1.3 Explain the Working Principles of the Cisco SD-Access Solution 350-401 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization is deploying SD-Access and wants to enforce micro-segmentation between two groups of users in the same IP subnet. The security team requires that traffic between the groups be blocked at the fabric edge, not at a central firewall. Which configuration should the administrator implement?

   • AUse VXLAN to segment the traffic and rely on the underlay to block the traffic.
   • BConfigure the control plane node to filter traffic between the groups.
   • CCreate two separate VLANs for the groups and configure an ACL on the edge switch to block inter-VLAN traffic.
   • DAssign different SGTs to the two groups and configure a security policy that denies traffic between those SGTs.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   During a phased migration to SD-Access, how can the fabric coexist with a traditional campus?

   • ABy using border nodes to interconnect the fabric and traditional network
   • BBy using the same VLANs in both networks without translation
   • CBy running LISP on all traditional switches
   • DBy disabling the traditional network until migration is complete
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary function of an intermediate node in an SD-Access fabric?

   • ATo connect the fabric to external networks
   • BTo enforce SGT-based policies
   • CTo maintain the EID-to-RLOC mapping database
   • DTo forward encapsulated traffic without participating in the overlay
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An engineer is troubleshooting a connectivity issue between two hosts in the same SD-Access fabric but attached to different fabric edge nodes. The underlay is healthy and both edge nodes can ping each other. However, traffic between the hosts fails. Which data plane element is most likely misconfigured?

   • ALISP map-cache on the intermediate nodes
   • BVXLAN encapsulation on the fabric edge nodes
   • CSGT classification on the access ports
   • DBGP peering between the edge nodes
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An SD-Access fabric is being integrated with an existing traditional campus. The traditional campus uses a core switch that also connects to the WAN and the internet. The engineer wants to minimize changes to the traditional core while still allowing the fabric to reach the WAN and internet. Which design should the engineer choose?

   • AUse a fusion node to connect the fabric directly to the WAN router, bypassing the traditional core.
   • BDeploy a fabric border node that connects to the traditional core, and let the border node advertise the fabric's subnets into the traditional network.
   • CReplace the traditional core with a fabric border node and move all WAN/internet connections to the border node.
   • DConnect the fabric edge nodes directly to the WAN router using VXLAN.
   Reveal Solution Discussion Select an answer first