A security-conscious organization is deploying SD-Access. They want to enforce micro-segmentation between endpoints in the same subnet. They also want to ensure that traffic between different VNs is blocked at the border. Which two mechanisms should they use?

VXLAN for micro-segmentation and LISP for macro-segmentation.

SGTs for micro-segmentation and VNs for macro-segmentation.

VLANs for micro-segmentation and VNs for macro-segmentation.

SGTs for micro-segmentation and ACLs on the border for inter-VN traffic.

A company is implementing SD-Access and wants to provide guest access. They want guests to have internet-only access and be isolated from the corporate network. Which overlay configuration should they use?

Create a separate VN for guests and use SGTs to restrict access to the internet only.

Use the same VN as corporate and rely on the border to filter traffic.

Create a separate VN for guests and use VLANs to restrict access.

Use the same VN as corporate and apply ACLs on the edge nodes.

A company is designing an SD-Access fabric for a campus with multiple buildings. They want to ensure high availability for the control plane. Which design should they use?

Deploy a single control plane node and rely on the border for redundancy.

Deploy multiple control plane nodes in the fabric.

Deploy a single control plane node with a standby.

Deploy control plane nodes only at the main site.

A university is implementing SD-Access to segment student, faculty, and guest traffic. They need to ensure that guests can only access the internet and cannot communicate with other guests or internal resources. Which combination of overlay technologies should be used?

LISP for data plane, VXLAN for control plane, and SGTs for policy.

LISP for control plane, VXLAN for data plane, and Cisco TrustSec for SGT-based policy.

BGP EVPN for control plane, VXLAN for data plane, and ACLs on the border.

VXLAN for both control and data plane, and use VLANs for segmentation.

CCIE Enterprise Infrastructure

Domain 2Objective 1

Cisco SD-Access CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 8)

Part of the Software-Defined Infrastructure domain, which accounts for 25% of the CCIE-ENTERPRISE-INFRASTRUCTURE exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

25%of the exam

Questions 36–40

36expert · medium
A security-conscious organization is deploying SD-Access. They want to enforce micro-segmentation between endpoints in the same subnet. They also want to ensure that traffic between different VNs is blocked at the border. Which two mechanisms should they use?
Select an answer first
37application · medium
A company is deploying SD-Access and wants to use a single routing protocol for the underlay. They have a mix of Cisco and non-Cisco devices in the underlay. Which routing protocol should they choose?
Select an answer first
38application · medium
A company is implementing SD-Access and wants to provide guest access. They want guests to have internet-only access and be isolated from the corporate network. Which overlay configuration should they use?
Select an answer first
39application · medium
A company is designing an SD-Access fabric for a campus with multiple buildings. They want to ensure high availability for the control plane. Which design should they use?
Select an answer first
40application · medium
A university is implementing SD-Access to segment student, faculty, and guest traffic. They need to ensure that guests can only access the internet and cannot communicate with other guests or internal resources. Which combination of overlay technologies should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-ENTERPRISE-INFRASTRUCTURE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-ENTERPRISE-INFRASTRUCTURE” is a trademark of its owner, used for identification only.