500-470 Practice Questions

The key business value of TrustSec is operational simplification and scalability. With VLANs/ACLs, security policy is tied to IP addresses. If a user moves or an IP address changes, ACLs must be manually updated across numerous devices, which is complex, error-prone, and slow. TrustSec uses logical group tags (SGTs), so policy is defined based on user/device roles (e.g., 'Doctors can access Patient-Records'). This policy is independent of location or IP address and is managed centrally in ISE. This radically simplifies administration, enables faster security changes, and reduces the risk of misconfiguration.

A centralized control policy (specifically a topology policy or VPN membership policy) is often used to define which paths are preferred or available for certain traffic types across the entire fabric. It sets the high-level routing intent from the vSmart controller.

A centralized data policy is the enforcement mechanism that inspects the actual data packets. It would be configured to match the specific SCADA application traffic (based on IP, port, or DSCP) and then set an action to steer it exclusively to the TLOC (path) associated with the MPLS circuit (e.g., color 'mpls').

LISP is the core control plane protocol for the SD-Access fabric. Its primary job is to resolve the location of endpoints. It separates an endpoint's identity (EID - its IP or MAC address) from its location (RLOC - the IP address of the fabric edge switch it's connected to). The control plane nodes maintain this EID-to-RLOC mapping database, allowing endpoints to move anywhere in the fabric while keeping their IP address, enabling seamless mobility.

The Policy Service Node (PSN) is the ISE persona that hosts the guest portals and interacts with end-users. For the described workflow, a 'Self-Registered Guest Portal' must be configured. This portal type allows guests to create their own accounts, which can then be configured to send the generated credentials to the email address they provided during registration.

Application-Aware Routing (AAR) is the specific Cisco SD-WAN feature designed for this use case. It allows an administrator to define an SLA class with thresholds for latency, jitter, and loss. The AAR policy then steers specific applications (like voice) to paths that meet the SLA (like MPLS). If the preferred path fails to meet the SLA, the policy automatically and dynamically reroutes the traffic to a compliant secondary path. This is more precise than a data policy for performance-based routing.

The most effective method is to use a centralized data policy with a QoS map. This allows the administrator to classify the UCaaS application traffic (e.g., using DSCP markings), assign it to a high-priority forwarding class (like EF), and allocate a specific percentage of bandwidth, ensuring it is always serviced before lower-priority traffic like backups. While AAR steers traffic, it doesn't guarantee bandwidth on the chosen path. Localized policies are less scalable for fabric-wide QoS, and a Cflowd policy is for monitoring, not enforcement.

ISE Profiling is crucial for identifying what the device is (e.g., a Windows laptop, an iPhone) as soon as it connects. Based on this profile, an ISE Authorization Policy can redirect the device to the BYOD onboarding portal for registration.

The Authorization Policy is the enforcement mechanism. It contains rules that match on conditions (like the device profile or authentication status) and assigns a result, such as redirecting the user's web traffic to the BYOD portal to start the registration process.

The core value of a controller like Cisco DNA Center is its ability to act as a single source of truth for the entire network fabric. This centralization is what enables powerful capabilities like intent-based networking, automated provisioning of devices and services (e.g., VLANs, VRFs), consistent application of security policies (via ISE integration), and deep network visibility through Assurance. A controller-less architecture cannot provide this level of cohesive management and intelligence at scale.

This statement is false. The roles are reversed. The Identity Services Engine (ISE) is responsible for assigning the Security Group Tag (SGT) to a user or device based on authorization policies. Cisco DNA Center consumes these SGTs and uses them to build and push the corresponding Security Group Access Control Lists (SGACLs) to the fabric edge nodes for enforcement.

SD-Access uses a routed access design by default. To extend a Layer 2 broadcast domain across different edge nodes, a Layer 2 Virtual Network Identifier (L2 VNID) must be explicitly configured and stretched across the fabric. This creates a VXLAN-based L2 overlay, allowing devices in the same VLAN (and thus the same L2 VNID) to communicate as if they were on the same physical switch, which is necessary for non-routable heartbeat mechanisms.