500-490 Exam Dumps - Designing Cisco Enterprise Networks exam

Cisco DNA Assurance provides three key differentiators that our competitors are unable to match:

• Proactive approach to guided remediation: Cisco DNA Assurance uses AI and machine learning to analyze network data and provide insights on network performance, issues, and optimization. It also offers guided remediation options that automate the process of issue resolution and performance enhancement. This reduces manual troubleshooting operations and saves time and resources for network administrators12.
• Apple Insights: Cisco DNA Assurance integrates with Apple devices and applications to provide enhanced visibility and analytics on the user experience and network performance. It also leverages the Fast Lane feature to prioritize critical iOS and macOS traffic over the wireless network. This improves the quality of service and collaboration for Apple users and applications13.
• Network time travel: Cisco DNA Assurance allows network administrators to go back in time and view the network state and health at any given point. This enables them to identify the root cause of issues, compare network performance over time, and troubleshoot historical problems. This feature is unique to Cisco DNA Assurance and provides a powerful tool for network analysis and optimization1 .

References:

1: Cisco DNA Assurance: AI/ML guided IT operations (AIOps) At-a-Glance 2: Leveraging Cisco Intent-Based Networking DNA Assurance (DNAAS) 3: Cisco DNA Assurance Unlocking the Power of Data, page 39 : Cisco DNA Assurance Unlocking the Power of Data, page 74

The node that enables Cisco ISE to share contextual information on a device with Cisco Stealthwatch is the pXGrid Controller. The pXGrid Controller is a component of the ISE Policy Service Node (PSN) that facilitates the exchange of contextual data between ISE and other security products, such as Stealthwatch, via the Platform Exchange Grid (pxGrid) protocol. The pXGrid Controller acts as a broker that registers, authenticates, and authorizes pxGrid clients, and allows them to publish and subscribe to topics of interest. For example, Stealthwatch can subscribe to the Session Directory topic to obtain user and device information from ISE, and use it to enrich the network flow data and provide better visibility and security analytics. Stealthwatch can also publish topics, such as Rapid Threat Containment (RTC), to allow ISE to take mitigation actions on compromised endpoints, such as quarantine or re-authentication. References:

• Cisco Identity Services Engine Administrator Guide, Release 2.4 - Manage Platform Exchange Grid Services [Cisco Identity Services Engine] - Cisco1
• Deploying Cisco Stealthwatch 7.x with Cisco ISE 2.4 using pxGrid - Cisco Community2
• Stealthwatch — Networking fun3
• pxGrid in Depth > Sharing the Context | Cisco Press4

 The new operational paradigm is a way of designing, deploying, and managing networks that leverages the power of intent-based networking. Intent-based networking is a network architecture that aligns the network with the business goals and policies, and uses artificial intelligence and automation to translate the intent into network configurations and actions. The new operational paradigm requires three foundational elements:

• Fabric: A fabric is a network topology that consists of interconnected nodes that provide a consistent and scalable way of delivering network services and functions. A fabric can span across multiple domains, such as campus, branch, data center, and cloud, and can support multiple protocols, such as IP, Ethernet, MPLS, and VXLAN. A fabric enables the network to operate as a single entity, rather than a collection of disparate devices and links. A fabric also simplifies the network design and management, as it reduces the complexity and variability of the network elements and interfaces.
• Assurance: Assurance is the process of continuously monitoring, verifying, and optimizing the network performance and behavior, based on the defined intent and policies. Assurance uses telemetry, analytics, and machine learning to collect and process data from the network devices and applications, and to provide insights and recommendations for network optimization and troubleshooting. Assurance also enables the network to self-heal and self-optimize, by applying corrective actions and adjustments to the network configurations and policies, based on the feedback loop from the data and analytics.
• Policy-based automated provisioning of network: Policy-based automated provisioning of network is the process of applying the intent and policies to the network devices and services, using automation and orchestration tools. Policy-based automated provisioning of network abstracts the network complexity and heterogeneity, and allows the network operators to define the network requirements and outcomes in a high-level and declarative way, rather than specifying the low-level and imperative commands and parameters. Policy-based automated provisioning of network also enables the network to be agile and adaptive, as it can dynamically adjust the network configurations and policies, based on the changing network conditions and business needs.

References:

• Cisco Intent-Based Networking
• Cisco Digital Network Architecture
• Cisco Routed Optical Networking
• Cisco Operational Insights: A New Way of Seeing Operations

Cisco SD-WAN vEdge routers can mitigate DoS attacks against the infrastructure by using two mechanisms:

• Only authorized controllers are allowed to communicate back to the vEdge router after the vEdge router establishes connection with the controllers. This means that the vEdge router initiates a secure connection to the vSmart controller and the vBond orchestrator using DTLS or TLS, and verifies their identity using certificates. The vEdge router does not accept any incoming connections from the controllers, and only responds to the messages that match the established sessions. This prevents unauthorized or malicious traffic from reaching the vEdge router and consuming its resources12.
• By default, all incoming traffic is denied at the transport (WAN) side interfaces. This means that the vEdge router applies an implicit deny-all policy to any traffic that arrives from the WAN side, unless it is explicitly allowed by a security policy. The security policy can be configured to permit only the traffic that matches certain criteria, such as source, destination, protocol, port, or application. This reduces the attack surface of the vEdge router and protects it from unwanted or harmful traffic34.

References:

• Cisco SD-WAN Security Features
• Cisco SD-WAN Design Guide
• Cisco SD-WAN Security Policy Configuration Guide
• Cisco SD-WAN vEdge Routers Denial of Service Vulnerability

Cisco SDA is a network architecture that uses software-defined networking (SDN) principles to create a secure, scalable, and consistent network fabric across wired, wireless, and VPN connections. It also provides visibility, control, and automation for the network devices, endpoints, users, and applications. To demonstrate SDA effectively, it is important to follow some best practices and recommendations, such as1:

• Focus on business benefits: SDA delivers business outcomes such as improved network performance, reduced operational costs, increased security, and simplified compliance. By focusing on the business benefits of SDA, you can align the solution with the customer’s pain points and needs, and show how SDA can help them achieve their goals.
• Show the customer how to integrate ISE into DNA Center at the end of the demo: ISE is the policy engine that defines and enforces the network segmentation and access policies for SDA. DNA Center is the management platform that automates and orchestrates the SDA network. By showing the customer how to integrate ISE into DNA Center at the end of the demo, you can demonstrate the ease of use and configuration of SDA, and how the two products work together to provide a unified and secure network solution.

The other three options are not helpful for demonstrating SDA:

• Use the CLI to perform as much of the configuration as possible: SDA is designed to simplify and automate the network configuration and management, and to reduce the reliance on manual and error-prone CLI commands. By using the CLI to perform as much of the configuration as possible, you can undermine the value proposition and differentiation of SDA, and make the solution appear complex and tedious.
• Keep the demo at a high level: SDA is a comprehensive and diverse solution that covers various use cases, such as device management, asset visibility, software-defined segmentation, software-defined access, guest and wireless access, BYOD, posture assessment, threat detection and response, and more2. By keeping the demo at a high level, you can miss the opportunity to showcase the features and capabilities of SDA that are relevant and applicable for the customer’s use case, and to address their questions and concerns.
• Be sure you explain the major technologies such as VXLAN and LISP in depth: VXLAN and LISP are the underlying technologies that enable the data plane and control plane of SDA, respectively. They are responsible for encapsulating and forwarding the traffic, and mapping the endpoint identities and locations, within the SDA fabric3. While VXLAN and LISP are important for SDA, they are not the key selling points, because they are technical details that are abstracted and automated by SDA. By explaining the major technologies such as VXLAN and LISP in depth, you can confuse or bore the customer with technical details that are not essential for their use case, and divert their attention from the core benefits and features of SDA.

References:

Cisco Identity Services Engine (ISE) Use Cases2 : Software-Defined Access Overview Demo - Cisco1 : Software-Defined Access - Cisco4 : Cisco SD-Access Solution Design Guide (CVD) - Cisco3

Cisco ISE can handle authentication for printers that do not have a supplicant using MAB (MAC Authentication Bypass). MAB is a method of authenticating devices based on their MAC address. MAB is useful for devices that do not support 802.1X or other authentication protocols, such as printers, cameras, or IoT devices. MAB works as follows:

• The device sends an Ethernet frame with its MAC address as the source address.
• The switch sends a RADIUS Access-Request message to ISE with the MAC address as the username and password.
• ISE checks the MAC address against a database of known devices or an identity source sequence.
• If the MAC address is found and authorized, ISE sends a RADIUS Access-Accept message to the switch with the appropriate authorization profile.
• The switch applies the authorization profile to the device and grants it access to the network.

MAB is less secure than 802.1X, as MAC addresses can be spoofed or cloned. Therefore, MAB should be used with caution and combined with other security measures, such as profiling, posture, or endpoint protection. MAB should also be restricted to specific ports or VLANs that are isolated from the rest of the network.

References:

• Cisco Identity Services Engine Administrator Guide, Release 2.7 - Configure MAC Authentication Bypass [Cisco Identity Services Engine]
• Cisco Identity Services Engine Administrator Guide, Release 2.7 - Manage Authentication Policies [Cisco Identity Services Engine]
• Cisco Identity Services Engine Administrator Guide, Release 2.7 - Manage Authorization Policies [Cisco Identity Services Engine]
• Cisco Identity Services Engine Administrator Guide, Release 2.7 - Manage Identity Source Sequences [Cisco Identity Services Engine]
• Cisco Identity Services Engine API Reference Guide, Release 2.7 - Authentication [Cisco Identity Services Engine]
• Designing Cisco Enterprise Networks (ENDESIGN) Exam Topics [Cisco]
• Cisco Validated Design Guides [Cisco]

The Cisco vEdge platform supports IPv6 transport (WAN) as one of its features. This means that the vEdge routers can use IPv6 addresses to establish secure control and data plane connections with other vEdge routers over the WAN network. The vEdge routers can also use IPv6 addresses to communicate with the vSmart controllers and the vManage network management system. The vEdge routers can also support IPv6 routing protocols, such as OSPFv3 and BGP, to exchange IPv6 routes with other routers in the network12.

The other features listed in the question are not supported on the Cisco vEdge platform. License enforcement is not applicable to the vEdge routers, as they do not require any license to operate. Reporting is a function of the vManage network management system, which collects and displays various statistics and analytics from the vEdge routers. Non-Ethernet interfaces, such as serial, T1/E1, or DSL, are not available on the vEdge routers, which only support Ethernet and cellular interfaces. Single sign-on and 2-factor authentication are not supported on the vEdge routers, which use local or remote authentication methods, such as TACACS+, RADIUS, or LDAP3.

References:

1: Cisco SD-WAN vEdge Routers Data Sheet 2: Cisco SD-WAN Configuration Guide, Release 20.3 3: Cisco SD-WAN Command Reference, Release 20.3