500-470 Sample Questions & Answers

The core security concern of using public internet for sensitive data is addressed by the fundamental architecture of Cisco SD-WAN. The solution builds a secure VPN overlay using IPsec tunnels over any available transport (MPLS, broadband, LTE). This ensures that all data, regardless of the underlying carrier, is encrypted and secure, directly mitigating the customer's primary security concern about moving away from private MPLS.

Centralized control policies, including those for service chaining, are applied to a 'site list' from the perspective of the vSmart controller. The direction is critical: 'from-service' or 'from-tunnel' for traffic coming into the site from the overlay, and 'from-site' for traffic leaving the site. For service chaining, the policy is typically applied to a site list containing the spoke sites in the 'from-site' direction to redirect traffic towards the firewall at a hub site.

For devices that do not support 802.1X, ISE's primary visibility tool is the Profiler service. The engineer should demonstrate how ISE can be configured to use various probes (DHCP, RADIUS, SNMP, NMAP, etc.) to collect attributes from network traffic and devices. ISE then matches these attributes against pre-defined or custom profiles to identify the endpoint's type, manufacturer, and OS, providing the exact visibility the customer wants to see.

In a hierarchical (or multi-instance) Cisco DNA Center design, the primary or 'master' appliance is used for centralized design, policy creation, and global reporting. This master configuration is then synchronized down to the subordinate or 'regional' appliances. The subordinate appliances are responsible for the operational management of the devices within their specific geographic region, including provisioning, assurance, and local event handling. This model provides both centralized control and regional autonomy/scalability.

The vManage operational monitoring dashboard is the most powerful feature for demonstrating simplified troubleshooting. It provides an immediate, intuitive, and centralized view of the entire fabric's health. An engineer can quickly see the status of all control connections, identify underperforming sites or links, view application performance scores (QoE), and then drill down into specific devices or tunnels to get detailed statistics and logs. This centralized visibility drastically reduces the time it takes to isolate and resolve issues compared to logging into individual routers.

Zero Trust starts with knowing what is on the network. ISE Profiling provides the visibility to identify every device (staff laptop, patient phone, infusion pump) to make an informed policy decision.

To provide controlled and auditable access for patients, a secure Guest Access portal is essential. It allows for self-registration, credential delivery, and enforcement of an acceptable use policy.

After identifying and authenticating a device, TrustSec provides micro-segmentation by assigning a Security Group Tag (SGT). This allows the creation of granular policies (e.g., infusion pumps can only talk to specific servers), which is a cornerstone of Zero Trust enforcement.

The SD-Access Extended Node feature is designed for this exact scenario. It allows a compatible Catalyst switch (like a 9200 or 9300 series) at a remote site to connect back to a main campus fabric edge node over a Layer 3 connection. The extended node itself doesn't participate in the fabric control plane (LISP) but acts as a policy enforcement point, extending the fabric's VNs and SGTs to the remote branch without requiring a full fabric deployment at that site.

Cloud OnRamp for SaaS is the specific feature designed to optimize performance for well-known SaaS applications. It continuously probes the paths from the branch to the SaaS provider (e.g., Microsoft, Salesforce) over all available internet circuits. It then calculates a quality score (vQoE) for each path and automatically steers the SaaS traffic to the best-performing path in real-time, ensuring the best possible user experience without backhauling traffic to a data center.

This statement is false. In a distributed ISE deployment, the Policy Service Nodes (PSNs) are responsible for handling all RADIUS and other network access requests. The Primary Administration Node (PAN) is used for configuration, management, and policy distribution to the PSNs but does not actively process endpoint authentication traffic. This separation of roles allows the deployment to scale.

The Fabric Border Node is the gateway between the SD-Access fabric and any external network, including the internet, WAN, data center, or a legacy campus network. It handles the translation and routing between the fabric's overlay (LISP/VXLAN) and the traditional IP routing of the external world. In a migration scenario, the border node is critical for ensuring seamless communication between users in the new fabric and resources still residing on the old network.