500-490 Sample Questions & Answers

Given that the devices lack 802.1X supplicants, the primary authentication method will be MAC Authentication Bypass (MAB). The first and most crucial step for a secure MAB implementation is to have a known list of valid MAC addresses. Asking for this list determines if a static endpoint group can be created, which is the most secure starting point for MAB. This allows ISE to authenticate known devices and deny unknown ones. Subsequent profiling can then be used to verify that the device connecting with a known MAC is, in fact, the correct type of medical device.

Zero Touch Provisioning (ZTP) is the feature specifically designed to simplify and automate the onboarding of new branch routers. With ZTP, a non-technical person at the store can simply plug in the router, which then automatically contacts the vBond orchestrator, authenticates itself, and downloads its full configuration from vManage. This eliminates the need for manual CLI configuration at each of the 500 stores, directly addressing the customer's requirement for simplified deployments with a small IT team.

This statement is false. The Control Plane node, which runs the LISP Map-Server/Map-Resolver, is responsible for dynamically advertising the aggregate EID prefixes into the external routing domain via BGP. The Border node provides the data plane exit/entry point for the fabric but does not handle the EID prefix advertisement itself; it learns external routes and advertises them into the fabric.

The Policy Service Node (PSN) is the persona that handles all RADIUS and TACACS+ requests, making policy decisions for endpoints. To ensure high availability for authentication services, PSNs should be deployed geographically close to the endpoints they are serving. Placing a cluster of PSNs in each data center ensures that local network access devices have a low-latency, resilient connection for authentication requests, even if connectivity to other data centers is lost. The PAN and MnT personas would typically be centralized in a primary/secondary data center pair for management and logging.

SD-Access is primarily a layer 3 routed fabric, which can be a problem for legacy devices that rely on layer 2 broadcasts or multicasts to discover each other. To support these devices, a specific Layer 2 Virtual Network (VN) must be created and configured for L2 flooding. This essentially creates a layer 2 broadcast domain that is tunneled over the layer 3 fabric underlay, providing the required adjacency for the legacy systems while still allowing them to be part of the overall fabric architecture.

The Client 360 view provides the most direct and compelling demonstration for user-specific Wi-Fi issues. It visualizes the entire connectivity journey for a single client, showing detailed information about association, authentication, DHCP, and roaming events. It also highlights specific failures (e.g., slow DHCP, failed authentication) with AI-driven insights and suggested remediation steps. This directly addresses the customer's pain point by showing a powerful tool that can quickly pinpoint the root cause of an individual's poor Wi-Fi experience.

This is the standard and most efficient way to achieve service insertion for cloud security. A centralized data policy on vSmart can surgically identify only the internet-bound traffic. By using a 'service' action, it can redirect this traffic into a specific service VPN (e.g., VPN 0 or another transport VPN) where tunnels to the SASE provider are established. This forces all internet traffic through the security stack while allowing other traffic (e.g., branch-to-branch) to follow its normal path as defined by the topology, thus meeting both requirements.

ISE itself does not perform bandwidth shaping, but it can instruct the network access device (like a Wireless LAN Controller or switch) to do so. This is achieved by configuring an Authorization Profile in ISE. Within this profile, you can specify RADIUS attributes that map to a QoS policy or a per-user bandwidth limit defined on the WLC. When a guest authenticates, ISE sends these attributes as part of the RADIUS Access-Accept message, and the WLC enforces the bandwidth limitation, directly addressing the customer's requirement.

The best practice for a global deployment is to create a single, logical cluster of vSmart controllers that is physically distributed across the major geographical regions. This design provides both low-latency control plane connections (branches connect to their nearest vSmart) and high availability. All controllers in the cluster share the same domain ID and are aware of each other, but they operate as a single logical entity. This provides regional survivability without partitioning the network into separate fabrics, which would complicate policy and connectivity.

This is the strongest defense because it shifts the conversation from a simple feature-for-feature comparison to a discussion about effective, modern security architecture. While Cisco routers do have embedded security, the key differentiator is the seamless integration with a full SASE/SSE stack like Cisco Umbrella. This provides a far more robust security posture by offloading advanced inspection to the cloud, ensuring consistent policy enforcement for all users, and protecting against threats that a simple stateful firewall cannot. It reframes the competitor's 'simple' solution as 'inadequate' for the current threat landscape.