Pass the Cisco Architecture Systems Engineer 500-470 Questions and answers with CertsForce

According to the Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers document1, the three Cisco recommendations on “How to Win” are:

Explain support for 3rd party network devices: Cisco ISE can integrate with more than 60 third-party solutions that span across security and network portfolios. This enablesCisco ISE to leverage the information and capabilities of these solutions to enhance the identity and access management, network visibility and segmentation, threat detection and response, and policy enforcement of the network. By explaining this support, the customer can see the value and flexibility of Cisco ISE in their existing or heterogeneous network environment2.

Explain architectural advantage of holistic Cisco solution: Cisco ISE is part of the Cisco Digital Network Architecture (DNA), which is a comprehensive and open platform that provides end-to-end network automation, assurance, security, and analytics. By explaining the architectural advantage of the holistic Cisco solution, the customer can see how Cisco ISE works seamlessly with other Cisco DNA components, such as Cisco DNA Center, Cisco SD-Access, Cisco SD-WAN, Cisco TrustSec, and Cisco Stealthwatch, to deliver a unified and consistent network experience across wired, wireless, and cloud domains3.

Talk about Cisco’s focus on Security and integration with StealthWatch, Sourcefire, WSA, vulnerability scanner to make smarter policy decisions: Cisco ISE is a core component of the Cisco security portfolio, which provides comprehensive and integrated security solutions for the network. By talking about Cisco’s focus on security and integration with other security products, such as StealthWatch, Sourcefire, WSA, and vulnerability scanner, the customer can see how Cisco ISE can provide enhanced visibility, threat detection, and policy enforcement for the network. For example, Cisco ISE can use the data from StealthWatch to identify anomalous or malicious behavior of the endpoints and apply appropriate network access policies based on the threat level4.

The other options, show case Cisco portfolio or ISE feature set during PoC and demonstrate complex policy flows, rather show case Wizards and enhanced context visibility, are not Cisco recommendations on “How to Win”. Showing case Cisco portfolio or ISE feature set during PoC is a general best practice, but not a specific recommendation for winning the customer. Demonstrating complex policy flows, rather than showing case Wizards and enhanced context visibility, is a counterproductive approach, as it can confuse or overwhelm the customer with technical details, rather than highlighting the benefits and simplicity of Cisco ISE. References := : 2: Cisco Identity Services Engine Administrator Guide, Release 2.7 - ISE Security Ecosystem Integration Guides [Cisco Identity Services Engine] - Cisco2, 1: Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers1, 3: Cisco Identity Services Engine - Cisco3, 4: Cisco Identity Services Engine Administrator Guide, Release 2.7 - Stealthwatch Integration [Cisco Identity Services Engine] - Cisco4

Syslog, FNF (Flexible NetFlow), and SNMP (Simple Network Management Protocol) are three technologies that can be deployed to gather data and provide insight into the network performance, health, and behavior. Syslog is a standard protocol for logging messages from network devices, such as routers, switches, firewalls, and servers. Syslog messages can be sent to a centralized server for analysis, correlation, and alerting. FNF is a Cisco technology that captures and exports information about network flows, such as source and destination IP addresses, ports, protocols, bytes, packets, and timestamps. FNF can be used to monitor network traffic patterns, identify anomalies, and optimize network resources. SNMP is a protocol that allows network devices to communicate with management systems, such as Cisco DNA Center. SNMP can be used to collect statistics, configuration, and status information from network devices, as well as to send commands and notifications. SNMP can help network administrators to troubleshoot, configure, and manage their network devices remotely. References: Cisco DNA Center User Guide, Release 1.3.1.0 - Monitor the Network 1, Cisco DNA Center User Guide, Release 1.3.1.0 - Configure Flexible NetFlow 2, Cisco DNA Center User Guide, Release 1.3.1.0 - Configure SNMP 3

A Digital Network is a network that is based on the Cisco Digital Network Architecture (Cisco DNA), which is an open and extensible, software-driven network architecture designed to rapidly deliver services that enable IT to innovate faster, reduce costs and complexity, lower risk, and comply with regulatory requirements1. A key function of a Digital Network is centralized provisioning, which allows IT to automate the deployment and configuration of network devices and services using a single platform, such as the Cisco DNA Center2. Centralized provisioning simplifies network management, reduces human errors, and accelerates network changes.

References:

 2: [Cisco DNA Software - Digital Network Architecture - Cisco] : 1: [Cisco Digital Network Architecture]

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/15-0_2_se

/configuration/guide/scg3750/sw8021x.pdf

The protocol that is used between an endpoint and a switch with an 802.1 authentication is EAP, which stands for Extensible Authentication Protocol. EAP is a framework that defines how the endpoint (also called the supplicant) and the switch (also called the authenticator) exchange authentication messages over a wired or wireless network. EAP supports various authentication methods, such as passwords, certificates, tokens, or biometrics, and can be encapsulated in different transport protocols, such as RADIUS, Diameter, or EAPOL. EAP is used in 802.1X authentication, which is a standard for port-based network access control that prevents unauthorized access to a network1.

The other options, TACACS, MAB, and RADIUS, are not protocols that are used between an endpoint and a switch with an 802.1 authentication. TACACS is a protocol that provides remote authentication and authorization for network devices, such as routers or switches, but it is not used for endpoint authentication. MAB is a technique that uses the MAC address of an endpoint as a credential for 802.1X authentication, but it is not a protocol itself. RADIUS is a protocol that provides centralized authentication, authorization, and accounting for network access, but it is not used directly between the endpoint and the switch, but rather between the switch and the authentication server1. References := : 2: What Is 802.1X Authentication? How Does 802.1x Work? - Fortinet2, 1: IEEE 802.1X - Wikipedia1

The current DNA-C 1.1 release supports the following wireless product families:

WLC 3504: This is a wireless LAN controller that provides centralized control, management, and troubleshooting for small to medium-sized enterprises and branch offices. It supports up to 150 access points and 3,000 clients, and offers high availability, scalability, and security features. It is compatible with Cisco DNA Center 1.1 and later releases1.

WLC 8540: This is a wireless LAN controller that provides centralized control, management, and troubleshooting for large enterprises and service providers. It supports up to 6,000 access points and 64,000 clients, and offers high performance, reliability, and flexibility. It is compatible with Cisco DNA Center 1.1 and later releases2.

AP 3800: This is an access point that delivers high-performance wireless connectivity for indoor and outdoor environments. It supports 802.11ac Wave 2 technology, multiuser multiple-input multiple-output (MU-MIMO), flexible radio assignment, and modular design. It is compatible with Cisco DNA Center 1.1 and later releases3.

References:

 1: [Cisco Wireless LAN Controller 3504 Data Sheet - Cisco] : 2: [Cisco 8540 Wireless Controller Data Sheet - Cisco] : 3: [Cisco Aironet 3800 Series Access Points Data Sheet - Cisco]

Cisco ISE integrates with more than 60 third-party solutions that span across security and network portfolios. These solutions include network access devices, firewalls, threat detection and prevention systems, vulnerability scanners, endpoint management platforms, cloud services, and more. By integrating with these solutions, Cisco ISE can leverage the information and capabilities of these solutions to enhance the identity and access management, network visibility and segmentation, threat detection and response, and policy enforcement of the network. Some of the examples of third-party solutions that integrate with Cisco ISE are:

Fortinet: Fortinet integrates with Cisco ISE through pxGrid to share user and device information, security group tags, and endpoint posture status. This enables Fortinet to apply granular and dynamic firewall policies based on the identity and context of the endpoints1.

Tripwire: Tripwire integrates with Cisco ISE through pxGrid to share vulnerability and compliance data of the endpoints. This enables Cisco ISE to apply appropriate network access policies based on the risk and compliance level of the endpoints2.

Splunk: Splunk integrates with Cisco ISE through REST APIs to collect and analyze the logs and events generated by Cisco ISE. This enables Splunk to provide network and security insights, dashboards, reports, and alerts based on the Cisco ISE data3.

References := : Cisco Identity Services Engine Administrator Guide, Release 2.7 - ISE Security Ecosystem Integration Guides [Cisco Identity Services Engine] - Cisco4, Solved: ISE Integration with 3rd party solution - Cisco Community1, ISE Security Ecosystem Integration Guides - Cisco Community5, Cisco Identity Services Engine Administrator Guide, Release 2.7 - Splunk Integration [Cisco Identity Services Engine] - Cisco3, Cisco Identity Services Engine Administrator Guide, Release 2.7 - Tripwire Integration [Cisco Identity Services Engine] - Cisco2

https://www.ciscolive.com/c/dam/r/ciscolive/apjc/docs/2017/pdf/BRKSEC-2141.pdf slide 9

Cisco ISE configuration capabilities include the following features:

ISE Deployment Assistant (IDA): This is a built-in application designed to accelerate the deployment of Cisco Identity Service Engine (ISE) by providing a guided workflow for configuring the most common ISE use cases, such as guest access, BYOD, and secure wired and wireless access1. IDA also provides validation checks, best practices, and troubleshooting tips to ensure a successful deployment.

Wireless Setup Wizard and Visibility Wizard: These are two of the several wizards that Cisco ISE provides to simplify the configuration of various ISE functions and features. The Wireless Setup Wizard helps to configure the wireless network settings, such as SSIDs, authentication methods, and policies, for secure wireless access2. The Visibility Wizard helps to enable the ISE profiling service, which collects and analyzes endpoint data to identify, classify, and monitor devices on the network3.

ISE Wizards and Pre-Canned Configurations: These are the tools that ease the ISE roll-out significantly by providing ready-made templates, policies, and settings for common ISE scenarios, such as posture assessment, device administration, and threat-centric NAC. These tools help to reduce the manual configuration efforts and errors, and speed up the time to value.

References:

 1: [Cisco Identity Services Engine Administrator Guide, Release 3.3 - ISE Deployment Assistant [Cisco Identity Services Engine]] : 2: [Cisco Identity Services Engine Administrator Guide, Release 3.3 - Wireless Setup Wizard [Cisco Identity Services Engine]] : 3: [Cisco Identity Services Engine Administrator Guide, Release 3.3 - Visibility Wizard [Cisco Identity Services Engine]] : : [Cisco Identity Services Engine Administrator Guide, Release 3.3 - ISE Wizards and Pre-Canned Configurations [Cisco Identity Services Engine]]

Cisco ISE configuration capabilities include the following features:

ISE Deployment Assistant (IDA) is a built-in application designed to accelerate the deployment of Cisco Identity Service Engine (ISE). IDA guides the user through the initial setup, configuration, and verification of ISE with a step-by-step wizard. IDA also provides best practices and recommendations for common deployment scenarios, such as wireless, wired, VPN, guest, and BYOD1.

Cisco ISE includes wireless setup wizard and visibility wizard. The wireless setup wizard simplifies the configuration of ISE for wireless access by automating the tasks of adding network devices, creating authorization profiles, and applying policies. The visibility wizard helps the user to enable device profiling and posture services, and to view the endpoint information and compliance status on the ISE dashboard2.

ISE wizards and per-canned configurations ease ISE roll-out significantly. ISE wizards are interactive tools that assist the user in configuring various features and functions of ISE, such as certificates, network access devices, authentication and authorization policies, guest access, BYOD, and TrustSec. Per-canned configurations are predefined templates that provide common settings and values for ISE components, such as policy sets, authorization profiles, and network conditions. The user can apply these templates to quickly configure ISE for specific use cases, such as 802.1X, MAB, or web authentication3.

The other options, Cisco Active Advisor and ISE command line, are not accurate descriptions of ISE configuration capabilities. Cisco Active Advisor is a separate cloud-based service that provides network health and security checks, device lifecycle management, and best practice recommendations for Cisco devices. It is not directly related to ISE deployments. ISE command line is an interface that allows the user to perform administrative tasks, such as backup and restore, password recovery, and troubleshooting. However, ISE does not require an understanding of the command line for set-up and configuration, as most of the functions can be done through the graphical user interface (GUI). References := : 1: ISE Deployment Assistant (IDA) - Cisco Identity Services Engine - Cisco, 2: Cisco Identity Services Engine Administrator Guide, Release 2.7 - Wireless Setup Wizard [Cisco Identity Services Engine] - Cisco, 3: Cisco Identity Services Engine Administrator Guide, Release 2.7 - ISE Wizards [Cisco Identity Services Engine] - Cisco, : Cisco Active Advisor - Cisco, : Cisco Identity Services Engine CLI Reference Guide, Release 2.7 - Using the Command-Line Interface [Cisco Identity Services Engine] - Cisco

Some of the statements that are true regarding Cisco SD-WAN license tiers are:

With Pro license, control and data policies are supported2. This license tier enables network operators to define and enforce policies for traffic shaping, quality of service (QoS), application optimization, and security2.

With Plus license, split-tunnel is supported3. This license tier enables network operators to use split-tunneling technology to route traffic through different paths based on application or user preferences3.

With Enterprise license, vAnalytics is included4. This license tier enables network operators to use vAnalytics feature to collect and analyze data from various sources such as endpoints, applications, devices, networks, and cloud services4.

https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/CVD-Software-Defined-Access-Design-Guide-2019SEP.pdf

References :=

Some possible references are:

Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers (ENSDENG) Study Guide

Cisco Identity Services Engine Administrator Guide, Release 2.7 - Configure Network Access Devices [Cisco Identity Services Engine]