Software-defined networking (SDN) — SY0-701

WHAT IT IS

Software-Defined Networking (SDN) is "a programmable networks approach that supports the separation of control and forwarding planes via standardized interfaces." (RFC 7426)

The key architectural shift: in a traditional network device, the logic that decides where traffic goes (control plane) and the hardware that actually moves traffic (forwarding plane) are bundled together inside the same box. SDN pulls those two functions apart so that software applications can program individual network devices dynamically and therefore control the behavior of the network as a whole.

RFC 7426 identifies three planes in an SDN architecture:

• Control plane — "the collection of functions responsible for controlling one or more network devices"; it instructs devices with respect to how to process and forward packets.
• Forwarding plane — "the collection of resources across all network devices responsible for forwarding traffic"; widely referred to as the data plane or data path.
• Management plane — "the collection of functions responsible for monitoring, configuring, and maintaining one or more network devices or parts of network devices."

Mental model

Think of a traditional router as a self-contained taxi driver who both reads the map and drives. SDN replaces that with a dispatch center (the SDN controller) that holds all the maps and radios instructions to drivers (forwarding-plane devices) that only know how to drive. The dispatch center communicates downward to devices via a southbound interface and upward to applications via a northbound interface.

When to use it

Scenario	SDN	Traditional (distributed) networking
Centralized, software-driven policy enforcement	Yes — control plane is centralized and programmable	No — each device holds its own control logic
Rapid, network-wide configuration changes	Yes — one controller pushes changes to all forwarding devices	Harder — must configure each device individually
Separation of concerns between policy and forwarding	Yes — planes are explicitly separated via standardized interfaces	No — control and forwarding are co-located in the same device
Security attack surface on the controller	Higher — a compromised controller affects the entire network	Lower — no single controller whose compromise cascades everywhere

The exam tests whether you can identify which SDN component is responsible for a described function. Know that the controller sits in the control plane, not the forwarding plane.

COMMON MISCONCEPTION

Candidates often assume that because SDN centralizes control, it is inherently more secure than traditional networking. This conflates manageability with security posture. Centralizing control in an SDN controller creates a high-value target: if the controller is compromised or unavailable, it can affect the behavior of the entire network's forwarding plane. RFC 7426 explicitly states that "security is paramount in networking; thus, it should be given full consideration when designing a network architecture or operational deployment." Centralization simplifies policy management but also concentrates risk — a trade-off the exam expects you to recognize.

A second trap: candidates confuse the management plane with the control plane. The control plane instructs devices on packet forwarding; the management plane handles monitoring, configuration, and maintenance of those devices. These are distinct functions in the RFC 7426 taxonomy.

How it shows up on the exam

The cognitive target is application — you will be given a scenario describing a network function and asked to classify it or identify the correct SDN component responsible. Signal phrases to watch for:

• "centrally managed" or "programmatically controlled" network — points toward SDN.
• "control plane" vs. "forwarding/data plane" — the exam may describe a function and ask which plane it belongs to.
• "single point of failure" or "single point of compromise" — a common misconception question framing SDN's centralized controller as either purely beneficial or purely risky; the correct answer acknowledges the trade-off.
• "standardized interfaces between planes" — the defining SDN characteristic per RFC 7426.

Candidates who memorize SDN as simply "software controls the network" often miss the architectural specifics: the separation of planes and the standardized interfaces between them are the defining features that generate exam-testable distinctions.

Architecture overview

The controller mediates between applications above and forwarding devices below via standardized interfaces. The management plane operates across both layers.

Related concepts

• Cloud Architecture Models — SDN principles underpin how cloud providers abstract and virtualize network resources across tenants.
• Shared Responsibility Model — When SDN is deployed in a cloud environment, understanding which party controls the SDN controller versus the forwarding layer is essential for assigning security responsibilities.
• Infrastructure as Code — SDN's programmable interfaces make network configuration expressible as code, enabling version-controlled, repeatable network policy deployment.