Software Defined Infrastructure
SD-Access fabric
Cisco SD-Access separates the underlay (IS-IS, OSPF or BGP, often with a routed-access design) from the overlay. The overlay is VXLAN encapsulated data plane plus LISP control plane. Fabric edge nodes register endpoint EIDs with their RLOC (the edge's loopback) to the fabric control plane node via LISP map-register; a lookup is a map-request/map-reply. Fabric border nodes (internal, external, or anycast) hand traffic between the fabric and the outside. Identity services come from ISE: 802.1X/MAB authenticates the endpoint, ISE returns an SGT, and the SGT is carried in the VXLAN-GPO header so SGACLs can be enforced at the edge.
SD-WAN
Three control components: vManage (management/NMS), vSmart (OMP control plane and policy), vBond (orchestrator and NAT traversal). A TLOC is system-IP + color + encapsulation and is the SD-WAN equivalent of a next hop. OMP advertises routes with TLOC attributes, service VPN, and topology (hub-and-spoke, full mesh, partial mesh); BFD runs per tunnel with IPsec by default. Policies split into control, data, application-route and cflowd.
Traps
Candidates confuse LISP with the data plane - LISP is control plane only. Another common trap is assuming DNA Center and Catalyst Center are different products; they are the same platform, renamed. Watch for questions that ask which node holds the endpoint database (control plane node) versus which node forwards (edge/border).
Worked rule of thumb
If a scenario says "endpoints must be authenticated and grouped so policy follows the user, not the subnet", the answer is SD-Access with ISE-issued SGTs and SGACLs - not plain VLAN ACLs.