500-490 Practice Questions

The underlay must provide resilient layer 3 connectivity from every edge node back to the border and control plane nodes. Understanding the physical layout, including cable paths and locations of wiring closets, is essential for designing a robust routed access layer and ensuring there are redundant paths.

Hardware compatibility is paramount. The underlay devices must support the necessary features (like VXLAN and a modern routing protocol) and have sufficient resources to function as fabric nodes. An inventory of existing hardware is a mandatory first step.

This component directly addresses the antivirus requirement. The posture policy uses an agent on the endpoint to assess its compliance with predefined rules, such as checking for specific AV products and ensuring definitions are current.

This is the first step. The device's identity must be verified. Using 802.1X (PEAP or EAP-TLS) against Active Directory confirms the machine is a trusted, domain-joined asset.

This is where the logic is enforced. After authentication and posture assessment, the Authorization Policy makes the final decision. It will have rules like 'IF (PostureStatus == Compliant) THEN PERMIT (Full_Access_Profile)' and 'IF (PostureStatus == NonCompliant) THEN PERMIT (Remediation_Profile)'. The remediation profile contains the URL redirect attribute.

This is the strongest, most collaborative defense. Instead of arguing which tool is better, it positions ISE as the essential integration layer. The response acknowledges the value of the customer's existing tools (EPP) and shows how ISE enhances their investment. ISE, through pxGrid, can subscribe to the rich context from the EPP and then translate that information into network enforcement (like changing a VLAN or applying an SGT). This demonstrates ISE's unique role as the policy enforcement point that bridges the gap between endpoint security and network infrastructure.

This combination directly meets the requirements. 'Open' authentication mode allows devices to connect to the network without passing 802.1X or MAB. However, by associating a default SGT (e.g., 'Dorm_User') with these ports, every device that connects is automatically tagged with that SGT. This allows the security team to write TrustSec policies in ISE (e.g., 'Dorm_User' cannot access 'Admin_Servers') that apply to all these devices, providing policy-based segmentation without requiring explicit authentication.

This is the standard and correct defense for this architecture. The diagram is a logical representation. In practice, the 'Transit VPC/VNet' is not a single device. The Cloud OnRamp for IaaS solution automates the deployment of redundant Cisco Catalyst 8000V routers across multiple Availability Zones (AZs) within the cloud provider's region. This provides high availability against an AZ failure. All on-prem sites build tunnels to both 8000V instances, ensuring seamless failover.

The most effective defense is to elevate the conversation beyond a simple NAC feature comparison. While TCO and scalability are valid points, the core value of ISE lies in its role as a central policy engine for the entire security architecture. Highlighting its integration with SD-Access (TrustSec) and the broader security ecosystem via pxGrid demonstrates that ISE is a strategic investment that enables advanced security capabilities like zero-trust and micro-segmentation, which a basic NAC solution cannot provide.

A dual-region design provides the highest level of resiliency. By placing each data center in its own region, you create independent failure domains for the data plane and control plane within each region. This ensures that a failure event in one data center (or its associated region) does not impact the other. Centralized policies can then be crafted to steer traffic to the preferred regional hub based on SLA, with seamless failover to the secondary region's hub if the primary becomes unreachable or path quality degrades. This architecture isolates failures and provides robust business continuity.

This is a core value proposition. SGTs are based on identity and role, not network location. This means a single policy can be created (e.g., 'IoT devices cannot talk to Finance Servers') and it will be enforced everywhere in the fabric without needing to update hundreds of location-specific ACLs.

This addresses the customer's concern about simplicity. While the underlying technology is more advanced, the operational management is far simpler. A visual policy matrix in a central controller is much easier to understand, manage, and audit than spreadsheets of disparate ACLs applied to various interfaces across the network.

In a large-scale, dynamic environment like a university campus, endpoints connect and disconnect frequently. LISP EID-Notify messages allow an Edge node to immediately inform the Control Plane node (Map-Server) when an endpoint disconnects. This prevents the Map-Server from having to wait for the registration timer to expire, purging the stale entry quickly and keeping the database clean and efficient. Properly tuning the registration interval is also important, but EID-Notify is the key mechanism for handling dynamic endpoint churn at scale.

Cloud OnRamp for SaaS is the specific feature designed for this exact use case. It moves beyond simple path selection based on latency/jitter. It continuously measures the performance of all possible paths from each branch to the SaaS provider's front door and calculates a Quality of Experience (vQoE) score. Demonstrating this feature shows an intelligent, automated solution that actively finds and maintains the optimal path for critical SaaS applications, directly addressing the customer's requirement.