Free 500-470 sample questions

Correct answer: Create a centralized data policy with a QoS map that classifies UCaaS traffic into a high-priority forwarding class with guaranteed bandwidth.

The most effective method is to use a centralized data policy with a QoS map. This allows the administrator to classify the UCaaS application traffic (e.g., using DSCP markings), assign it to a high-priority forwarding class (like EF), and allocate a specific percentage of bandwidth, ensuring it is always serviced before lower-priority traffic like backups. While AAR steers traffic, it doesn't guarantee bandwidth on the chosen path. Localized policies are less scalable for fabric-wide QoS, and a Cflowd policy is for monitoring, not enforcement.

Correct answers: ISE Profiling Service to identify the device type upon connection.; An ISE Authorization Policy that redirects unknown devices to a BYOD portal.

ISE Profiling is crucial for identifying what the device is (e.g., a Windows laptop, an iPhone) as soon as it connects. Based on this profile, an ISE Authorization Policy can redirect the device to the BYOD onboarding portal for registration.

The Authorization Policy is the enforcement mechanism. It contains rules that match on conditions (like the device profile or authentication status) and assigns a result, such as redirecting the user's web traffic to the BYOD portal to start the registration process.

Correct answer: Cisco DNA Center's centralized controller architecture enables fabric-wide automation, consistent policy enforcement, and advanced analytics that are impossible to achieve in a distributed, controller-less model.

The core value of a controller like Cisco DNA Center is its ability to act as a single source of truth for the entire network fabric. This centralization is what enables powerful capabilities like intent-based networking, automated provisioning of devices and services (e.g., VLANs, VRFs), consistent application of security policies (via ISE integration), and deep network visibility through Assurance. A controller-less architecture cannot provide this level of cohesive management and intelligence at scale.

Correct answer: False

This statement is false. The roles are reversed. The Identity Services Engine (ISE) is responsible for assigning the Security Group Tag (SGT) to a user or device based on authorization policies. Cisco DNA Center consumes these SGTs and uses them to build and push the corresponding Security Group Access Control Lists (SGACLs) to the fabric edge nodes for enforcement.

Correct answer: Configuration of an L2 VNID extension across the fabric.

SD-Access uses a routed access design by default. To extend a Layer 2 broadcast domain across different edge nodes, a Layer 2 Virtual Network Identifier (L2 VNID) must be explicitly configured and stretched across the fabric. This creates a VXLAN-based L2 overlay, allowing devices in the same VLAN (and thus the same L2 VNID) to communicate as if they were on the same physical switch, which is necessary for non-routable heartbeat mechanisms.

Correct answer: The built-in, scalable VPN overlay that provides automatic IPsec encryption over any transport, including broadband internet.

The core security concern of using public internet for sensitive data is addressed by the fundamental architecture of Cisco SD-WAN. The solution builds a secure VPN overlay using IPsec tunnels over any available transport (MPLS, broadband, LTE). This ensures that all data, regardless of the underlying carrier, is encrypted and secure, directly mitigating the customer's primary security concern about moving away from private MPLS.

Correct answer: site list

Centralized control policies, including those for service chaining, are applied to a 'site list' from the perspective of the vSmart controller. The direction is critical: 'from-service' or 'from-tunnel' for traffic coming into the site from the overlay, and 'from-site' for traffic leaving the site. For service chaining, the policy is typically applied to a site list containing the spoke sites in the 'from-site' direction to redirect traffic towards the firewall at a hub site.

Correct answer: Endpoint Profiling using probes like DHCP, RADIUS, and NMAP.

For devices that do not support 802.1X, ISE's primary visibility tool is the Profiler service. The engineer should demonstrate how ISE can be configured to use various probes (DHCP, RADIUS, SNMP, NMAP, etc.) to collect attributes from network traffic and devices. ISE then matches these attributes against pre-defined or custom profiles to identify the endpoint's type, manufacturer, and OS, providing the exact visibility the customer wants to see.

Correct answer: The primary DNA Center holds the master copy of network design and policies, which are pushed down to subordinate appliances that manage the day-to-day operations of their local sites.

In a hierarchical (or multi-instance) Cisco DNA Center design, the primary or 'master' appliance is used for centralized design, policy creation, and global reporting. This master configuration is then synchronized down to the subordinate or 'regional' appliances. The subordinate appliances are responsible for the operational management of the devices within their specific geographic region, including provisioning, assurance, and local event handling. This model provides both centralized control and regional autonomy/scalability.

Correct answer: The operational monitoring dashboard that provides a single-pane-of-glass view of control connections, site health, and application performance with drill-down capabilities.

The vManage operational monitoring dashboard is the most powerful feature for demonstrating simplified troubleshooting. It provides an immediate, intuitive, and centralized view of the entire fabric's health. An engineer can quickly see the status of all control connections, identify underperforming sites or links, view application performance scores (QoE), and then drill down into specific devices or tunnels to get detailed statistics and logs. This centralized visibility drastically reduces the time it takes to isolate and resolve issues compared to logging into individual routers.