Designing Cisco Enterprise Networks

Here you have the best Cisco ENDESIGN practice exam questions

You have 30 total questions to study from
Each page has 5 questions, making a total of 6 pages
You can navigate through the pages using the buttons at the bottom
This questions were last updated on July 4, 2025
This site is not affiliated with or endorsed by Cisco.

Question 1 of 30

Which component of the SD-Access fabric is responsible for communicating with networks that are external to the fabric?

edge nodes

control plane nodes

intermediate nodes

border nodes

Correct Answer: D

In an SD-Access fabric, border nodes are the components responsible for communicating with networks that are external to the fabric. These nodes serve as the gateway and handle the routing of traffic between the SD-Access fabric and external networks, including the internet and other remote sites.

Question 2 of 30

Which protocol runs between the vSmart controllers and between the vSmart controllers and the vEdge routers, and unifies all control plane functions under a single protocol umbrella?

BGP

OSPF

IKE

OMP

VRRP

Correct Answer: D

The protocol that runs between the vSmart controllers and between the vSmart controllers and the vEdge routers, and unifies all control plane functions under a single protocol umbrella is OMP (Overlay Management Protocol). OMP is specifically designed for the Cisco SD-WAN solution and is responsible for managing the overlay network by exchanging control plane information like route prefixes, next-hop routes, crypto keys, and policy information over a secure connection.

Question 3 of 30

Which two statements regarding Cisco SD-WAN vEdge routers can mitigate DoS attacks against the infrastructure? (Choose two.)

Open Certificate Authority and automated enrollment feature.

By default, all incoming traffic is denied at the transport (WAN) side interfaces.

Only authorized controllers are allowed to communicate back to the vEdge router after the vEdge router establishes connections with the controllers.

In case of direct Internet access, the only traffic allowed back is the traffic matching the state table entries on the vEdge router.

The vEdge routers run on hardened Linux operating systems.

Correct Answer: B, D

To mitigate DoS attacks against Cisco SD-WAN vEdge routers, it is essential to control incoming traffic meticulously. By default, denying all incoming traffic at the transport (WAN) side interfaces ensures that no unsolicited or potentially harmful traffic reaches the infrastructure directly, providing a strong defensive measure. Additionally, for direct Internet access, allowing only the traffic that matches the state table entries ensures a stateful inspection, meaning only traffic corresponding to expected connections (and thus less likely to be malicious) is permitted. This combination of default-deny policies and stateful inspection forms a robust defense against DoS attacks.

Question 4 of 30

What are the three foundational elements required for the new operational paradigm? (Choose three.)

centralization

assurance

application QoS

multiple technologies at multiple OSI layers

policy-based automated provisioning of network

fabric

Correct Answer: B, E, F

The three foundational elements required for the new operational paradigm include assurance, policy-based automated provisioning of network, and fabric. Assurance refers to the ability to guarantee performance and reliability, which is critical in modern network operations. Policy-based automated provisioning allows for streamlined and consistent network configuration and management, reducing manual errors and improving efficiency. Fabric refers to the underlying network structure enabling seamless connectivity and integration across various segments, necessary for a robust and flexible operational model.

Question 5 of 30

Which two statements are true regarding Cisco ISE? (Choose two.)

It distributed deployments, failover from primary to secondary Policy Administration Nodes happens automatically.

The number of logs that ISE can retain is determined by your disk space.

ISE supports IPv6 downloadable ACLs.

ISE can detected endpoints whose addresses have been translated via NAT.

ISE supports up to 100 Policy Services Nodes.

In two-nodes standalone ISE deployments, failover must be done manually.

Correct Answer: B, C

Cisco ISE's log retention is determined by the available disk space. Additionally, Cisco ISE supports IPv6 downloadable ACLs, making these two statements true.