply policies for traffic entering or leaving the fabric, but not for intra-VN traffic.

Trap 3: It acts as the default gateway for all endpoints in the fabric.

The default gateway for endpoints is typically the fabric edge node to which they are connected. The border node does not serve as the default gateway for endpoints; it provides external connectivity and may be the gateway for external networks to reach the fabric.

Study all Sd Access Architecture common traps →

A
It provides connectivity between the fabric and external networks, such as WAN or data center.
The border node in Cisco SD-Access provides connectivity between the fabric and external networks. It handles traffic entering and leaving the fabric, performing functions such as VXLAN-to-VLAN translation and routing to external networks. This allows external users to reach fabric endpoints.
B
It maintains the mapping of endpoint IP addresses to fabric edge nodes.
Why it fails: The control plane node, not the border node, maintains the endpoint-to-edge node mappings using LISP. The border node handles external connectivity and does not perform the mapping function. This option describes the control plane node's role.
C
It enforces security policies between endpoints within the same virtual network.
Why it fails: Security policy enforcement within a virtual network is performed by fabric edge nodes using SGTs, not by the border node. The border node focuses on external connectivity and may apply policies for traffic entering or leaving the fabric, but not for intra-VN traffic.
D
It acts as the default gateway for all endpoints in the fabric.
Why it fails: The default gateway for endpoints is typically the fabric edge node to which they are connected. The border node does not serve as the default gateway for endpoints; it provides external connectivity and may be the gateway for external networks to reach the fabric.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Sd Access Architecture sessions

Start a Sd Access Architecture only practice session

Every question in these sessions is drawn from the Sd Access Architecture domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Sd Access Architecture questions →Mixed 350-401 session

Frequently asked questions

What does the 350-401 exam test about Sd Access Architecture?: Sd Access Architecture questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Sd Access Architecture questions in a focused session?: Yes — the session launcher on this page draws every question from the Sd Access Architecture domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 350-401 topics?: Use the topic links above to move to related areas, or go back to the 350-401 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 350-401 exam covers. They are not copied from any real exam or dump site.

Sd Access Architecture only

10 questions 20 questions 30 questions 50 questions

Mixed 350-401 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 350-401 questions Sd Access Architecture domain overview 350-401 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Sd Access Architecture practice questions

What to know about Sd Access Architecture

Common Sd Access Architecture exam traps

Sd Access Architecture questions

A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?

A network engineer is designing a network that uses Cisco SD-Access with a fabric that includes a border node and control plane node. The engineer must ensure that traffic from external networks can reach endpoints within the fabric. Which function does the border node provide in this architecture?

Track your progress over time

Start a Sd Access Architecture only practice session

Related 350-401 topic practice pages

Architecture practice questions

Virtualization practice questions

Infrastructure practice questions

Network Assurance practice questions

Security practice questions

Automation practice questions

ENCOR BGP practice questions

ENCOR OSPF practice questions

ENCOR EIGRP practice questions

ENCOR VLANs and trunking practice questions

ENCOR STP practice questions

ENCOR ACLs and CoPP practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid