An administrator is designing an SD-Access fabric and needs to ensure that traffic between two virtual networks (VNs) is isolated. The administrator plans to use VXLAN VNIs to provide this isolation. Which statement about VXLAN VNIs in SD-Access is correct?

VXLAN VNIs are assigned per host, not per virtual network.

VXLAN VNIs are used only for the underlay routing and do not affect overlay segmentation.

Each virtual network is mapped to a unique VXLAN VNI, and the VNI is carried in the VXLAN header to identify the overlay segment.

VXLAN VNIs are used only at the border node and are not used within the fabric.

A company wants to enforce micro-segmentation between user groups in its SD-Access fabric. The security team requires that traffic between two groups be blocked at the fabric edge, not at a central firewall. Which policy plane mechanism should the engineer rely on?

Scalable Group Tags (SGTs) with SGACL enforcement on the fabric edge

LISP EID-to-RLOC mapping with a default-deny policy

VXLAN VNI segmentation with separate VLANs

Traditional ACLs on the intermediate nodes

An SD-Access fabric is configured with SGTs for different user groups. The security team wants to enforce a policy that blocks all traffic from the 'Guest' group to the 'Corporate' group, but allows the 'Corporate' group to initiate traffic to the 'Guest' group. The policy must be enforced even when the two groups are in different subnets and different VNIs. Which mechanism should be used?

ACL on the border node to filter traffic between the two subnets.

VXLAN VNI segmentation with inter-VNI routing disabled.

LISP policy to prevent the Guest EIDs from being resolved.

SGACL on the fabric edge nodes that denies Guest-to-Corporate and allows Corporate-to-Guest.

What is a common strategy for migrating from a traditional campus to SD-Access?

Phased deployment, starting with a small fabric and expanding

Using a separate overlay without underlay changes

Immediate replacement of all switches

Deploying SD-Access only in the core

How are legacy devices that do not support VXLAN or LISP supported in an SD-Access fabric?

They are connected directly to the control plane node

They are upgraded to support VXLAN

They are placed in the underlay as intermediate nodes

They are connected as extended nodes to a fabric edge

CiscoCertified Network Professional Enterprise

Domain 1Objective 3

1.3 Explain the Working Principles of the Cisco SD-Access Solution 350-401 Practice Questions (Page 8)

Part of the 1.0 Architecture domain, which accounts for 15% of the 350-401 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

10concepts

15%of the exam

Questions 36–40

36application · medium
An administrator is designing an SD-Access fabric and needs to ensure that traffic between two virtual networks (VNs) is isolated. The administrator plans to use VXLAN VNIs to provide this isolation. Which statement about VXLAN VNIs in SD-Access is correct?
Select an answer first
37application · medium
A company wants to enforce micro-segmentation between user groups in its SD-Access fabric. The security team requires that traffic between two groups be blocked at the fabric edge, not at a central firewall. Which policy plane mechanism should the engineer rely on?
Select an answer first
38expert · hard
An SD-Access fabric is configured with SGTs for different user groups. The security team wants to enforce a policy that blocks all traffic from the 'Guest' group to the 'Corporate' group, but allows the 'Corporate' group to initiate traffic to the 'Guest' group. The policy must be enforced even when the two groups are in different subnets and different VNIs. Which mechanism should be used?
Select an answer first
39foundation · easy
What is a common strategy for migrating from a traditional campus to SD-Access?
Select an answer first
40foundation · easy
How are legacy devices that do not support VXLAN or LISP supported in an SD-Access fabric?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-401” is a trademark of its owner, used for identification only.