Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cisco CCNP ENCOR > SD-WAN, SDA, Fabric > Flashcards

SD-WAN, SDA, Fabric Flashcards

SD-WAN, SD-Access, ACI

1
Q

Why type of Tunnels does SD-WAN leverage?

A

IPSec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the name of the device where SD-WAN Policy is defined?

A

The Controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 4 main components of Cisco SD-WAN and what are their functions?

A

vManage - GUI and API VM used to configure and manage SD-WAN
vSmart - the controller that pushes the policy and acts as the data plane for the SD-WAN
vEdge / cEdge - These are the SD-WAN Edge Routers
vBond - the out of band orchestrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is cEdge and how is it different from vEdge?

A

cEdge is a Cisco ISR router running Viptella firmware. The main difference is that cEdge supports advanced security features that vEdge does not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What features does cEdge have that vEdge does not?

A
  • Cisco AMP and Threat Grid
  • Enterprise Firewall
  • Cisco Umbrella DNS
  • URL Filtering
  • Snort IPS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the three main features of vBond?

A
  • Control Plane Connection - permanent control plane connection to each vSmart controller
  • NAT Traversal
  • Load Balancing - load balances routers to vSmart controllers when more than one exist in a domain
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the benefits of SD-WAN?

A
  • Lower Costs and Reduce Risks with simple WAN automation and Orchestration
  • Extend Enterprise networks seamlessly into the public cloud
  • Provide optimal user experience for SaaS applications
  • Leverage a transport-independent WAN for lower cost and higher diversity. This means the underlay network can be any type of IP-based network, such as the Internet, MPLS, 3G/4G LTE, satellite, or dedicated circuits.
  • Enhance application visibility and use that visibility to improve performance with intelligent path control to meet SLAs for business-critical and real-time applications.
  • Provide end-to-end WAN traffic segmentation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are some limitations of Cisco SD-WAN?

A
  • Base SD-WAN license only allows for a Hub-and-Spoke topology
  • If there are two vManage, they must be Active/Passive
  • vAnalytics feature requires an additional license
  • vBond must have a public IP address (or NAT’d private)
  • Some ISR/ASR modules may not be compatible with cEdge
  • Deep Packet Inspection (DPI) requires additional licensing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the four different SD-WAN traffic forwarding options when configuring a policy?

A
  • Active/Active: Load Balanced
  • Active/Active Weighted: Load balanced based on bandwidth
  • Active/Standby Pinning: Application traffic has a preferred route unless it is down
  • Application Aware SLA: application traffic chooses a route based on network metrics such as loss and jitter
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

In SD-WAN, what is OMP?

A

Overlay Management Protocol - this is the control plane information and controller policies that is sent from vSmart to the vEdge. Sent over TCP using SSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the three different types of SD-WAN deployment models?

A
  • Public: on AWS
  • Hybrid: on-prem using Public IPs
  • Hybrid w/ Private IP: when ISP rejects public IP route
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a TLOC extension?

A

A connection between two vEdge routers at the same site that create a “U-shaped” topological connection to two redundant WAN links.

TLOC = Transport Locator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When deploying a vEdge or cEdge router using Zero Touch Provisioning (ZTP), what is the first thing the router attempts to communicate with?

A

A ZTP Server that is hosted and managed by Cisco on the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When deploying a vEdge or cEdge router using Zero Touch Provisioning (ZTP), what are the only protocols enabled on the outside interface by default?

A

DNS, DHCP, and ICMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When DPI is not enabled in SD-WAN, what are the 6 parameters used to identify an application within a policy?

A

1 -2) Source and Destination IP address
3 - 4) Source and Destination Port
5) DSCP value (QoS)
6) Protocol Number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When using Application Awareness and Deep Packet Inspection (DPI), what protocol is used to detect latency and jitter on a WAN circuit?

A

BFD - Bi-Directional Forwarding Detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

In Cisco SD-WAN, what VPN ID is reserved for out-of-band management?

A

VLAN 512

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is SD-WAN Cloud OnRamp for IaaS?

A

A feature that allows us to deploy virtual vEdge devices to IaaS platforms (AWS and Azure only) to bring SD-WAN into the public cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is SD-WAN Cloud OnRamp for SaaS?

A

A feature that extends HTTP(S) probes to the SaaS platform to determine the best path to the SaaS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the name of the metric used to measure how good a connection is to an OnRamp SaaS application?

A

VQoE - Viptela Quality of Experience.

Value is 0 - 10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the challenges of traditional networks that Software Defined Networks sets out to overcome?

A
  • Layer 2 Scaling in large networks
  • Layer 3 Roaming (Wireless)
  • CLI configuration in large networks (manual config)
  • Security and QoS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the three elements that make up Cisco Campus Fabric when discussing SDN?

A
  • VXLAN - Tunnel
  • LISP - Routing
  • CTS (Cisco TrustSec [ISE])
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the two critical entities of SD-Access?

A
  • Campus Fabric
  • DNA Center
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the four “Layers” of SD-Access?

A
  • Physical Layer: devices
  • Network Layer: underlay/overlay
  • Control Layer: DNA Center/ISE
  • Management Layer: DNA Center GUI
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the 6 physical components of an SD-Access deployment?

A
  • Fabric Edge Node
  • Control Plane Node
  • Fabric Border Node
  • Fabric WLC
  • Intermediate Nodes
  • SD Controller (DNA Center/ISE)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the recommended Interior Gateway Protocol to be used in a Cisco SD-Access solution?

A

IS-IS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What SDA component is used to connect user endpoint devices to the SDA Fabric?

A

Fabric Edge Node

28
Q

What SDA component uses the LISP protocol to map device endpoint locations?

A

Control Plan Node(s)

29
Q

What SDA component connects to other networks (internal or external)?

A
  • Fabric Border Nodes

NOTE:
Internal Border Nodes connect to internal networks
External Border Nodes connect to external networks (BGP/Internet)

30
Q

What is the difference between a Fabric WLC and a standard WLC?

A

Fabric WLC is aware of the Software Defined Access fabric. Wireless APs under control of the Fabric WLC can connect to other switches in the fabric using VXLAN tunnels.

31
Q

Which two SDA component roles can be combined to a single device in smaller networks?

A

Fabric Border Node & Control Plane Node

32
Q

In SD Access, which protocols are responsible for the the Data Plane, the Control Plane, and the Policy Plane?

A
  • Data: VXLAN
  • Control: LISP
  • Policy: CTS (Cisco TrustSec [ISE])
33
Q

What are the Cisco recommended network layer configurations for nodes running SD Access?

A
  • Interior Gateway Protocol: IS-IS is preferred
  • Increase MTU by 50 Bytes
  • Layer 3 connectivity end-to-end
34
Q

What two engines does DNA Center run as the Control Node?

A
  • NCP: Network Control Platform (aka APIC-EM)
  • NDP: Network Data Platform
35
Q

What function does the NCP subsystem perform?

A
  • Automation of Underlay and Overlay Configurations
36
Q

What function does the NDP subsystem perform?

A
  • Network Assurance
37
Q

What are the 4 workflows in DNA configuration?

A

1.) Design - network settings and profiles
2.) Policy - ISE and Security
3.) Provision - assign SDA roles
4.) Assurance - network health

38
Q

When using LISP and VXLAN in an SD Access deployment, what are the two interchangeable terms used for a network device ID?

A

VTEP - Virtual Tunnel Endpoint (VXLAN)
RLOC - Routing Locator

39
Q

When applying CTS Policy to SD Access, what are two types of segmentation that can be accomplished?

A

Micro-segmentation - blocking hosts on the same subnet from talking to each other.

Macro-segmentation - creation of Virtual Networks (VRFs)

40
Q

When creating virtual networks within a VXLAN deployment. Which VXLAN field facilitates CTS policy across a virtual network?

A

The VXLAN VNID (Virtual Network Identifier)

41
Q

The 802.1X (TrustSec) acronym SGT was changed to mean something different for the purpose of use within SD Access CTS. What was it changed to?

A

Changed from Security Group Tag to Scalable Group Tag

42
Q

The new VXLAN specification is now called what? How many SGT tags does it support?

A

VXLAN-GPO; up to 64,000 SGT Tags

43
Q

What are the new fields and sizes for a VXLAN-GPO packet header?

A

Group Policy ID: 16 bit
Group Based Policy Extension: 1 bit
Don’t Learn Bit (D Bit): 1 bit
Policy Applied Bit (A Bit): 1 bit

44
Q

What type of segmentation does SGT facilitate within SD Access CTS Policy?

A

Micro-Segmentation

45
Q

Where is SD Access CTS Policy defined?

A

It is defined inside of DNA Center then passed to Cisco ISE

46
Q

When using a Fabric WLC in SD Access, where does the control and data traffic traverse?

A
  • Control traffic goes over the CAPWAP tunnel
  • Data traffic goes over the VXLAN
47
Q

When roaming in a LISP (SDA) Fabric and a client roams to a new ETR, what does the “old” ETR do when it receives a packet from the ITR?

A

1.) Tells the ITR to send a new map-request to the control node (aka Map Server)

2.) Forwards the packet to the new ETR

NOTE: In this scenario a control node has already sent a map-register to the “old” ETR with the new location of the client…

48
Q

What is the difference between an External and Internal Border node in an SDA Fabric?

A
  • Internal Border nodes map-registers IGP subnets to the Control Node
  • External Border node acts as the destination for all “unknown” destinations like a Default Gateway.
49
Q

Which Cisco 9k switches are designed to be a Core switch?

A

Catalyst 9500 and 9600

*In an SDA deployment these could also be a Fabric Border or Control Node

50
Q

Which Cisco 9k switches are designed to be a Fabric Edge switch?

A

Catalyst 9200, 9300 and 9400 - these were designed to replace the old 2k, 3k, and 4k access switches.

9500 is also capable of being a fabric edge node although it is designed to be a core switch

51
Q

Which Cisco routers are preferable for use in SDA fabric?

A
  • ASR1000
  • ISRv (virtual)
  • CSRv (virtual/cloud)
52
Q

What two roles in an SDA Fabric would a Cisco router serve?

A
  • Control Node
  • Fabric Border Node
53
Q

What are the recommended models of Cisco devices for use as a Fabric WLC in an SDA deployment?

A
  • Catalyst 9800 WLC
  • Catalyst Embedded WLC (on Catalyst 9300 Switch)
  • Catalyst 9800-CL (cloud)
54
Q

What Cisco devices are recommended as Wireless APs in an SDA deployment?

A
  • Catalyst 9100 APs
55
Q

What piece of hardware is used to deploy the physical instance of DNA Center?

A

Cisco UCS M5 Server

NOTE: DNA Center recently became available as a Virtual Appliance

56
Q

What are the “Three A’s” of SD Access?

A
  • Automation
  • Analytics
  • Assurance
57
Q

What services does the DNA Center Analytics Engine provide for network engineers?

A
  • SNMP
  • Syslog
  • Netflow
  • Streaming Telemetry
58
Q

What new tool does SD Access Assurance provide for network engineers?

A

Path Trace

59
Q

What communication protocol does ISE use to push policies to 3rd party devices such as third party firewalls and switches?

A

pxGrid - Platform Exchange Grid

60
Q

What Cisco products make up the Encrypted Traffic Analytics solution?

A
  • StealthWatch
  • ISE
  • Catalyst 9k devices (not 9200s)
61
Q

In an SD Access environment, where do Anycast gateways get deployed?

A

On all Fabric Edge nodes

62
Q

In the Design workflow of DNA Center, what are the key elements you would configure?

A
  • The Network Hierarchy (Geographically)
  • Network Devices and settings
  • Image Repository
  • Network Profiles
  • Auth Templates
63
Q

In the Policy workflow of DNA Center, what are the key elements you would configure?

A
  • Virtual Networks
  • Group Based Access
  • IP Based Access
64
Q

What happens in the DNA Center Provisioning workflow?

A
  • Device Onboarding
  • Automated Underlay Configuration (If the devices support it)
65
Q

What information can DNA Center provide in the Assurance workflow?

A
  • Client Health
  • Connectivity data
  • Historical Network data
  • Detected Issues
  • AI suggested resolution steps

Cisco CCNP ENCOR (27 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions