500-490 Designing Cisco Enterprise Networks (ENDESIGN) exam Questions and Answers

The overall health page of the assurance component in the Cisco DNA Center displays two primary categories:  Client  and  Network 1 .  The Client category shows the health score of all the wired and wireless clients connected to the network, along with the number of clients, the top issues affecting the clients, and the distribution of clients by type, OS, and SSID 1 .  The Network category shows the health score of all the network devices, such as switches, routers, wireless controllers, and access points, along with the number of devices, the top issues affecting the devices, and the distribution of devices by site, family, and role 1 .

The other options are not primary categories on the overall health page.  Server is not a category, but a type of client that can be filtered in the Client category 1 .  Access-Distribution and Core are not categories, but roles of network devices that can be filtered in the Network category 1 .  Wired is not a category, but a subcategory of the Client category that shows the health score of the wired clients only 1 .

References :

Cisco DNA Assurance User Guide, Release 1.3.1.0 - Monitor and Troubleshoot the Health of Your Network [Cisco DNA Center]

Designing Cisco Enterprise Networks (ENDESIGN) Exam Topics [Cisco]

Cisco Validated Design Guides [Cisco]

 A cloud-based SD-WAN deployment is a model of delivering SD-WAN services from the cloud, rather than from on-premises hardware or software appliances. A cloud-based SD-WAN deployment has several benefits, such as:

Instant scale: A cloud-based SD-WAN deployment can scale up or down the network resources and bandwidth on demand, without requiring additional hardware or manual configuration.  This enables the network to adapt to the changing traffic patterns and user demands, while optimizing the network performance and efficiency 1 2 .

Reduced costs: A cloud-based SD-WAN deployment can lower the capital and operational expenses of the network, by eliminating the need for expensive and complex WAN infrastructure, such as MPLS circuits, routers, firewalls, and WAN optimization devices.  A cloud-based SD-WAN deployment can also leverage the economies of scale and the pay-as-you-go model of the cloud, which can reduce the network costs per megabit 1 2 .

Simplified management: A cloud-based SD-WAN deployment can simplify the network management and operation, by providing a centralized and unified dashboard that can monitor, configure, and troubleshoot the network across multiple sites and regions.  A cloud-based SD-WAN deployment can also automate the network provisioning, orchestration, and optimization, by applying intelligent policies and analytics based on the business intent and network conditions 1 2 .

Enhanced security: A cloud-based SD-WAN deployment can enhance the network security and compliance, by providing built-in and integrated security features, such as encryption, firewall, VPN, IPS, and antivirus.  A cloud-based SD-WAN deployment can also leverage the cloud security services, such as SASE, to provide secure and direct access to the cloud applications and platforms, without compromising the network performance and user experience 1 2 3 .

Improved cloud readiness: A cloud-based SD-WAN deployment can improve the cloud readiness and agility of the network, by enabling seamless and optimized connectivity to the public cloud, SaaS, and cloud interconnect providers.  A cloud-based SD-WAN deployment can also support the multicloud and hybrid-cloud strategies, by allowing the network to operate as a cloud-native WAN overlay, using software-defined automation and orchestration tools 1 2 3 .

References :

What Is SD-WAN? - Software-Defined WAN (SDWAN) - Cisco

SD-WAN Benefits: 5 Business Advantages of SD-WAN - Fortinet

What are the Benefits of SD-WAN? - Cisco

What are the Benefits of SD-WAN?

SD-WAN and SASE: The new landscape of networking

https://salesconnect.cisco.com/sc/s/learning-activity-from-plan?ltui__urlRecordId=a0c8c00000P3hKMAAZ & ltui__urlRedirect=learning-activity-from-plan & ltui__parentUrl=

The Proactive Insights feature of Cisco DNA Center Assurance is a function that generates synthetic traffic to perform tests that raise awareness of potential network issues. This feature uses the Cisco DNA Center platform to create and schedule tests that simulate real user traffic and measure the network performance and user experience. The tests can be run on demand or periodically, and the results are displayed in the Cisco DNA Center dashboard.  The Proactive Insights feature helps network administrators to proactively identify and troubleshoot network issues before they affect the end users 1 2 .  References :

Cisco DNA Center Assurance User Guide, Release 2.1.2

Understanding Cisco DNA Center Assurance!

Cisco ISE is a security policy management platform that provides secure access to network resources.  Cisco ISE functions as a policy decision point and enables enterprises to ensure compliance, enhance infrastructure security, and streamline service operations 1 . Two of the statements that are true regarding Cisco ISE are:

ISE can detect endpoints whose addresses have been translated via NAT : Cisco ISE can discover, profile, and monitor the endpoint devices on the network, and classify them according to their associated policies and identity groups.  Cisco ISE can leverage the pxGrid framework to share the contextual information with other security tools and platforms, and enhance the network visibility and security 1 .  Cisco ISE can also detect endpoints whose addresses have been translated via NAT by using various methods, such as passive and active discovery, NMAP scanning, DHCP snooping, and RADIUS accounting 2 3 4 .

The number of logs that ISE can retain is determined by your disk space : Cisco ISE provides a logging mechanism that is used for auditing, fault management, and troubleshooting. The logging mechanism helps you to identify fault conditions in deployed services and troubleshoot issues efficiently.  You can configure your Cisco ISE node to collect the logs in the local systems using a virtual loopback address 5 .  The number of logs that ISE can retain is determined by your disk space, as well as the data purging settings that you can configure under Administration > System > Maintenance > Data Purging 6 .  You can also configure Cisco ISE to send its logs to a remote system for greater retention history 7 .

The other statements are not true regarding Cisco ISE, because:

In distributed deployments, failover from primary to secondary Policy Administration Nodes happens automatically : Cisco ISE supports high availability for the Administration persona, which provides centralized configuration and management of the distributed deployment. You can configure one primary Administration ISE node and one secondary Administration ISE node for high availability.  However, the failover from primary to secondary Policy Administration Nodes does not happen automatically, unless you enable the automatic failover feature and configure a health check node to monitor the primary node’s status 8 .  Otherwise, you have to manually promote the secondary node to become the primary node in case of a failure 9 .

In two-node standalone ISE deployments, failover must be done manually : Cisco ISE supports high availability for the Policy Service persona, which provides network access, posture, guest access, client provisioning, and profiling services. You can configure multiple Policy Service Nodes (PSNs) in a node group to provide session failover and load balancing for the endpoints.  In a two-node standalone ISE deployment, where each node assumes all the personas, the failover for the Policy Service persona does not need to be done manually, as long as the network access devices are configured to use both nodes for RADIUS and TACACS services 10 .

ISE supports IPv6 downloadable ACLs : Cisco ISE supports downloadable ACLs (DACLs), which are configured and implemented through authorization profiles. DACLs are used to enforce granular access control policies for the endpoints based on their identity and other attributes.  However, Cisco ISE does not support IPv6 downloadable ACLs, as it only supports IPv4 ACLs for RADIUS and TACACS protocols 11 12 .

References :

1 :  Cisco Content Hub - Cisco ISE Features   2 :  Cisco ISE Profiler Service Overview   3 :  ISE Deployment through NAT Boundaries - Cisco Community   4 :  Configure ISE 3.3 Native IPSec to Secure NAD (IOS-XE) Communication - Cisco   5 :  Logging [Cisco Identity Services Engine] - Cisco Systems   6 :  ISE maximum logging time / data retention - Cisco Community   7 :  Logs retention on ISE - Cisco Community   8 :  Cisco Identity Services Engine Administrator Guide, Release 2.4   9 :  Setting Up Cisco ISE in a Distributed Environment   10 :  Cisco Content Hub - Network Deployments in Cisco ISE   11 :  Cisco Identity Services Engine Administrator Guide, Release 2.2   12 :  Solved: ISE: support for IPv6 DACL’s - Cisco Community

"There is no automatic failover for the Administration persona." https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.html...Newer platforms and ISE versions appear to support ipv6 dacl just fine now

Cisco ISE is a security policy management platform that provides secure access to network resources.  Cisco ISE functions as a policy decision point and enables enterprises to ensure compliance, enhance infrastructure security, and streamline service operations 1 . Two of the primary functions of Cisco ISE are:

Enforcing endpoint compliance with network security policies : Cisco ISE can assess the posture of all endpoints that access the network, including 802.1X environments, and enforce the appropriate policies based on the device type, identity, location, and other attributes. Cisco ISE can also provide comprehensive client provisioning measures to ensure that the endpoints are compliant with the network security policies before granting them access.  Cisco ISE can also quarantine or remediate non-compliant endpoints to prevent potential threats or vulnerabilities 1 2 .

Providing information about every device that touches the network : Cisco ISE can gather real-time contextual information from networks, users, and devices, and use that information to make governance decisions and apply policies. Cisco ISE can also discover, profile, and monitor the endpoint devices on the network, and classify them according to their associated policies and identity groups.  Cisco ISE can also leverage the pxGrid framework to share the contextual information with other security tools and platforms, and enhance the network visibility and security 1 3 .

The other options are not primary functions of Cisco ISE, because:

Allocating resources : Cisco ISE does not allocate resources to the endpoints or the network devices.  Cisco ISE can assign services or access levels based on the policies, but not resources such as bandwidth, memory, or CPU 1 .

Enabling WAN deployment over any type of connection : Cisco ISE does not enable WAN deployment over any type of connection.  Cisco ISE can support VPN access for remote endpoints, but not WAN deployment for the network infrastructure 1 .

Automatically enabling, disabling, or reducing allocated power to certain devices : Cisco ISE does not automatically enable, disable, or reduce allocated power to certain devices.  Cisco ISE can control the access and authorization of the devices, but not their power consumption or management 1 .

Providing VPN access for any type of device : Cisco ISE does not provide VPN access for any type of device. Cisco ISE can authenticate and authorize the VPN access for the endpoints, but not provide the VPN service or connection itself.  Cisco ISE relies on other network devices, such as VPN gateways or routers, to provide the VPN access 1 .

References :

1 :  Cisco Content Hub - Cisco ISE Features   2 :  Cisco ISE Posture Service Overview   3 : [Cisco ISE Profiler Service Overview]

According to the Cisco SD-WAN vEdge Routers Data Sheet 1 , the Cisco vEdge 5000 router is the only model that offers 20 Gbps of encrypted throughput.  The vEdge 5000 router delivers highly secure site-to-site data connectivity to large enterprises, offers interface modularity, and supports up to 4 Network Interface Modules (NIMs) 2 .  The other models of vEdge routers have lower encrypted throughput capacities, as shown in Table 6 of the Ordering Guide for SD-WAN 3 .  The vEdge 1000 router has a maximum encrypted throughput of 1 Gbps, the vEdge 2000 router has a maximum encrypted throughput of 5 Gbps, and the vEdge 100 router has a maximum encrypted throughput of 100 Mbps 3 .

References :

1 :  Cisco SD-WAN vEdge Routers Data Sheet   2 :  vEdge 5000 Router   3 :  Ordering Guide for SD-WAN

1. vEdge-100: 100Mbps AES-256 throughput, with five fixed 10/100/1000 Mbps ports. Comes in three different flavors: ● vEdge 100b: Ethernet only ● vEdge 100m: Ethernet and integrated 2G/3G/4G modem ● vEdge 100wm: Ethernet and integrated 2G/3G/4G modem + Wireless LAN 2. vEdge-1000: 1 Gbps AES-256 throughput, with 8 ports of fixed GE SFP 3. vEdge-2000: 10 Gbps AES-256 throughput, with 2 Pluggable Interface Modules 4. vEdge-5000: 20 Gbps AES-256 throughput, with 4 Network Interface Modules

Cisco ISE can handle authentication for printers that do not have a supplicant using MAB (MAC Authentication Bypass). MAB is a method of authenticating devices based on their MAC address. MAB is useful for devices that do not support 802.1X or other authentication protocols, such as printers, cameras, or IoT devices. MAB works as follows:

The device sends an Ethernet frame with its MAC address as the source address.

The switch sends a RADIUS Access-Request message to ISE with the MAC address as the username and password.

ISE checks the MAC address against a database of known devices or an identity source sequence.

If the MAC address is found and authorized, ISE sends a RADIUS Access-Accept message to the switch with the appropriate authorization profile.

The switch applies the authorization profile to the device and grants it access to the network.

MAB is less secure than 802.1X, as MAC addresses can be spoofed or cloned. Therefore, MAB should be used with caution and combined with other security measures, such as profiling, posture, or endpoint protection. MAB should also be restricted to specific ports or VLANs that are isolated from the rest of the network.

References :

Cisco Identity Services Engine Administrator Guide, Release 2.7 - Configure MAC Authentication Bypass [Cisco Identity Services Engine]

Cisco Identity Services Engine Administrator Guide, Release 2.7 - Manage Authentication Policies [Cisco Identity Services Engine]

Cisco Identity Services Engine Administrator Guide, Release 2.7 - Manage Authorization Policies [Cisco Identity Services Engine]

Cisco Identity Services Engine Administrator Guide, Release 2.7 - Manage Identity Source Sequences [Cisco Identity Services Engine]

Cisco Identity Services Engine API Reference Guide, Release 2.7 - Authentication [Cisco Identity Services Engine]

Designing Cisco Enterprise Networks (ENDESIGN) Exam Topics [Cisco]

Cisco Validated Design Guides [Cisco]