Software-Defined Networking (SDN)

Software-Defined Networking separates the control plane, the logic that decides where traffic goes, from the data plane, the hardware that forwards it. In a conventional network every switch and router runs its own control plane; SDN centralises those decisions in a programmable controller that pushes forwarding rules down to simple devices via southbound APIs such as OpenFlow, while applications drive the controller through northbound APIs. The network becomes software: policy is written once and enforced everywhere at once.

The trade-off decides exam answers. Centralisation makes sweeping change cheap: micro-segmentation at workload granularity and the dynamic, identity-aware policies of zero trust are practical at scale precisely because SDN can reprogram the network in seconds. The same property concentrates risk: the controller is the highest-value target in the architecture, because compromising it means rewriting the forwarding behaviour of every device it manages. Controllers therefore demand hardened access, strong authentication on both API surfaces, and redundancy against failure.

Exam relevance: if a scenario separates the control plane from the data plane, or manages a network through a centralised programmable controller, the answer is SDN; if it asks for the architecture’s greatest risk, the answer is controller compromise. Contrast a VLAN, which reconfigures segmentation within traditional switching rather than changing who makes the forwarding decisions.