500-220 Sample Questions & Answers

Systems Manager Sentry provides several key integrations. Sentry Policies enforce that only managed devices can connect to specific SSIDs. Furthermore, Sentry VPN automatically provisions and enables a VPN connection on the managed device back to a Meraki MX, ensuring that all traffic is tunneled through the corporate network for security inspection and policy enforcement, regardless of the device's location.

Action Batches are designed for automation and efficiency. They allow a developer to bundle multiple API actions (e.g., update 100 switch port configurations, create 5 new VLANs, bind a network to a template) into a single API request. The Dashboard then executes these actions asynchronously, which is ideal for large-scale or long-running configuration tasks without having to wait for each individual call to complete.

While the standard Meraki MS Enterprise License enables basic Layer 3 functionality like static routing, advanced features such as support for dynamic routing protocols (OSPF, BGP) require the MS Advanced License. This license tier unlocks the full routing capabilities of the switch hardware.

In a hub-and-spoke topology, all traffic from the spokes (retail stores) must pass through the central hub (datacenter) to reach other spokes or the internet. This architecture forces traffic through a central point, making it ideal for applying consistent security policies, content filtering, and threat inspection using the hub MX appliance before traffic proceeds to its destination.

For a simple guest network, 'Open' association is standard. 'Click-through' splash page meets the terms-of-service requirement. Most importantly, 'NAT mode' instructs the Meraki AP to act as a DHCP server and NAT gateway for guest clients. This isolates their traffic onto a separate subnet and sends it directly to the internet, completely bypassing the internal corporate network, which is a critical security practice for guest access.

Meraki Insight breaks down application performance into distinct segments. Low 'Local Network Delay' rules out the school's LAN, and low 'WAN Latency' rules out the internet connection path. A high 'Server Response Time' specifically indicates that the delay is occurring after the request has reached the application's hosting environment. This points directly to a problem with the server itself (e.g., overloaded CPU/memory) or the infrastructure within its datacenter.

By default, AWS EC2 instances perform a source/destination check, meaning they must be the source or destination of any traffic they send or receive. A vMX, acting as a router and VPN concentrator, needs to forward traffic on behalf of other devices (i.e., traffic where it is neither the source nor the destination). Disabling this check is a mandatory step to allow the vMX to perform its routing functions correctly within the VPC.

For SAML SSO to work, Meraki needs to know how to map the incoming identity from the IdP to a set of permissions. This is done by creating a SAML administrator role. In this role, the administrator specifies the attribute name from the IdP (in this case, 'username') and the value that will be sent (the user's email). This mapping tells the Dashboard, 'When a user logs in with this email in the username attribute, grant them these specific organization/network permissions.'

The rule needs to know what traffic to act upon. Meraki's Layer 7 application intelligence provides predefined categories, such as 'All peer-to-peer', which must be selected as the traffic signature.

The rule must specify the action to take. A per-client bandwidth limit ensures that each individual user is throttled, preventing one user from consuming the entire allocated pool of bandwidth for P2P traffic.

All traffic shaping rules must have a schedule. To apply the rule at all times, the 'All day' schedule must be selected.

The statement is false because Air Marshal containment can be performed by any Meraki AP that has an Ethernet connection to the network (i.e., gateway or repeater APs). It does not have to be the specific AP acting as the network gateway. APs in 'repeater' mode can also perform containment as long as they have a wired uplink.