Free 500-490 sample questions

Correct answer: Emphasize that ISE is not just a NAC solution but a security policy platform that provides foundational context-sharing via pxGrid and enables advanced micro-segmentation with SD-Access, which future-proofs the investment.

The most effective defense is to elevate the conversation beyond a simple NAC feature comparison. While TCO and scalability are valid points, the core value of ISE lies in its role as a central policy engine for the entire security architecture. Highlighting its integration with SD-Access (TrustSec) and the broader security ecosystem via pxGrid demonstrates that ISE is a strategic investment that enables advanced security capabilities like zero-trust and micro-segmentation, which a basic NAC solution cannot provide.

Correct answer: Establish a dual-region design where each data center is the primary hub in its own region. Configure inter-region connectivity and use centralized policies to direct branches to their preferred regional hub while allowing failover to the secondary region.

A dual-region design provides the highest level of resiliency. By placing each data center in its own region, you create independent failure domains for the data plane and control plane within each region. This ensures that a failure event in one data center (or its associated region) does not impact the other. Centralized policies can then be crafted to steer traffic to the preferred regional hub based on SLA, with seamless failover to the secondary region's hub if the primary becomes unreachable or path quality degrades. This architecture isolates failures and provides robust business continuity.

Correct answers: The use of Scalable Group Tags (SGTs) decouples policy from network topology (IP addresses and VLANs), allowing policies to follow the user or device regardless of location.; SD-Access segmentation policies are centrally managed and visualized in DNA Center and ISE, drastically simplifying policy administration and auditing compared to managing thousands of individual ACLs.

This is a core value proposition. SGTs are based on identity and role, not network location. This means a single policy can be created (e.g., 'IoT devices cannot talk to Finance Servers') and it will be enforced everywhere in the fabric without needing to update hundreds of location-specific ACLs.

This addresses the customer's concern about simplicity. While the underlying technology is more advanced, the operational management is far simpler. A visual policy matrix in a central controller is much easier to understand, manage, and audit than spreadsheets of disparate ACLs applied to various interfaces across the network.

Correct answer: Enabling EID-Notify messages and configuring an appropriate registration interval for LISP.

In a large-scale, dynamic environment like a university campus, endpoints connect and disconnect frequently. LISP EID-Notify messages allow an Edge node to immediately inform the Control Plane node (Map-Server) when an endpoint disconnects. This prevents the Map-Server from having to wait for the registration timer to expire, purging the stale entry quickly and keeping the database clean and efficient. Properly tuning the registration interval is also important, but EID-Notify is the key mechanism for handling dynamic endpoint churn at scale.

Correct answer: Utilize the Cloud OnRamp for SaaS feature, select Microsoft 365, and show how vManage automatically probes all paths to the closest cloud gateways and dynamically selects the best-performing path based on a calculated vQoE score.

Cloud OnRamp for SaaS is the specific feature designed for this exact use case. It moves beyond simple path selection based on latency/jitter. It continuously measures the performance of all possible paths from each branch to the SaaS provider's front door and calculates a Quality of Experience (vQoE) score. Demonstrating this feature shows an intelligent, automated solution that actively finds and maintains the optimal path for critical SaaS applications, directly addressing the customer's requirement.

Correct answer: "Can you provide a list of all MAC addresses for these medical devices so we can create an endpoint identity group?"

Given that the devices lack 802.1X supplicants, the primary authentication method will be MAC Authentication Bypass (MAB). The first and most crucial step for a secure MAB implementation is to have a known list of valid MAC addresses. Asking for this list determines if a static endpoint group can be created, which is the most secure starting point for MAB. This allows ISE to authenticate known devices and deny unknown ones. Subsequent profiling can then be used to verify that the device connecting with a known MAC is, in fact, the correct type of medical device.

Correct answer: Zero Touch Provisioning (ZTP)

Zero Touch Provisioning (ZTP) is the feature specifically designed to simplify and automate the onboarding of new branch routers. With ZTP, a non-technical person at the store can simply plug in the router, which then automatically contacts the vBond orchestrator, authenticates itself, and downloads its full configuration from vManage. This eliminates the need for manual CLI configuration at each of the 500 stores, directly addressing the customer's requirement for simplified deployments with a small IT team.

Correct answer: False

This statement is false. The Control Plane node, which runs the LISP Map-Server/Map-Resolver, is responsible for dynamically advertising the aggregate EID prefixes into the external routing domain via BGP. The Border node provides the data plane exit/entry point for the fabric but does not handle the EID prefix advertisement itself; it learns external routes and advertises them into the fabric.

Correct answer: Policy Service Node (PSN)

The Policy Service Node (PSN) is the persona that handles all RADIUS and TACACS+ requests, making policy decisions for endpoints. To ensure high availability for authentication services, PSNs should be deployed geographically close to the endpoints they are serving. Placing a cluster of PSNs in each data center ensures that local network access devices have a low-latency, resilient connection for authentication requests, even if connectivity to other data centers is lost. The PAN and MnT personas would typically be centralized in a primary/secondary data center pair for management and logging.

Correct answer: Layer 2 VN Extension with L2 Flooding enabled

SD-Access is primarily a layer 3 routed fabric, which can be a problem for legacy devices that rely on layer 2 broadcasts or multicasts to discover each other. To support these devices, a specific Layer 2 Virtual Network (VN) must be created and configured for L2 flooding. This essentially creates a layer 2 broadcast domain that is tunneled over the layer 3 fabric underlay, providing the required adjacency for the legacy systems while still allowing them to be part of the overall fabric architecture.