Free 500-470 Questions Attempt

 A WAN design is a plan for how to connect multiple sites or locations over a wide area network (WAN). A WAN design can have various benefits, depending on the goals and requirements of the organization. Two of the possible benefits from a WAN design are:

• Ensure remote site uptime: A WAN design can help to ensure that remote sites or branches have reliable and consistent connectivity to the central site or the cloud. This can improve the availability and performance of critical applications and services, such as voice, video, collaboration, and data backup. A WAN design can also provide redundancy and resiliency in case of network failures or disasters, by using multiple WAN links, backup routes, or failover mechanisms. For example, SD-WAN is a WAN design that uses software to dynamically route traffic over the best available WAN link, based on the network conditions and the application requirements1.
• Prioritize and secure with granular control: A WAN design can also help to prioritize and secure the traffic and applications that flow over the WAN. This can enhance the quality of service (QoS) and the security of the network. A WAN design can use various techniques, such as traffic shaping, policy-based routing, encryption, firewall, or VPN, to classify, prioritize, and secure the WAN traffic according to the business needs and the security policies. For example, TrustSec is a WAN design that uses software-defined segmentation to enforce granular access policies based on the identity and context of users, devices, and applications2.

The other options, provide lower quality service to guest users, reduce cost and increase operational complexity, and lower circuit bandwidth requirements, are not benefits from a WAN design. Providing lower quality service to guest users is not a desirable outcome, as it can affect the user experience and the reputation of the organization. Reducing cost and increasing operational complexity is a trade-off that may not be worth it, as it can create more challenges and risks for the network management and maintenance. Lowering circuit bandwidth requirements is not a benefit in itself, but a means to achieve other benefits, such as reducing cost or improving performance. A WAN design should aim to optimize the bandwidth utilization and allocation, rather than simply lowering it. References := : 1: Cisco SD-WAN Solution Design Guide (CVD) - Cisco1, 2: Cisco TrustSec Solution Overview - Cisco

Cisco ISE is a network access control solution that uses policy-based decision making to determine if a device is allowed access to the network and, if allowed, what level of access this device is given1.Cisco ISE can also provide authentication, authorization, and accounting (AAA) through the RADIUS protocol and device administration through TACACS+ service1.

Some of the use cases of Cisco ISE are:

• Access Control: Cisco ISE can grant and control the right level of network access for both wired and wireless devices by employing mainly the 802.1x protocol and EAPoL (EAP over LAN)1.Cisco ISE can also use MAC authentication bypass (MAB) to authenticate devices that are unable to use the EAP protocol1.Additionally, Cisco ISE can integrate with Microsoft Active Directory for confirming user identity1.
• Assurance: Cisco ISE can monitor and troubleshoot the various features on ISE and analyze trends of the network activities from a centralized admin node2.Cisco ISE can also provide reports on user andentity behavior analytics (UEBA), enterprise mobility management/mobile device management (EMM/MDM), security incident and event management (SIEM), and segmentation34.
• Monitoring: Cisco ISE can provide endpoint visibility with context by collecting and analyzing data from various sources such as endpoints, users, applications, devices, networks, and cloud services4.Cisco ISE can also provide real-time alerts and notifications on security events and anomalies4.

/configuration/guide/scg3750/sw8021x.pdf

The protocol that is used between an endpoint and a switch with an 802.1 authentication is EAP, which stands for Extensible Authentication Protocol. EAP is a framework that defines how the endpoint (also called the supplicant) and the switch (also called the authenticator) exchange authentication messages over a wired or wireless network. EAP supports various authentication methods, such as passwords, certificates, tokens, or biometrics, and can be encapsulated in different transport protocols, such as RADIUS, Diameter, or EAPOL. EAP is used in 802.1X authentication, which is a standard for port-based network access control that prevents unauthorized access to a network1.

The other options, TACACS, MAB, and RADIUS, are not protocols that are used between an endpoint and a switch with an 802.1 authentication. TACACS is a protocol that provides remote authentication and authorization for network devices, such as routers or switches, but it is not used for endpoint authentication. MAB is a technique that uses the MAC address of an endpoint as a credential for 802.1X authentication, but it is not a protocol itself. RADIUS is a protocol that provides centralized authentication, authorization, and accounting for network access, but it is not used directly between the endpoint and the switch, but rather between the switch and the authentication server1. References := : 2: What Is 802.1X Authentication? How Does 802.1x Work? - Fortinet2, 1: IEEE 802.1X - Wikipedia1

 Cisco ISE is a comprehensive solution that provides authentication, authorization, and accounting (AAA) services, as well as posture, profiling, and guest access features. These are some of the key features that differentiate Cisco ISE from other RADIUS and NAC products in the market.

• Ability to authenticate and authorize users and endpoints: Cisco ISE supports various authentication methods and protocols, such as 802.1X, MAB, WebAuth, EAP, PEAP, EAP-TLS, and TEAP. Cisco ISE also integrates with various identity sources, such as Active Directory, LDAP, RADIUS, SAML, and Azure AD. Cisco ISE can enforce granular and dynamic policies based on the identity and context of the users and endpoints, such as device type, location, posture, and time. Cisco ISE can also leverage TrustSec and SGTs to provide software-defined segmentation and micro-segmentation12.
• BYOD provides auto configuration of endpoints: Cisco ISE supports BYOD (Bring Your Own Device) scenarios, where users can register and onboard their personal devices to the network. Cisco ISE provides a self-service portal and a native supplicant provisioning tool that can automatically configure the endpoints with the required certificates, profiles, and settings. Cisco ISE can also apply different policies for corporate and personal devices, and integrate with MDM (Mobile Device Management) solutions to enforce compliance and security34.
• Guest access and guest lifecycle management functionality: Cisco ISE provides a comprehensive guest access solution that allows administrators and sponsors to create and manage guest accounts, and assign different access levels and privileges to guests. Cisco ISE also provides a customizable guest portal that can support various authentication methods, such as social media login, SMS, email, or self-registration. Cisco ISE can also monitor and audit the guest activities and sessions, and enforce expiration and revocation policies .

References:

• : Cisco ISE Features - Cisco
• : Cisco TrustSec Configuration Guide, Cisco IOS XE Gibraltar 16.12.x - TrustSec Overview [Cisco IOS XE 16] - Cisco
• : Cisco Identity Services Engine Administrator Guide, Release 2.7 - BYOD [Cisco Identity Services Engine] - Cisco
• : Cisco Identity Services Engine Administrator Guide, Release 2.7 - Mobile Device Management [Cisco Identity Services Engine] - Cisco
• : [Cisco Identity Services Engine Administrator Guide, Release 2.7 - Guest Access [Cisco Identity Services Engine] - Cisco]
• : [Cisco Identity Services Engine Administrator Guide, Release 2.7 - Guest Lifecycle Management [Cisco Identity Services Engine] - Cisco]