A security administrator is designing an SD-Access fabric and needs to enforce a policy that blocks all traffic from the 'Guest' SGT to the 'Corporate' SGT, except for HTTP/HTTPS to a specific server. The policy must be enforced regardless of the IP subnet of the endpoints. Which mechanism should be used to enforce this policy?

Configure the policy on the control plane node to filter traffic between the SGTs.

Configure an SGT-based policy on the fabric edge nodes that denies all traffic between the SGTs, then add a permit rule for HTTP/HTTPS to the specific server's IP.

Use a traditional ACL on the edge nodes based on IP subnets, since the policy is IP-specific.

Use VXLAN VNIs to separate the Guest and Corporate traffic, and then block inter-VNI traffic at the border.

An SD-Access fabric has multiple fabric edge nodes. A host attached to edge node A sends its first packet to a host attached to edge node B. Which sequence of events occurs in the control plane?

Edge A broadcasts the packet to all other edge nodes using VXLAN multicast.

Edge A sends a LISP map-request to the control plane node, receives the RLOC of edge B, and then encapsulates the packet in VXLAN to edge B.

The control plane node forwards the packet directly to edge B.

Edge A sends the packet to the border node, which then routes it to edge B.

An SD-Access fabric is being deployed in a campus that also has a traditional (non-fabric) network. The fabric must provide connectivity for fabric users to reach servers located in the traditional network. Which device should be used to connect the fabric to the traditional network?

A control plane node that routes traffic between the fabric and the traditional network.

An intermediate node that is placed between the fabric and the traditional network.

A fabric edge node that connects directly to the traditional network's core switch.

A fabric border node that connects the fabric to the traditional network and performs the necessary interworking.

CiscoCertified Network Professional Enterprise

Domain 1Objective 3

1.3 Explain the Working Principles of the Cisco SD-Access Solution 350-401 Practice Questions (Page 6)

Part of the 1.0 Architecture domain, which accounts for 15% of the 350-401 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

10concepts

15%of the exam

Questions 26–30

26expert · hard
A security administrator is designing an SD-Access fabric and needs to enforce a policy that blocks all traffic from the 'Guest' SGT to the 'Corporate' SGT, except for HTTP/HTTPS to a specific server. The policy must be enforced regardless of the IP subnet of the endpoints. Which mechanism should be used to enforce this policy?
Select an answer first
27expert · hard
A network engineer is designing an SD-Access fabric and must decide how to handle the underlay routing. The engineer wants to use a single routing protocol for the underlay and also ensure that the overlay can scale to a large number of virtual networks. Which routing protocol should be used for the underlay?
Select an answer first
28application · medium
An SD-Access fabric has multiple fabric edge nodes. A host attached to edge node A sends its first packet to a host attached to edge node B. Which sequence of events occurs in the control plane?
Select an answer first
29application · medium
An SD-Access fabric is being deployed in a campus that also has a traditional (non-fabric) network. The fabric must provide connectivity for fabric users to reach servers located in the traditional network. Which device should be used to connect the fabric to the traditional network?
Select an answer first
30application · medium
An organization is deploying SD-Access in one building of a multi-building campus. The other buildings still run a traditional campus network with a collapsed-core design. The SD-Access fabric must allow users in the traditional buildings to reach servers inside the fabric. Which SD-Access component is required to connect the fabric to the traditional network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-401” is a trademark of its owner, used for identification only.

1.3 Explain the Working Principles of the Cisco SD-Access Solution 350-401 Practice Questions (Page 6)

Questions 26–30

An SD-Access fabric has multiple fabric edge nodes. A host attached to edge node A sends its first packet to a host attached to edge node B. Which sequence of events occurs in the control plane?

An SD-Access fabric is being deployed in a campus that also has a traditional (non-fabric) network. The fabric must provide connectivity for fabric users to reach servers located in the traditional network. Which device should be used to connect the fabric to the traditional network?

Keep studying — 1.0 Architecture