A healthcare system deploys SD-Access across a hospital and two clinics, requiring wired endpoints to authenticate at access switches, reach servers in the data center, and resolve endpoint locations for roaming users. Which SD-Access fabric role assignment should the designer document for edge, border, and control plane functions?

SD-Access separates functions so fabric edge nodes provide first-hop onboarding, authentication, and encapsulation for wired and wireless endpoints, fabric border nodes connect the fabric to external networks such as data center, Internet, or WAN, and control plane nodes maintain the host tracking database mapping endpoint identity to locator for mobility and policy. Placing onboarding on borders and tracking on edges fails by concept because it reverses first-hop access and centralized location resolution. Placing onboarding on control plane nodes and external access on edges fails by concept because control plane nodes are a database and signaling function, not a forwarding edge or exit point. Collapsing all functions onto borders fails by concept because it defeats scaling and resiliency through role separation and overloads the exit point. For the exam, remember edge equals access, border equals exit, control plane equals map server, and a practical check is to verify edge-to-control-plane signaling and border handoff routes during roaming tests.