Free 500-470 sample questions

Correct answer: Cisco DNA Center's centralized controller architecture enables fabric-wide automation, consistent policy enforcement, and advanced analytics that are impossible to achieve in a distributed, controller-less model.

The core value of a controller like Cisco DNA Center is its ability to act as a single source of truth for the entire network fabric. This centralization is what enables powerful capabilities like intent-based networking, automated provisioning of devices and services (e.g., VLANs, VRFs), consistent application of security policies (via ISE integration), and deep network visibility through Assurance. A controller-less architecture cannot provide this level of cohesive management and intelligence at scale.

Correct answer: False

This statement is false. The roles are reversed. The Identity Services Engine (ISE) is responsible for assigning the Security Group Tag (SGT) to a user or device based on authorization policies. Cisco DNA Center consumes these SGTs and uses them to build and push the corresponding Security Group Access Control Lists (SGACLs) to the fabric edge nodes for enforcement.

Correct answer: Configuration of an L2 VNID extension across the fabric.

SD-Access uses a routed access design by default. To extend a Layer 2 broadcast domain across different edge nodes, a Layer 2 Virtual Network Identifier (L2 VNID) must be explicitly configured and stretched across the fabric. This creates a VXLAN-based L2 overlay, allowing devices in the same VLAN (and thus the same L2 VNID) to communicate as if they were on the same physical switch, which is necessary for non-routable heartbeat mechanisms.

Correct answer: The built-in, scalable VPN overlay that provides automatic IPsec encryption over any transport, including broadband internet.

The core security concern of using public internet for sensitive data is addressed by the fundamental architecture of Cisco SD-WAN. The solution builds a secure VPN overlay using IPsec tunnels over any available transport (MPLS, broadband, LTE). This ensures that all data, regardless of the underlying carrier, is encrypted and secure, directly mitigating the customer's primary security concern about moving away from private MPLS.

Correct answer: site list

Centralized control policies, including those for service chaining, are applied to a 'site list' from the perspective of the vSmart controller. The direction is critical: 'from-service' or 'from-tunnel' for traffic coming into the site from the overlay, and 'from-site' for traffic leaving the site. For service chaining, the policy is typically applied to a site list containing the spoke sites in the 'from-site' direction to redirect traffic towards the firewall at a hub site.

Correct answer: Endpoint Profiling using probes like DHCP, RADIUS, and NMAP.

For devices that do not support 802.1X, ISE's primary visibility tool is the Profiler service. The engineer should demonstrate how ISE can be configured to use various probes (DHCP, RADIUS, SNMP, NMAP, etc.) to collect attributes from network traffic and devices. ISE then matches these attributes against pre-defined or custom profiles to identify the endpoint's type, manufacturer, and OS, providing the exact visibility the customer wants to see.

Correct answer: The primary DNA Center holds the master copy of network design and policies, which are pushed down to subordinate appliances that manage the day-to-day operations of their local sites.

In a hierarchical (or multi-instance) Cisco DNA Center design, the primary or 'master' appliance is used for centralized design, policy creation, and global reporting. This master configuration is then synchronized down to the subordinate or 'regional' appliances. The subordinate appliances are responsible for the operational management of the devices within their specific geographic region, including provisioning, assurance, and local event handling. This model provides both centralized control and regional autonomy/scalability.

Correct answer: The operational monitoring dashboard that provides a single-pane-of-glass view of control connections, site health, and application performance with drill-down capabilities.

The vManage operational monitoring dashboard is the most powerful feature for demonstrating simplified troubleshooting. It provides an immediate, intuitive, and centralized view of the entire fabric's health. An engineer can quickly see the status of all control connections, identify underperforming sites or links, view application performance scores (QoE), and then drill down into specific devices or tunnels to get detailed statistics and logs. This centralized visibility drastically reduces the time it takes to isolate and resolve issues compared to logging into individual routers.

Correct answers: Endpoint Profiling and Visibility; Guest Access Portal; Cisco TrustSec for dynamic micro-segmentation.

Zero Trust starts with knowing what is on the network. ISE Profiling provides the visibility to identify every device (staff laptop, patient phone, infusion pump) to make an informed policy decision.

To provide controlled and auditable access for patients, a secure Guest Access portal is essential. It allows for self-registration, credential delivery, and enforcement of an acceptable use policy.

After identifying and authenticating a device, TrustSec provides micro-segmentation by assigning a Security Group Tag (SGT). This allows the creation of granular policies (e.g., infusion pumps can only talk to specific servers), which is a cornerstone of Zero Trust enforcement.

Correct answer: SD-Access Extended Node

The SD-Access Extended Node feature is designed for this exact scenario. It allows a compatible Catalyst switch (like a 9200 or 9300 series) at a remote site to connect back to a main campus fabric edge node over a Layer 3 connection. The extended node itself doesn't participate in the fabric control plane (LISP) but acts as a policy enforcement point, extending the fabric's VNs and SGTs to the remote branch without requiring a full fabric deployment at that site.