SD-Access and ACI Fabric Similarities: VNIDs, Group Policy, and SGTs

300-420 By islever Editorial Last updated

Describe SD-Access Architecture (underlay, overlay, control and data plane, automation, wireless, and security)

Short answer

ACD SD-Access and ACI both use VNIDs for overlay segmentation, apply group-based policy, and enforce it with Scalable Group Tags (SGTs).

Question

Which three ways are SD-Access and ACI Fabric similar? (Choose three.)
  1. use of Virtual Network IDs Correct Answer
  2. use of Endpoint Groups
  3. use of group policy Correct Answer
  4. use of Scalable Group Tags Correct Answer
  5. focus on user endpoints

Key Takeaways

The shared DNA is overlay segmentation (VNID) + SGT-driven group policy. EPGs belong to ACI only; SD-Access uses Virtual Networks plus SGTs, not EPGs.

Both Cisco SD-Access and ACI fabrics use VXLAN with Virtual Network Identifiers (VNID) for overlay segmentation, express intent through group-based policy, and enforce that policy with Scalable Group Tags (SGTs). Endpoint Groups (EPGs) are ACI-specific and are not shared by SD-Access.

Common mistake: Picking B (Endpoint Groups): EPGs are an ACI construct; SD-Access does not use EPGs, so it is not a shared similarity. SGTs (D) are the common tag mechanism.

Expert Analysis

Why the Answer Is Correct

A, C, and D are correct. Both fabrics overlay VXLAN using Virtual Network Identifiers (VNID) to segment tenants/VRFs (A). Both express intent through group-based policy (C), and both implement that policy with Scalable Group Tags (SGT) carried in the fabric (D).

Why the Other Options Are Wrong

B (Endpoint Groups) is wrong: EPGs are an ACI-specific object; SD-Access uses Virtual Networks and SGTs, not EPGs, so it is not a shared similarity. E (focus on user endpoints) is too generic to be a defining architectural similarity tested here.

Community Comment Notes

Votes are split (AC vs AD) with no aggregate. The strongest reading: VNID (A), group policy (C), and SGT (D) are the three shared mechanisms; EPGs are ACI-only.

Official Reference

https://www.cisco.com/c/en/us/solutions/enterprise-networks/software-defined-access.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Spot the term 'Endpoint Groups' as an ACI-specific trap; it is not shared by SD-Access. Instead, look for 'Scalable Group Tags' (SGT) and 'group policy' which appear in both architectures alongside VNIDs.

Frequently Asked Questions

Are Endpoint Groups (EPGs) used in SD-Access?

No. EPGs are specific to Cisco ACI. SD-Access uses Virtual Networks and Scalable Group Tags (SGTs) instead.

Do both fabrics use VXLAN with VNIDs?

Yes. Both SD-Access and ACI overlay VXLAN using Virtual Network Identifiers (VNID) to segment tenants or VRFs.

More 300-420 FAQ →

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. TheGorn 👍 2
    Given the answer to 248, I'll go a,d,f.
  2. salmarin 👍 2
    I think ACI doesn't transport SGT
  3. cybman76 👍 1
    I think is A&C&F

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

POV Report Builds the Customer Platform During Discovery

S-grade

Advertising a Default Route from Core to Aggregation to Hide Instability

S-grade

SE Discovery Activities: Gather Current State and Map Innovation to Needs

S-grade

Shape Outbound and Police Inbound to Protect a 10 Mbps Link

S-grade

Practice All 300-420 Questions

Access 150 questions with complete answers and detailed explanations.

View Full 300-420 Practice Test →

← Back to 300-420 Study Guide