Free 300-820 sample questions

Correct answer: Best effort

The 'Best effort' mode is the optimal choice in this scenario. It attempts to establish an encrypted SRTP call first, satisfying the security policy for all capable partners. If the remote party (the legacy H.323 system) does not support SRTP, Expressway will allow the call to proceed with unencrypted RTP. 'Force encrypted' would block the call to the legacy partner. 'Force unencrypted' would violate the security policy for all other partners. 'Auto' is a valid option but 'Best effort' is more explicit about preferring encryption while allowing fallback.

Correct answer: The external firewall (Firewall-EXT) is blocking inbound UDP traffic for the RTP media range to the Expressway-E.

Successful registration and presence indicate that the signaling path (typically TCP) is working correctly. The absence of audio/video points to a problem with the media path (RTP/SRTP), which uses UDP. The most common cause for this specific symptom in an MRA deployment is the external firewall blocking the inbound UDP port range required for media to reach the Expressway-E from the internet. A missing SRV record or certificate issue would typically cause registration to fail entirely.

Correct answers: A neighbor zone configured for H.323; The 'Interworking mode' setting enabled on the Expressway

A neighbor zone for H.323 is required to establish a peering relationship with the H.323 Gatekeeper or endpoints.

The global 'Interworking mode' setting must be turned on (set to On) to allow the Expressway to translate calls between H.323 and SIP.

Correct answer: 9[0-9]{7}

In Expressway regular expressions, the pattern '9[0-9]{7}' correctly matches the literal digit '9' followed by exactly seven digits (any number from 0 to 9). While '9\d{7}' is a common regex syntax in other systems, Expressway often prefers the more explicit '[0-9]'. '9.{7}' would match '9' followed by any seven characters, not just digits. The parentheses in '(9\d{7})' create a capture group, which is not necessary for a simple match pattern.

Correct answer: False

This statement is false. In an Expressway cluster, licenses are shared across all nodes. A single Rich Media Session license is consumed for each active MRA registration, regardless of which node in the cluster the user is registered to. The license pool is managed centrally for the entire cluster.

Correct answer: Back up only the primary (master) node; this single backup file contains the entire cluster's replicated configuration.

In an Expressway cluster, the configuration database is replicated from the primary (master) node to all other peer nodes. Therefore, performing a backup operation on the primary node is sufficient to capture the complete configuration for the entire cluster. This single backup file can be used to restore the configuration to the primary node, which will then replicate it to the other nodes upon re-clustering.

Correct answer: A single LAN interface with a private IP address, using Static NAT on the firewall for external access.

The recommended and most common configuration for an Expressway-E in a DMZ is to use a single LAN interface with a single private IP address. The external firewall then performs Static 1:1 NAT to map a public IP address to the Expressway-E's private IP. This configuration simplifies routing and enhances security by not exposing the server's real IP address directly to the internet. The Expressway-E must be configured to be NAT-aware in this setup.

Correct answer: Create a series of search rules with high priority to match and route calls for each partner domain to the 'B2B_Partners' zone. Then, create a final search rule with the lowest priority that matches all patterns (.*) and has a target zone of 'Stop'.

This solution creates an explicit 'allow list' and a default 'deny' policy, which is a highly effective method for toll fraud prevention without CPL. The high-priority rules explicitly permit calls to known partners by routing them to the correct zone. The final, low-priority 'catch-all' rule (matching '.*') ensures that any call not matching a specific partner rule is stopped immediately. This directly prevents unauthorized calls to any other destination, fulfilling the CISO's requirement.

Correct answers: On the Expressway-C neighbor zone to UCM, set the 'TLS verify mode' to 'On'.; On the UCM SIP Trunk Security Profile, set the 'Device Security Mode' to 'Encrypted'.; On the UCM SIP Trunk Security Profile, configure the 'Incoming Port' to 5061.

Setting the TLS verify mode to 'On' on the Expressway-C's neighbor zone forces it to validate the UCM's certificate, which is essential for a secure connection.

This setting on the UCM security profile mandates that signaling for this trunk must be encrypted using TLS.

Port 5061 is the standard port for SIP over TLS (secure SIP). The UCM must be configured to listen for secure connections on this port.

Correct answer: nslookup -q=srv _collab-edge._tls.company.com

The `nslookup -q=srv _collab-edge._tls.company.com` command is used to query the public DNS for the specific SRV record that Jabber and other MRA clients use to discover the Expressway-E server. A successful response to this query is the first critical step in the MRA registration process. The _cisco-uds record is for internal service discovery, not external MRA.