FHRPs (First Hop Redundancy Protocols like HSRP, VRRP, GLBP) provide gateway redundancy by allowing multiple routers to present a single virtual default gateway to hosts, ensuring continued connectivity if one router fails.
SSO (Stateful Switchover) enables failover within a single device, particularly between the active and standby supervisor modules in modular switches or routers, preserving forwarding and control plane state during a switchover.

According to this Cisco link (Table 5), the following ports are from Cisco DNA Center to fabric underlay switches:
+ TCP 22: From Cisco DNA Center to fabric switches' loopbacks for SSH
+ TCP 23: From Cisco DNA Center to fabric switches' loopbacks for TELNET
+ UDP 161: From Cisco DNA Center to fabric switches' loopbacks for SNMP device discovery
+ ICMP: From Cisco DNA Center to fabric switches' loopbacks for SNMP device discovery
+ TCP 443: From Cisco DNA Center to fabric switches for software upgrades (also to the internet if there is no proxy)
+ UDP 6007: From Cisco DNA Center to switches and routers for NetFlow
+ UDP 123: From Cisco DNA Center to fabric switches for the initial period during LAN automation So in fact there are three correct answers for this question, including TCP 23, ICMP and UDP
6007 but there are two best answers TCP 23 and ICMP (which match "fabric switches" in the question).
https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and- management/dna-center/2-1-
2/install_guide/2ndGen/b_cisco_dna_center_install_guide_2_1_2_2ndGen/m_plan_deployment_
2_1_2_2ndgen.html

Separation of Privilege: Granting permissions to an entity should not be purely based on a single condition, a combination of conditions based on the type of resource is a better idea.