Pass Your Cisco 350-401 Exam Easy!

That control reduces a separate risk: The host location mapping has not converged to the new edge RLOC. For the described design, the recurring risk arises from: the access switch was not functioning as an SD-Access fabric edge for that VLAN/virtual network. The specific required safeguard is: validate edge onboarding, VN assignments and overlay reachability in fabric provisioning.

That control reduces a separate risk: The device lacks routed underlay reachability rather than an end-user VLAN trunk. For the described design, the recurring risk arises from: the access switch was not functioning as an SD-Access fabric edge for that VLAN/virtual network. The specific required safeguard is: validate edge onboarding, VN assignments and overlay reachability in fabric provisioning.

That control reduces a separate risk: Its EID-to-RLOC registration is missing or incorrect in the fabric control plane. For the described design, the recurring risk arises from: the access switch was not functioning as an SD-Access fabric edge for that VLAN/virtual network. The specific required safeguard is: validate edge onboarding, VN assignments and overlay reachability in fabric provisioning.

Using a fabric edge node that applies policy and VXLAN encapsulation for attached endpoint flows would not place a properly configured fabric border node at the fabric-to-external routing boundary.

Using the fabric control-plane node/LISP mapping service for endpoint-to-RLOC lookup rather than flooding every fabric edge would not place a properly configured fabric border node at the fabric-to-external routing boundary.

Maintaining a routed underlay that carries outer VXLAN reachability would not place a properly configured fabric border node at the fabric-to-external routing boundary.

This test measures a different behavior: Trace outer IP VTEP connectivity separately from inner host VLAN and VNIs. It does not establish the target outcome. For the documented fault, the direct acceptance test is: verify routing exchange between fabric VNs and authorized outside networks at the border.

This test measures a different behavior: Inspect endpoint attachment on the edge and VXLAN forwarding toward the selected remote RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: verify routing exchange between fabric VNs and authorized outside networks at the border.

This test measures a different behavior: Check the endpoint registration and map resolution to the correct fabric edge RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: verify routing exchange between fabric VNs and authorized outside networks at the border.

That diagnosis is supported by a different symptom: Remote traffic is bridged out an ordinary trunk rather than encapsulated through the fabric overlay. Here the recorded observation is: fabric endpoints reach one another but cannot reach the permitted external data center. The applicable cause is: no viable border handoff/routing policy connects the fabric virtual network to the external domain.

That diagnosis is supported by a different symptom: An endpoint is reachable on its local edge but remote fabric edges cannot resolve its current location. Here the recorded observation is: fabric endpoints reach one another but cannot reach the permitted external data center. The applicable cause is: no viable border handoff/routing policy connects the fabric virtual network to the external domain.

That diagnosis is supported by a different symptom: The overlay fails even though a host VLAN is manually permitted on one spine-facing switchport. Here the recorded observation is: fabric endpoints reach one another but cannot reach the permitted external data center. The applicable cause is: no viable border handoff/routing policy connects the fabric virtual network to the external domain.

That control reduces a separate risk: The routed underlay cannot reach the remote VTEP/RLOC; extending inner VLANs on transit does not solve this. For the described design, the recurring risk arises from: no viable border handoff/routing policy connects the fabric virtual network to the external domain. The specific required safeguard is: review border routing, route filtering and transit policies for each new shared service.

That control reduces a separate risk: Its EID-to-RLOC registration is missing or incorrect in the fabric control plane. For the described design, the recurring risk arises from: no viable border handoff/routing policy connects the fabric virtual network to the external domain. The specific required safeguard is: review border routing, route filtering and transit policies for each new shared service.

That control reduces a separate risk: The access switch was not functioning as an SD-Access fabric edge for that VLAN/virtual network. For the described design, the recurring risk arises from: no viable border handoff/routing policy connects the fabric virtual network to the external domain. The specific required safeguard is: review border routing, route filtering and transit policies for each new shared service.

Using a fabric edge node that applies policy and VXLAN encapsulation for attached endpoint flows would not assign endpoints to correct SD-Access virtual networks and carry their traffic over the shared routed underlay.

Maintaining a routed underlay that carries outer VXLAN reachability would not assign endpoints to correct SD-Access virtual networks and carry their traffic over the shared routed underlay.

The needed correction is to assign endpoints to correct SD-Access virtual networks and carry their traffic over the shared routed underlay.

This test measures a different behavior: Trace outer IP VTEP connectivity separately from inner host VLAN and VNIs. It does not establish the target outcome. For the documented fault, the direct acceptance test is: verify distinct VN/VNI assignments and the intended isolated forwarding tables for the two groups.

This test measures a different behavior: Inspect endpoint attachment on the edge and VXLAN forwarding toward the selected remote RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: verify distinct VN/VNI assignments and the intended isolated forwarding tables for the two groups.

This test measures a different behavior: Test a permitted and prohibited source/destination SGT pairing and inspect enforced policy matches. It does not establish the target outcome. For the documented fault, the direct acceptance test is: verify distinct VN/VNI assignments and the intended isolated forwarding tables for the two groups.

That diagnosis is supported by a different symptom: The overlay fails even though a host VLAN is manually permitted on one spine-facing switchport. Here the recorded observation is: a guest endpoint unexpectedly reaches internal finance services across the campus. The applicable cause is: the endpoint was placed into the wrong virtual network or external fusion routing bypasses isolation.

That diagnosis is supported by a different symptom: Remote traffic is bridged out an ordinary trunk rather than encapsulated through the fabric overlay. Here the recorded observation is: a guest endpoint unexpectedly reaches internal finance services across the campus. The applicable cause is: the endpoint was placed into the wrong virtual network or external fusion routing bypasses isolation.

That diagnosis is supported by a different symptom: Two endpoints in the same VN communicate although their security groups should be isolated. Here the recorded observation is: a guest endpoint unexpectedly reaches internal finance services across the campus. The applicable cause is: the endpoint was placed into the wrong virtual network or external fusion routing bypasses isolation.

Security group tags control group-to-group access within a virtual network; the request is to separate user groups into different virtual networks.

That control reduces a separate risk: The routed underlay cannot reach the remote VTEP/RLOC; extending inner VLANs on transit does not solve this. For the described design, the recurring risk arises from: the endpoint was placed into the wrong virtual network or external fusion routing bypasses isolation. The specific required safeguard is: audit endpoint-to-VN mapping and controlled inter-VN route leaks.

Fabric-edge encapsulation transports endpoint traffic, but by itself does not assign those endpoints to distinct virtual networks.

Maintaining a routed underlay that carries outer VXLAN reachability would not update or repair LISP endpoint registration and map-cache resolution for the new EID-to-RLOC binding.

Using the fabric control-plane node/LISP mapping service for endpoint-to-RLOC lookup rather than flooding every fabric edge would not update or repair LISP endpoint registration and map-cache resolution for the new EID-to-RLOC binding.

Using a fabric edge node that applies policy and VXLAN encapsulation for attached endpoint flows would not update or repair LISP endpoint registration and map-cache resolution for the new EID-to-RLOC binding.

This test measures a different behavior: Trace outer IP VTEP connectivity separately from inner host VLAN and VNIs. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check control-plane host-location registration and remote cached location after a move.

This test measures a different behavior: Check the endpoint registration and map resolution to the correct fabric edge RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check control-plane host-location registration and remote cached location after a move.

This test measures a different behavior: Inspect endpoint attachment on the edge and VXLAN forwarding toward the selected remote RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check control-plane host-location registration and remote cached location after a move.