500-490 Designing Cisco Enterprise Networks exam Questions and Answers

Cisco SD-WAN vEdge routers can mitigate DoS attacks against the infrastructure by using two mechanisms:

• Only authorized controllers are allowed to communicate back to the vEdge router after the vEdge router establishes connection with the controllers. This means that the vEdge router initiates a secure connection to the vSmart controller and the vBond orchestrator using DTLS or TLS, and verifies their identity using certificates. The vEdge router does not accept any incoming connections from the controllers, and only responds to the messages that match the established sessions. This prevents unauthorized or malicious traffic from reaching the vEdge router and consuming its resources12.
• By default, all incoming traffic is denied at the transport (WAN) side interfaces. This means that the vEdge router applies an implicit deny-all policy to any traffic that arrives from the WAN side, unless it is explicitly allowed by a security policy. The security policy can be configured to permit only the traffic that matches certain criteria, such as source, destination, protocol, port, or application. This reduces the attack surface of the vEdge router and protects it from unwanted or harmful traffic34.

References:

• Cisco SD-WAN Security Features
• Cisco SD-WAN Design Guide
• Cisco SD-WAN Security Policy Configuration Guide
• Cisco SD-WAN vEdge Routers Denial of Service Vulnerability

 Cisco ISE benefits our customers by providing network access control and helping them stop and contain real-time threats. Network access control is the ability to enforce policies on who and what can access the network, based on the identity and context of users, devices, and applications. Cisco ISE allows customers to authenticate, authorize, and audit network access, as well as to segment and isolate network traffic based on security and compliance requirements. Cisco ISE also helps customers stop and contain real-time threats by leveraging intel from across the network and security ecosystem, and by automating threat response actions. Cisco ISE can integrate with various security solutions, such as Cisco Stealthwatch, Cisco Firepower, and Cisco Umbrella, to detect and mitigate attacks on the network quickly and effectively. References:

• Cisco Identity Services Engine (ISE) - Cisco1
• Cisco Identity Services Engine (ISE) - Cisco2
• Network Visibility and Segmentation (NVS) - Cisco3
• Rapid Threat Containment - Cisco4

 The current time in enterprise networking history is characterized by the rapid pace of change in the network technologies, architectures, and services. Some of the factors that contribute to this change are:

• The increasing demand for network performance, scalability, reliability, security, and agility from the business and end users.
• The emergence of new network paradigms, such as software-defined networking (SDN), network function virtualization (NFV), cloud networking, and intent-based networking (IBN).
• The proliferation of network devices, applications, and data sources, such as the Internet of Things (IoT), mobile devices, cloud services, big data, and artificial intelligence (AI).
• The evolution of network standards, protocols, and best practices, such as IPv6, 5G, Wi-Fi 6, Ethernet, and network automation.

These factors create new opportunities and challenges for enterprise network designers, engineers, and administrators, who need to keep up with the latest trends and innovations, and adapt their network solutions to the changing business and technical requirements.

References:

Cisco Enterprise Network Architecture and Design, https://www.cisco.com/c/en/us/solutions/design-zone/networking-design-guides/enterprise-networking-design.html 1 : Enterprise Networking Explained: Types, Concepts & Trends, https://www.bmc.com/blogs/enterprise-networking/ 2 : What is enterprise networking?, https://www.cloudflare.com/learning/network-layer/enterprise-networking/ 3 : Enterprise WAN – A Brief History, https://blogs.juniper.net/en-us/enterprise-cloud-and-transformation/enterprise-wan-a-brief-history 4

 The current digital business era is characterized by the rapid growth and adoption of digital technologies that enable companies to improve their business capabilities, operational efficiencies, and customer experiences. According to various sources, such as McKinsey1 and Forbes23, some of the key focus areas of the current digital business era are:

• IoT scale: The Internet of Things (IoT) refers to the network of physical devices, sensors, and machines that are connected to the internet and can communicate, collect, and exchange data. The IoT scale represents the massive amount and variety of data that are generated and processed by the IoT devices, as well as the potential value and insights that can be derived from them. The IoT scale also poses new challenges and opportunities for businesses, such as enhancing customer engagement, optimizing operations, creating new products and services, and ensuring security and privacy45.
• Automation: Automation refers to the use of technology to perform tasks or processes that would otherwise require human intervention or effort. Automation can increase productivity, efficiency, accuracy, and consistency, as well as reduce costs, errors, and risks. Automation can also enable businesses to scale up or down their operations, respond to changing customer demands, and innovate faster. Automation can be applied to various domains and functions, such as manufacturing, marketing, customer service, finance, and human resources6 .
• Connectivity: Connectivity refers to the ability to access, share, and exchange information and resources across different platforms, devices, and locations. Connectivity can enhance the communication and collaboration among businesses, customers, partners, and employees, as well as enable new business models and value propositions. Connectivity can also create new customer expectations and preferences, such as personalization, convenience, and speed. Connectivity can be enabled by various technologies, such as cloud computing, mobile devices, social media, and artificial intelligence .

References:

1: Digital strategy in the postpandemic era | McKinsey 2: The Business Benefits Of Living In The Most Digital Era Yet - Forbes 3: Why The Era Of Digital Transformation Is Important For … - Forbes 4: [What is IoT? How Smart Devices Impact Businesses in 2021] 5: [The Internet of Things: How IoT is changing the world - Forbes] 6: [What is Automation? Definition, Benefits, and Examples] : [How Automation Is Changing The Future Of Work - Forbes] : [What is Connectivity? Definition, Types, and Examples] : [How Connectivity Is Driving Business Transformation - Forbes]

If you are looking at a strategic win with a customer and the customer wants to examine Cisco ISE for longer than a few weeks, you should provide them with a downloadable POV kit. A POV kit is a proof of value kit that contains a pre-configured virtual machine of Cisco ISE with licenses, sample data, and documentation. A POV kit allows the customer to quickly and easily deploy and test Cisco ISE in their own environment, without requiring any hardware or installation. A POV kit can help the customer to evaluate the features and benefits of Cisco ISE, such as identity-based access control, device profiling, posture assessment, guest management, and threat mitigation12.

The other options are not suitable for a customer who wants to examine Cisco ISE for longer than a few weeks. Pointing them to our dCloud demo library, giving them our ISE YouTube videos, or giving them some of our flash files that can be played on any browser are good ways to introduce Cisco ISE to the customer, but they do not provide a hands-on experience or a realistic scenario of how Cisco ISE works in their network. Setting them up with a dCloud account or an account on a Cisco UCS server that hosts ISE are also possible ways to provide a demo or a trial of Cisco ISE, but they may have limitations on the duration, availability, scalability, or customization of the environment. A POV kit gives the customer more flexibility and control over their evaluation of Cisco ISE.

References :=

• Solved: ISE PoV licenses - Cisco Community
• Cisco Endpoint Security Analytics (CESA) Built on Splunk Quickstart POV Kit & Deployment Guide - Cisco Community

 The new operational paradigm is a way of designing, deploying, and managing networks that leverages the power of intent-based networking. Intent-based networking is a network architecture that aligns the network with the business goals and policies, and uses artificial intelligence and automation to translate the intent into network configurations and actions. The new operational paradigm requires three foundational elements:

• Fabric: A fabric is a network topology that consists of interconnected nodes that provide a consistent and scalable way of delivering network services and functions. A fabric can span across multiple domains, such as campus, branch, data center, and cloud, and can support multiple protocols, such as IP, Ethernet, MPLS, and VXLAN. A fabric enables the network to operate as a single entity, rather than a collection of disparate devices and links. A fabric also simplifies the network design and management, as it reduces the complexity and variability of the network elements and interfaces.
• Assurance: Assurance is the process of continuously monitoring, verifying, and optimizing the network performance and behavior, based on the defined intent and policies. Assurance uses telemetry, analytics, and machine learning to collect and process data from the network devices and applications, and to provide insights and recommendations for network optimization and troubleshooting. Assurance also enables the network to self-heal and self-optimize, by applying corrective actions and adjustments to the network configurations and policies, based on the feedback loop from the data and analytics.
• Policy-based automated provisioning of network: Policy-based automated provisioning of network is the process of applying the intent and policies to the network devices and services, using automation and orchestration tools. Policy-based automated provisioning of network abstracts the network complexity and heterogeneity, and allows the network operators to define the network requirements and outcomes in a high-level and declarative way, rather than specifying the low-level and imperative commands and parameters. Policy-based automated provisioning of network also enables the network to be agile and adaptive, as it can dynamically adjust the network configurations and policies, based on the changing network conditions and business needs.

References:

• Cisco Intent-Based Networking
• Cisco Digital Network Architecture
• Cisco Routed Optical Networking
• Cisco Operational Insights: A New Way of Seeing Operations

 The easiest way to enable SD-Access for all your remote sites after you have your campus SD-Access fabric up and running is to treat all the sites as one fabric domain and use SD-WAN as the underlay. This option has the following advantages:

• It simplifies the network design and management by using a single fabric domain for all the sites, which reduces the complexity of VRF and SGT mapping, and enables consistent policy enforcement across the network.
• It leverages the benefits of SD-WAN as the underlay, such as dynamic path selection, application-aware routing, WAN optimization, and security services, which improve the network performance, reliability, and security for the remote sites.
• It allows the remote sites to communicate with each other and with the campus fabric using the same SD-Access technology, which eliminates the need for additional protocols or devices to support the transit network.

References:

Cisco SD-Access Solution Design Guide (CVD) - Cisco1 : Cisco SD-Access – Connecting Multiple Sites in a Single Fabric Domain2 : What Is Software-Defined Access? - SD-Access - Cisco3 : How SD-WAN Enables Remote Network Access & Scalability4