Free Cisco 350-401 Practice Exam with Questions & Answers | Set: 8

The correct answer is C. A point-to-point Layer 3 underlay network with jumbo frames enabled .

In Cisco SD-Access , the fabric is built on top of an underlay network . Cisco documentation states that the SD-Access underlay uses a structured Layer 3 foundation and a Layer 3 routed access design , where the network elements establish IP connectivity through routing rather than relying on Layer 2 adjacency. Cisco Catalyst Center LAN automation documentation also describes the underlay links as point-to-point Layer 3 routed connections .

This makes Option C the best answer because it matches the recommended SD-Access design approach:

Point-to-point Layer 3 links in the underlay

Routed access instead of Layer 2 campus meshing

Jumbo frames enabled to accommodate encapsulation overhead commonly associated with fabric technologies such as VXLAN in software-defined fabrics, which is a standard design consideration in Cisco fabric deployments.

Why the other options are incorrect:

A. A fully meshed Layer 2 topology This is not the SD-Access design model. Cisco SD-Access is not based on a campus-wide Layer 2 mesh; instead, it uses a routed Layer 3 underlay.

B. A fully meshed Layer 3 topology SD-Access does require Layer 3 underlay connectivity, but not a fully meshed Layer 3 topology . Cisco recommends a structured routed access design , not an every-device-to-every-device full mesh.

D. A point-to-point Layer 2 network with LACP between devices for redundancy This contradicts the SD-Access underlay principle. The underlay should be Layer 3 point-to-point , not Layer 2 point-to-point.

ENCOR exam point:

For Cisco SD-Access, remember this core design rule:

Underlay = routed, point-to-point, Layer 3 foundation

Overlay = virtualized fabric services on top of that underlay

The correct answer is B. Only the database can initiate communication.

From the exhibit:

ip nat inside source static 10.1.2.100 interface GigabitEthernet0/1

Inside local (DB): 10.1.2.100

Inside global (translated IP): 10.50.250.1 (Gi0/1 interface)

NAT type: Static NAT

Static NAT creates a permanent one-to-one mapping between inside local and inside global IP.

It allows bidirectional communication, but only if traffic is properly addressed.

The server initiates the connection

The server expects the DB to appear as 10.50.250.0/24 (translated network)

The server sends traffic to 10.50.250.1 (inside global IP).

The router translates:

Destination → 10.1.2.100 (DB) ✔️

DB receives the request and responds.

Return traffic is translated back to 10.50.250.1 ✔️

However:

The NAT rule only defines source translation for traffic originating from inside (DB).

It does not fully support proper session handling when initiated from outside unless routing/NAT symmetry is correct.

In this topology, the expectation and flow mismatch causes only inside-initiated sessions to work reliably.

The database (inside) can initiate connections outward using NAT ✔️

The server (outside) initiating may fail due to NAT direction and expectation mismatch ❌

A. Only the server can initiate communication Incorrect — NAT favors inside-initiated traffic.

C. No communication possible Incorrect — inside-initiated traffic still works.

D. Both can initiate communication Incorrect — would only be true with correct bidirectional NAT design.

Static NAT = bidirectional mapping, BUT

Always check:

Who initiates traffic

Which side is inside vs outside

Whether NAT rules match expected traffic flow

Exam trick:

If NAT is configured as inside source , it primarily supports inside → outside initiation.