500-470 Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers Questions and Answers

https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/software-defined-access/guide-c07-739242.pdf

 Cisco ISE is a comprehensive solution that provides authentication, authorization, and accounting (AAA) services, as well as posture, profiling, and guest access features. These are some of the key features that differentiate Cisco ISE from other RADIUS and NAC products in the market.

Ability to authenticate and authorize users and endpoints: Cisco ISE supports various authentication methods and protocols, such as 802.1X, MAB, WebAuth, EAP, PEAP, EAP-TLS, and TEAP. Cisco ISE also integrates with various identity sources, such as Active Directory, LDAP, RADIUS, SAML, and Azure AD. Cisco ISE can enforce granular and dynamic policies based on the identity and context of the users and endpoints, such as device type, location, posture, and time.  Cisco ISE can also leverage TrustSec and SGTs to provide software-defined segmentation and micro-segmentation 1 2 .

BYOD provides auto configuration of endpoints: Cisco ISE supports BYOD (Bring Your Own Device) scenarios, where users can register and onboard their personal devices to the network. Cisco ISE provides a self-service portal and a native supplicant provisioning tool that can automatically configure the endpoints with the required certificates, profiles, and settings.  Cisco ISE can also apply different policies for corporate and personal devices, and integrate with MDM (Mobile Device Management) solutions to enforce compliance and security 3 4 .

Guest access and guest lifecycle management functionality: Cisco ISE provides a comprehensive guest access solution that allows administrators and sponsors to create and manage guest accounts, and assign different access levels and privileges to guests. Cisco ISE also provides a customizable guest portal that can support various authentication methods, such as social media login, SMS, email, or self-registration. Cisco ISE can also monitor and audit the guest activities and sessions, and enforce expiration and revocation policies .

References :

:  Cisco ISE Features - Cisco

:  Cisco TrustSec Configuration Guide, Cisco IOS XE Gibraltar 16.12.x - TrustSec Overview [Cisco IOS XE 16] - Cisco

:  Cisco Identity Services Engine Administrator Guide, Release 2.7 - BYOD [Cisco Identity Services Engine] - Cisco

:  Cisco Identity Services Engine Administrator Guide, Release 2.7 - Mobile Device Management [Cisco Identity Services Engine] - Cisco

: [Cisco Identity Services Engine Administrator Guide, Release 2.7 - Guest Access [Cisco Identity Services Engine] - Cisco]

: [Cisco Identity Services Engine Administrator Guide, Release 2.7 - Guest Lifecycle Management [Cisco Identity Services Engine] - Cisco]

https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/Release_18.2/05Sec urity/01Security_Overview/Data_Plane_Security_Overview

 vEdge is the Cisco SD WAN component that provides a secure data plane with remote vEdge routers. vEdge routers are the devices that sit at the edge of the SD WAN fabric and connect to the WAN transports, such as MPLS, Internet, or LTE. vEdge routers establish secure IPsec tunnels with other vEdge routers in the fabric and exchange routing and policy information with the vSmart controller. vEdge routers also perform application-aware routing, QoS, and security functions on the data plane traffic.  vEdge routers can be physical or virtual devices and can be deployed in branch, campus, data center, or cloud environments 1 .

The other options, vBond, vSmart, and vManage, are not the components that provide a secure data plane with remote vEdge routers. vBond is the orchestrator that performs the initial authentication and authorization of vEdge routers and assigns them to a vSmart controller. vSmart is the controller that distributes the control and data policies and the network topology information to the vEdge routers.  vManage is the management platform that provides centralized configuration, monitoring, and troubleshooting of the SD WAN fabric 1 .  References  := :  1 : Cisco SD-WAN Getting Started Guide - Cisco SD-WAN Overview [Cisco SD-WAN] - Cisco

 Identity management is the practice of making sure that people and entities with digital identities have the right level of access to enterprise resources like networks and databases.  User roles and access privileges are defined and managed through an identity management system, such as Cisco Identity Services Engine (ISE) 1 . Identity management solves two customer problems:

Provides network visibility and security: Identity management allows customers to see who and what is on their network, and to control their access based on policies and context.  Identity management also integrates with other security solutions, such as Cisco Firepower, Cisco Stealthwatch, or Cisco Umbrella, to detect and respond to threats, and to enforce adaptive network access policies based on the threat level of the endpoints 2 .

Achieves dynamic and adaptive network segmentation: Identity management enables customers to segment their network based on the identity and context of the users and devices, rather than the IP addresses and VLANs. This allows customers to implement a zero-trust model, where only trusted users and devices can access the resources they need, and where the access policies can be dynamically updated based on the changing conditions and requirements.  Identity management also supports Cisco TrustSec, which is a technology that assigns scalable group tags (SGTs) to endpoints and enforces group-based policies (contracts) across the network 3 .

References :

  1 : [What Is Identity Access Management (IAM)? - Cisco

The 4D Training is a methodology that helps Systems Engineers and Field Engineers to understand and sell Cisco Enterprise Networks solutions, such as SD-Access, SD-WAN, and ISE.  The 4D stands for Discovery, Design, Demonstrate, and Defend 1 2 . These are the four phases of the sales cycle that the training covers, with each phase having specific objectives, activities, and outcomes.

Discovery: This phase involves identifying the customer’s needs, challenges, goals, and opportunities, as well as the current state of their network. The objective is to establish a trusted relationship with the customer and uncover their pain points and requirements. The activities include conducting interviews, surveys, assessments, and audits. The outcome is a clear understanding of the customer’s business and technical drivers, as well as their readiness and willingness to adopt Cisco solutions.

Design: This phase involves creating a high-level solution architecture that meets the customer’s needs and aligns with their vision. The objective is to demonstrate the value proposition and benefits of Cisco solutions, as well as the differentiation from the competition. The activities include developing use cases, scenarios, diagrams, and presentations. The outcome is a compelling and customized solution design that addresses the customer’s challenges and opportunities.

Demonstrate: This phase involves showing the capabilities and features of Cisco solutions in action, using live or simulated environments. The objective is to validate the solution design and showcase the advantages and benefits of Cisco solutions, as well as the ease of deployment and operation. The activities include conducting demos, proofs of concept, pilots, and trials. The outcome is a positive customer experience and feedback, as well as a confirmation of the solution fit and feasibility.

Defend: This phase involves addressing the customer’s objections, concerns, and questions, as well as overcoming any barriers or risks that may prevent the deal closure. The objective is to reinforce the value proposition and benefits of Cisco solutions, as well as the trust and credibility of Cisco as a partner. The activities include providing references, testimonials, case studies, and best practices. The outcome is a successful deal closure and customer satisfaction.

Therefore, the definition that is not part of the 4D Training is Deploy, which is not one of the four phases of the sales cycle that the training covers.

References :

  1 : [500-470 ENSDENG - Cisco] :  2 : [500-490 ENDESIGN - Cisco]

According to the Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers document 1 , the three Cisco recommendations on “How to Win” are:

Explain support for 3rd party network devices: Cisco ISE can integrate with more than 60 third-party solutions that span across security and network portfolios. This enables Cisco ISE to leverage the information and capabilities of these solutions to enhance the identity and access management, network visibility and segmentation, threat detection and response, and policy enforcement of the network.  By explaining this support, the customer can see the value and flexibility of Cisco ISE in their existing or heterogeneous network environment 2 .

Explain architectural advantage of holistic Cisco solution: Cisco ISE is part of the Cisco Digital Network Architecture (DNA), which is a comprehensive and open platform that provides end-to-end network automation, assurance, security, and analytics.  By explaining the architectural advantage of the holistic Cisco solution, the customer can see how Cisco ISE works seamlessly with other Cisco DNA components, such as Cisco DNA Center, Cisco SD-Access, Cisco SD-WAN, Cisco TrustSec, and Cisco Stealthwatch, to deliver a unified and consistent network experience across wired, wireless, and cloud domains 3 .

Talk about Cisco’s focus on Security and integration with StealthWatch, Sourcefire, WSA, vulnerability scanner to make smarter policy decisions: Cisco ISE is a core component of the Cisco security portfolio, which provides comprehensive and integrated security solutions for the network. By talking about Cisco’s focus on security and integration with other security products, such as StealthWatch, Sourcefire, WSA, and vulnerability scanner, the customer can see how Cisco ISE can provide enhanced visibility, threat detection, and policy enforcement for the network.  For example, Cisco ISE can use the data from StealthWatch to identify anomalous or malicious behavior of the endpoints and apply appropriate network access policies based on the threat level 4 .

The other options, show case Cisco portfolio or ISE feature set during PoC and demonstrate complex policy flows, rather show case Wizards and enhanced context visibility, are not Cisco recommendations on “How to Win”. Showing case Cisco portfolio or ISE feature set during PoC is a general best practice, but not a specific recommendation for winning the customer.  Demonstrating complex policy flows, rather than showing case Wizards and enhanced context visibility, is a counterproductive approach, as it can confuse or overwhelm the customer with technical details, rather than highlighting the benefits and simplicity of Cisco ISE.  References  := :  2 : Cisco Identity Services Engine Administrator Guide, Release 2.7 - ISE Security Ecosystem Integration Guides [Cisco Identity Services Engine] - Cisco 2 ,  1 : Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers 1 ,  3 : Cisco Identity Services Engine - Cisco 3 ,  4 : Cisco Identity Services Engine Administrator Guide, Release 2.7 - Stealthwatch Integration [Cisco Identity Services Engine] - Cisco 4

Some of the statements that are true regarding Cisco SD-WAN license tiers are:

With Pro license, control and data policies are supported 2 .  This license tier enables network operators to define and enforce policies for traffic shaping, quality of service (QoS), application optimization, and security 2 .

With Plus license, split-tunnel is supported 3 .  This license tier enables network operators to use split-tunneling technology to route traffic through different paths based on application or user preferences 3 .

With Enterprise license, vAnalytics is included 4 .  This license tier enables network operators to use vAnalytics feature to collect and analyze data from various sources such as endpoints, applications, devices, networks, and cloud services 4 .