Security and Quality of Service (15%)

ENSDWI · 45 questions

• A 200-user branch WAN Edge runs two transports and hosts trusted LAN in VPN 10 and guest Wi-Fi in VPN 20. Compliance requires application-aware inspection between zones, logging of denied sessions, and default deny between VPNs. Which zone-based firewall design enforces application-aware segmentation on the WAN Edge?
• A healthcare company needs secure Internet gateway access for two DC WAN Edges to a cloud security provider with frequent key rotation. Operations wants tunnels built and refreshed from SD-WAN Manager without manual IKE configuration on each router. Which SIG tunnel provisioning method should the engineer choose for automated creation?
• A logistics firm runs voice and bulk backup over a single MPLS transport with variable bandwidth due to carrier policing. The operations team wants per-tunnel queuing plus automatic shaping-rate adjustment when the path degrades. Which QoS treatment on the WAN Edge routers satisfies both needs?
• A healthcare network adds a third-party firewall with a service TLOC at the data center and requires all guest VPN traffic from branches to traverse it before internet breakout. Spoke routes must be redirected through the service while return traffic still works. Which service-chaining design via control policy directs the guest traffic to the firewall service TLOC?
• A university backs up research data nightly over a constrained 20-Mbps MPLS link with highly repetitive file transfers, while interactive browsing shares the same path. Leaders want lower backup time without buying bandwidth. Which App-QoE data redundancy elimination use best reduces repeated bytes where it helps most?
• A school district sees rising malware from student devices resolving malicious domains over branch internet exits and wants to block risky lookups before connections form, without backhauling DNS to headquarters. Which DNS security policy using a cloud resolver to filter DNS requests blocks malicious domains at branches?
• A financial branch WAN Edge must block known malware callbacks and exploit attempts for Internet-bound traffic without adding appliances. The security team wants automatic signature updates and logging within the existing SD-WAN security workflow. Which IPS/IDS design in Unified Security policy meets inline prevention needs?
• A logistics site prioritizes voice, warehouse scanning, and bulk file sync over one 100-Mbps Internet circuit with congestion at peak hours. The design needs classification, queuing, and scheduling on egress. Which QoS treatment on the WAN Edge should the engineer configure for application-aware queuing?
• A mining site uses LTE with 8% bursty loss for voice and SCADA, with ample spare bandwidth but strict latency targets and limited router CPU. Voice needs immediate repair for single-packet loss while bulk telemetry tolerates delay. Which App-QoE loss-mitigation choice best fits these stated loss and latency needs?
• A retail chain adds a firewall service at its data center WAN Edge in VPN 10 serving stores in VPN 20. Stores must reach the firewall via OMP, and the firewall must return traffic to store prefixes. The service node is only reachable inside VPN 10. Which service-route advertisement approach satisfies the reachability requirement?
• A manufacturer reports slow file transfers and ERP sync over a high-latency MPLS and internet mix, with packet captures showing mostly long-lived TCP sessions and window constraints. Loss is low and UDP voice is fine, so the team wants App-QoE optimization without touching voice. Which statement correctly describes TCP optimization benefits and the traffic it applies to?
• A financial firm must send branch internet traffic to a third-party Secure Internet Gateway over the public transport with encrypted tunnels and survive a gateway PoP outage without manual reconfiguration. Each branch has dual internet links. Which cloud security integration design provides encrypted SIG connectivity and redundancy?
• A school district must block adult and gambling sites, block domains with a high-risk web reputation, and always allow the district learning portal even if its category or reputation scores poorly. Which URL filtering design enforces category, reputation and exception needs together?
• A manufacturer must steer file transfers and backup traffic to a central WAN optimization farm without hairpinning branch routers, with automatic load sharing across two optimizers and health-aware bypass on failure. Branches run SD-WAN with limited CPU. Which App-QoE service-steering design meets load sharing and bypass needs?
• A retail chain must connect 150 branches to Zscaler and Cisco Umbrella SIGs quickly, enforce consistent IKE parameters, and let operations audit tunnels centrally. Engineers debate portal automation versus CLI. Which statement correctly contrasts automated SIG tunnel creation versus manual configuration?
• A university WAN Edge hosts student VPN 30, research VPN 40, and Internet transport in VPN 0. Policy requires research traffic to pass inspection before Internet breakout, student peer traffic blocked, and zones tied to VPN membership. Which zone-based firewall design enforces the application-aware inspection requirement?
• An engineering firm replicates large CAD files daily between two data centers over a constrained MPLS link, sending the same blocks repeatedly with ample memory on the routers. Branch voice and small web flows see no benefit. Which statement correctly describes data redundancy elimination and where it helps most?
• A call center has 500 agents with voice, video, and bulk file transfers sharing a 100 Mbps edge. Voice needs strict priority with policing, while video and bulk need assured shares without starvation during congestion. Which scheduling and queue-class approach should the engineer apply to meet both needs?
• A 40-site retailer runs guest Wi-Fi and POS traffic through cEdge routers with a Unified Security policy already doing URL filtering. Leadership requires malicious payloads to be blocked automatically at the branch, with alerts visible in SD-WAN Manager, without sending traffic to cloud. Which IPS/IDS choice in the Unified Security policy meets these branch requirements?
• A financial campus must inspect all branch-to-data-center traffic in VPN 20 through a firewall service attached to a hub Edge before delivery. The firewall advertises a service TLOC and OMP carries the service route. Which control policy design chains traffic through the firewall correctly?
• A clinic branch allows USB file transfers and web downloads, but ransomware incidents require blocking known-malicious files and analyzing suspicious ones in the cloud. The WAN Edge has integrated security licensing. Which WAN Edge capability best delivers file reputation and verdicting?
• A trading firm runs real-time voice over a lossy transoceanic link with 4% packet loss and jitter spikes, tolerating extra bandwidth but not retransmission delay. Engineers must choose Application Quality of Experience mitigation for sustained loss versus single-packet gaps. Which App-QoE choice correctly contrasts packet duplication versus forward error correction for lossy links?
• An enterprise call center reports voice clipping on a 50 Mbps MPLS uplink from a WAN Edge while bulk file transfers saturate the same interface during business hours. The design requires voice in a priority queue and remaining traffic fairly shared. Which QoS configuration should the engineer apply on the WAN Edge to enforce egress treatment?
• A hospital edge has a 50 Mbps MPLS circuit where voice needs smooth pacing during bursts and guest internet must be capped at 10 Mbps with excess dropped. CPU is limited and buffer memory is adequate. Which QoS mechanism should the engineer apply to satisfy both traffic types?
• A colocation Edge hosts a firewall for VPN 30 service chaining, with a 10.30.50.0/24 subnet behind it. Remote sites in VPN 30 must reach the subnet through the firewall, but traffic bypasses the firewall even though the firewall is deployed. Which service-route advertisement requirement enables reachable service chaining?
• A financial firm must inspect outbound HTTPS to block data exfiltration, but auditors require that internal clients trust the inspection without browser errors and private keys stay protected. Which SSL/TLS proxy certificate handling best enables decrypt-and-inspect?
• A healthcare group must block phishing and adult sites, block sites with a poor reputation score, and explicitly permit the patient portal despite its miscategorization. CCT traffic stays local with Unified Security policy. Which URL-filtering design meets categorization, reputation and list requirements?
• A regional retailer with 40 branches runs bulk file transfers and virtual desktops over MPLS and broadband, needs TCP optimization without per-branch appliances, and wants flows automatically distributed across optimization resources. Which AppNav and service-node design best supports App-QoE WAN optimization steering?
• A hospital branch prioritizes voice with strict 256-kbps priority and no queuing delay, while file backup in the same VPN needs a guaranteed minimum share during congestion but can wait. Both classes share a 10-Mbps tunnel where voice must never starve data. Which WAN Edge scheduling and queue class combination meets this voice latency guarantee?
• A university uses TrustSec to group students, faculty and IoT cameras and needs those group tags preserved across an SD-WAN fabric with mixed MPLS and internet for policy at the data center. Inline tagging on all links is unreliable. Which Cisco SD-WAN security feature should the engineer describe to carry group context end to end?
• A call center marks voice EF and signaling AF31 at phones, but the MPLS provider re-marks all inbound traffic to default and Internet traffic arrives untrusted. The WAN Edge must enforce enterprise markings outbound and restore them on return traffic consistently. Which QoS DSCP marking and remarking approach on the Edge achieves this requirement?
• A clinic WAN Edge terminates guest Internet, clinical VPN traffic, and a service VPN, needs application-aware inspection between zones, and must deny inter-zone traffic by default. Which zone-based enterprise firewall design best meets this WAN Edge security requirement?
• A logistics firm enables internet breakout at branches and must block malicious downloads and stop known-bad files from executing, with verdicts refreshed from cloud intelligence. Branch routers have security licensing and limited bandwidth. Which WAN Edge advanced malware protection behavior should the engineer describe to meet file-based threat defense?
• A school district with 30 sites allows local DIA for students but suffers malware from malicious domains. It wants DNS requests filtered before resolution without deploying branch appliances, using SD-WAN policy to redirect queries. Which DNS security integration should the engineer configure to block malicious domains centrally?
• A hospital must send all guest VPN traffic through a centralized firewall service before Internet exit, needs automatic route advertisement for the service location, and wants to avoid per-branch static routes. Which service-chaining design via control policy correctly steers to the firewall TLOC?
• A branch has a 50-Mbps internet circuit carrying voice and bulk replication where excess replication bursts cause drops for voice during congestion. Replication must be capped at 20 Mbps with excess dropped, while total egress must be smoothed to the circuit rate without discarding conforming voice. Which shaping and policing treatment meets this congestion requirement?
• A regional bank with 40 branches must inspect outbound HTTPS for malware while preserving privacy for banking apps via an allow-list, and auditors require no browser warnings for users. Edge routers will perform decrypt-and-inspect for selected flows. Which certificate handling for SSL/TLS proxy meets the decrypt-and-inspect requirement?
• A regional retailer with 40 stores runs POS traffic and guest Wi-Fi on the same WAN Edge routers, must inspect inbound Internet traffic for exploits, and needs automatic signature updates without a separate appliance. Which IPS/IDS design should you deploy in the Unified Security policy to meet these requirements?
• A retail branch uses dual broadband transports with highly variable throughput during peak hours, and voice in VPN 10 must stay protected while bulk traffic is shaped per tunnel. The design requires shaping that tracks actual path bandwidth instead of a static shaper. Which QoS treatment on the WAN Edge router achieves adaptive per-tunnel shaping for this requirement?
• A hospital WAN Edge carries voice in VPN 20 and data in VPN 30 over one MPLS transport, voice arrives unmarked from legacy phones, and queuing must prioritize voice upstream. Which QoS configuration should the engineer apply to ensure correct marking and remarking of DSCP at the edge?
• A school district with 25 campuses must block adult and gambling sites for students, allow teachers to access social media for lessons, and override miscategorized educational domains quickly. Which URL filtering design should you deploy for categories, reputation and allow/block lists?
• A hospital inserts a service-side firewall cluster behind two data-center WAN Edges in VPN 20 to inspect guest traffic, but remote sites cannot reach the firewall IP and return traffic drops. The firewall is up and VRRP is healthy. Which service-route advertisement and reachability design makes the centralized security service usable?
• A university with wired TrustSec domains in two campuses wants student and staff SGT tags preserved over the SD-WAN fabric so firewall policy at the data center enforces role-based access. Edges connect to switches carrying SGTs in service VPNs. Which TrustSec SGT propagation method preserves role tags across the fabric?
• A financial firm must send branch Internet traffic to a Secure Internet Gateway provider requiring scalable onboarding, with active-standby resilience if a provider site fails and no per-tunnel manual reconfiguration. Branches run dual transports. Which branch-to-SIG connectivity design meets these needs?
• A logistics firm complains that file transfers and database sync over long-haul Internet paths suffer from slow start and packet-loss stalls, while real-time voice is already optimized elsewhere. The WAN architect proposes App-QoE TCP optimization on selected WAN Edges to improve throughput without changing applications. Which statement of TCP optimization benefits and traffic scope justifies this App-QoE proposal for this use case?