350-401 Question #188: Real Exam Question with Answer & Explanation

Question

What function does VXLAN perform in a Cisco SD-Access deployment?

Options

• Apolicy plane forwarding (SDA Fabric Policy Plane) -> Cisco TrusSec SGT tags
• Bcontrol plane forwarding (SDA Fabric Control Plane) -> LISP
• Cdata plane forwarding (SDA Fabric Data Plane) -> VXLAN
• Dsystems management and orchestration

Explanation

VXLAN in Cisco SD-Access

Why C is Correct: VXLAN (Virtual Extensible LAN) serves as the data plane technology in SD-Access, encapsulating and transporting user traffic (Layer 2 and Layer 3) across the fabric underlay network. It carries both the original packet payload and critical metadata, including SGT tags and VNI (Virtual Network Identifier) information, enabling network segmentation and policy enforcement during actual data forwarding.

Why the Distractors Are Wrong:

• A is wrong because the policy plane uses Cisco TrustSec SGT (Scalable Group Tags) - not VXLAN - to define and enforce access policies (though VXLAN carries the SGT tags, it is not the policy mechanism itself).
• B is wrong because the control plane uses LISP (Locator/ID Separation Protocol), which handles endpoint registration, mapping, and lookup - tracking where endpoints are located across the fabric.
• D is wrong because systems management and orchestration is handled by Cisco DNA Center (now Catalyst Center), the GUI-driven automation platform for the entire SD-Access solution.

Memory Tip: Use the acronym "CPD" - Control plane = LISP, Policy plane = TrustSec/SGT, Data plane = VXLAN. Think of VXLAN as the delivery truck that physically moves the data, while LISP is the GPS and SGT is the security badge.

No community discussion yet for this question.