Library RFID scanners need segmentation inside an SD-Access fabric without first redesigning every classic access VLAN. What fabric capability primarily enables that outcome?
Select an answer to reveal the explanation.
Short Explanation
Classic VLANs are like painting every shelf a different color and hoping nobody mixes the books. Fabric is more like tagging each scanner with an identity badge and letting the control and data planes enforce the lanes in the overlay—so you are not forced to redraw every VLAN first.
Full Explanation
SD-Access segmentation for municipal endpoints such as library RFID scanners is driven by fabric control-plane and data-plane behavior, not by first redrawing every classic access VLAN. The control plane tracks endpoint identity and location mappings so the fabric knows who and where an endpoint is. The data plane overlay then forwards traffic according to virtual network and group-based policy. Together those planes let architects map identity-based groups into overlay segmentation, which is the ENCOR principle that reduces dependence on sprawling per-device access VLAN designs when scanners need isolation inside the fabric.
Replacing every RFID scanner with a Type 2 hypervisor on the same SSID confuses virtualization and wireless association with fabric policy. Hypervisors do not provide SD-Access group segmentation for physical scanners, and sharing an SSID does not create the identity-driven overlay lanes the question is asking about. Disabling CEF so scanners are process-switched into a single macro VLAN is operationally harmful and conceptually wrong: process switching is a slow CPU path, not a segmentation architecture, and collapsing scanners into one large VLAN works against isolation goals. Using only static HSRP priorities likewise fails the concept test—FHRP priority influences which gateway is active, not whether RFID traffic is segmented from other library workloads in a fabric overlay.
Exam caveat: distractors frequently recycle CEF, FHRP, or hypervisor vocabulary next to fabric questions. The discriminating idea is identity-and-overlay segmentation via fabric planes versus VLAN sprawl alone.
Operational check: verify that scanners receive the intended scalable group or virtual network assignment at onboarding, confirm control-plane mappings exist for those endpoints, and test that policy denies or permits paths between scanner groups and other library segments without requiring a full classic VLAN redesign first.