Pass Your Cisco 350-401 Exam Easy!

That control reduces a separate risk: Its EID-to-RLOC registration is missing or incorrect in the fabric control plane. For the described design, the recurring risk arises from: the migration handoff and fabric border integration were omitted. The specific required safeguard is: keep legacy/fabric handoff addresses, VLANs, routes and policy boundaries in migration tests.

That control reduces a separate risk: No viable border handoff/routing policy connects the fabric virtual network to the external domain. For the described design, the recurring risk arises from: the migration handoff and fabric border integration were omitted. The specific required safeguard is: keep legacy/fabric handoff addresses, VLANs, routes and policy boundaries in migration tests.

That control reduces a separate risk: The required external DHCP relay or policy path was not integrated for migrated fabric endpoints. For the described design, the recurring risk arises from: the migration handoff and fabric border integration were omitted. The specific required safeguard is: keep legacy/fabric handoff addresses, VLANs, routes and policy boundaries in migration tests.

Using a fabric edge node that applies policy and VXLAN encapsulation for attached endpoint flows would not meet the need for resilient Layer 3 underlay adjacencies to carry overlay RLOC reachability between fabric devices.

Maintaining a routed underlay that carries outer VXLAN reachability would not meet the need for resilient Layer 3 underlay adjacencies to carry overlay RLOC reachability between fabric devices.

Using the fabric control-plane node/LISP mapping service for endpoint-to-RLOC lookup rather than flooding every fabric edge would not meet the need for resilient Layer 3 underlay adjacencies to carry overlay RLOC reachability between fabric devices.

This test measures a different behavior: Inspect endpoint attachment on the edge and VXLAN forwarding toward the selected remote RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check IPv4 routing neighbors and ECMP toward remote fabric RLOC addresses.

This test measures a different behavior: Check the endpoint registration and map resolution to the correct fabric edge RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check IPv4 routing neighbors and ECMP toward remote fabric RLOC addresses.

This test measures a different behavior: Trace outer IP VTEP connectivity separately from inner host VLAN and VNIs. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check IPv4 routing neighbors and ECMP toward remote fabric RLOC addresses.

That diagnosis is supported by a different symptom: An endpoint is reachable on its local edge but remote fabric edges cannot resolve its current location. Here the recorded observation is: vXLAN packets are dropped because the remote RLOC is absent from the underlay RIB. The applicable cause is: the device lacks routed underlay reachability rather than an end-user VLAN trunk.

That diagnosis is supported by a different symptom: The overlay fails even though a host VLAN is manually permitted on one spine-facing switchport. Here the recorded observation is: vXLAN packets are dropped because the remote RLOC is absent from the underlay RIB. The applicable cause is: the device lacks routed underlay reachability rather than an end-user VLAN trunk.

That diagnosis is supported by a different symptom: Remote traffic is bridged out an ordinary trunk rather than encapsulated through the fabric overlay. Here the recorded observation is: vXLAN packets are dropped because the remote RLOC is absent from the underlay RIB. The applicable cause is: the device lacks routed underlay reachability rather than an end-user VLAN trunk.

That control reduces a separate risk: The access switch was not functioning as an SD-Access fabric edge for that VLAN/virtual network. For the described design, the recurring risk arises from: the device lacks routed underlay reachability rather than an end-user VLAN trunk. The specific required safeguard is: validate underlay convergence and MTU independently of VN and SGT policy.

That control reduces a separate risk: Its EID-to-RLOC registration is missing or incorrect in the fabric control plane. For the described design, the recurring risk arises from: the device lacks routed underlay reachability rather than an end-user VLAN trunk. The specific required safeguard is: validate underlay convergence and MTU independently of VN and SGT policy.

That control reduces a separate risk: The routed underlay cannot reach the remote VTEP/RLOC; extending inner VLANs on transit does not solve this. For the described design, the recurring risk arises from: the device lacks routed underlay reachability rather than an end-user VLAN trunk. The specific required safeguard is: validate underlay convergence and MTU independently of VN and SGT policy.

The endpoint was placed into the wrong virtual network or external fusion routing bypasses isolation. The SGT mapping or group-based policy enforcement is missing even though the shared VN works.

The access switch was not functioning as an SD-Access fabric edge for that VLAN/virtual network. The SGT mapping or group-based policy enforcement is missing even though the shared VN works.

Its EID-to-RLOC registration is missing or incorrect in the fabric control plane. The SGT mapping or group-based policy enforcement is missing even though the shared VN works.

This test measures a different behavior: Check the endpoint registration and map resolution to the correct fabric edge RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: test a permitted and prohibited source/destination SGT pairing and inspect enforced policy matches.

This test measures a different behavior: Verify distinct VN/VNI assignments and the intended isolated forwarding tables for the two groups. It does not establish the target outcome. For the documented fault, the direct acceptance test is: test a permitted and prohibited source/destination SGT pairing and inspect enforced policy matches.

This test measures a different behavior: Inspect endpoint attachment on the edge and VXLAN forwarding toward the selected remote RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: test a permitted and prohibited source/destination SGT pairing and inspect enforced policy matches.

That diagnosis is supported by a different symptom: An endpoint is reachable on its local edge but remote fabric edges cannot resolve its current location. Here the recorded observation is: two endpoints in the same VN communicate although their security groups should be isolated. The applicable cause is: the SGT mapping or group-based policy enforcement is missing even though the shared VN works.

That diagnosis is supported by a different symptom: A guest endpoint unexpectedly reaches internal finance services across the campus. Here the recorded observation is: two endpoints in the same VN communicate although their security groups should be isolated. The applicable cause is: the SGT mapping or group-based policy enforcement is missing even though the shared VN works.

That diagnosis is supported by a different symptom: Remote traffic is bridged out an ordinary trunk rather than encapsulated through the fabric overlay. Here the recorded observation is: two endpoints in the same VN communicate although their security groups should be isolated. The applicable cause is: the SGT mapping or group-based policy enforcement is missing even though the shared VN works.

LISP endpoint location mapping does not provide the identity-based access matrix needed between groups in the same virtual network.

Assigning separate virtual networks solves a different segmentation problem; the scenario asks for group-specific controls within one virtual network.

That control reduces a separate risk: The access switch was not functioning as an SD-Access fabric edge for that VLAN/virtual network. For the described design, the recurring risk arises from: the SGT mapping or group-based policy enforcement is missing even though the shared VN works. The specific required safeguard is: audit tag propagation and policy matrix changes separately from VN-level routing.

Using the fabric control-plane node/LISP mapping service for endpoint-to-RLOC lookup rather than flooding every fabric edge would not route approved shared services through the fabric handoff with correct helper/service reachability and policy.

Using a fabric edge node that applies policy and VXLAN encapsulation for attached endpoint flows would not route approved shared services through the fabric handoff with correct helper/service reachability and policy.

Connecting the legacy campus to an appropriate fabric border or extended-node handoff with controlled routes and VLAN/service scope would not route approved shared services through the fabric handoff with correct helper/service reachability and policy.

This test measures a different behavior: Check the endpoint registration and map resolution to the correct fabric edge RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: confirm a new fabric endpoint receives DHCP and resolves DNS via the approved external service.

This test measures a different behavior: Inspect endpoint attachment on the edge and VXLAN forwarding toward the selected remote RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: confirm a new fabric endpoint receives DHCP and resolves DNS via the approved external service.

This test measures a different behavior: Verify legacy endpoint reachability through the handoff without unapproved cross-VN traffic. It does not establish the target outcome. For the documented fault, the direct acceptance test is: confirm a new fabric endpoint receives DHCP and resolves DNS via the approved external service.