A company is migrating from a traditional campus to SD-Access. To minimize risk, they want to deploy SD-Access in one building first while the rest of the campus remains traditional. They also need users in the SD-Access building to communicate with users in the traditional buildings during the migration. Which strategy should they use?

Full cutover to SD-Access in the entire campus at once

Deploy SD-Access in the traditional building using extended nodes only

Use a fusion node to connect the fabric to the traditional network

Phased deployment with a border node connecting the fabric to the traditional network

A security audit requires that traffic between the Finance and HR groups be denied, even if they are in the same IP subnet. The SD-Access fabric is already deployed with SGTs assigned to each group. Which configuration is needed to enforce this policy?

Configure an ACL on the intermediate nodes to block the two subnets.

Use LISP to prevent the two groups from learning each other's EIDs.

Create an SGACL on the fabric edge nodes that denies traffic between the Finance and HR SGTs.

Create separate VNIs for Finance and HR and block inter-VNI routing.

Which three components are the primary building blocks of the Cisco SD-Access solution?

LISP, VXLAN, and Cisco TrustSec

Routing, switching, and wireless

An SD-Access fabric is designed with two fabric border nodes for redundancy. The underlay is a simple IP network. The engineer notices that traffic from a host in the fabric to an external network is always leaving through the same border node, even when the other border node is available. The engineer wants to load-balance external traffic across both border nodes. What should the engineer configure?

Enable VXLAN multicast on both border nodes.

Configure the external network to advertise different routes through each border node and tune the routing metrics.

Configure LISP to use both border nodes as control plane nodes.

Use a fusion node to connect both border nodes to the external network.

A branch office has a legacy access switch that cannot run SD-Access fabric software. The switch connects to a fabric edge node in the same wiring closet. The engineer needs to integrate this switch so that its connected users can join the SD-Access fabric. Which approach should the engineer use?

Replace the legacy switch with a fabric edge node

Place the legacy switch in the underlay as an intermediate node

Connect the legacy switch to a fabric border node

Configure the legacy switch as an extended node

CiscoCertified Network Professional Enterprise

Domain 1Objective 3

1.3 Explain the Working Principles of the Cisco SD-Access Solution 350-401 Practice Questions (Page 5)

Part of the 1.0 Architecture domain, which accounts for 15% of the 350-401 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

10concepts

15%of the exam

Questions 21–25

21application · medium
A company is migrating from a traditional campus to SD-Access. To minimize risk, they want to deploy SD-Access in one building first while the rest of the campus remains traditional. They also need users in the SD-Access building to communicate with users in the traditional buildings during the migration. Which strategy should they use?
Select an answer first
22application · medium
A security audit requires that traffic between the Finance and HR groups be denied, even if they are in the same IP subnet. The SD-Access fabric is already deployed with SGTs assigned to each group. Which configuration is needed to enforce this policy?
Select an answer first
23foundation · easy
Which three components are the primary building blocks of the Cisco SD-Access solution?
Select an answer first
24expert · hard
An SD-Access fabric is designed with two fabric border nodes for redundancy. The underlay is a simple IP network. The engineer notices that traffic from a host in the fabric to an external network is always leaving through the same border node, even when the other border node is available. The engineer wants to load-balance external traffic across both border nodes. What should the engineer configure?
Select an answer first
25application · medium
A branch office has a legacy access switch that cannot run SD-Access fabric software. The switch connects to a fabric edge node in the same wiring closet. The engineer needs to integrate this switch so that its connected users can join the SD-Access fabric. Which approach should the engineer use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-401” is a trademark of its owner, used for identification only.

1.3 Explain the Working Principles of the Cisco SD-Access Solution 350-401 Practice Questions (Page 5)

Questions 21–25

A security audit requires that traffic between the Finance and HR groups be denied, even if they are in the same IP subnet. The SD-Access fabric is already deployed with SGTs assigned to each group. Which configuration is needed to enforce this policy?

Which three components are the primary building blocks of the Cisco SD-Access solution?

A branch office has a legacy access switch that cannot run SD-Access fabric software. The switch connects to a fabric edge node in the same wiring closet. The engineer needs to integrate this switch so that its connected users can join the SD-Access fabric. Which approach should the engineer use?

Keep studying — 1.0 Architecture