Cisco 500-220 Engineering Cisco Meraki Solutions (ECMS) v2.2 Exam Practice Test

This is the approximate number of APs that are needed based on client count, assuming that each AP can support up to 25 concurrent video streaming users. This can be calculated by using the formula:

Number of APs = (Number of Users x Percentage of Users on a Band) / Number of Users per AP on that Band

Where Number of Users is 100, Percentage of Users on 2.4 Ghz is 30%, Percentage of Users on 5 Ghz is 70%, Number of Users per AP on 2.4 Ghz is 15, and Number of Users per AP on 5 Ghz is 30. Therefore,

Number of APs = (100 x 0.3 / 15) + (100 x 0.7 / 30) Number of APs = (3.33) + (2.33) Number of APs = 5.66

Rounding to the nearest whole number, the number of APs is 4.

This question is related to the topic of Wireless Capacity Planning in the Cisco Meraki documentation. You can find more information about this topic in the [Wireless Capacity Planning] article or the [Best Practice Design - MR Wireless] page.

Configuring a syslog server for the network is the Cisco Meraki best practice method to preserve complete historical network event logs. A syslog server can be configured to store messages for reporting purposes from MX Security Appliances, MR Access Points, and MS switches1. The syslog server can collect various types of events, such as VPN connectivity, uplink connectivity, DHCP leases, firewall rules, IDS alerts, and security events2. The syslog server can also help with troubleshooting and monitoring the network performance and security.

See Behavior - Firmware MX 15.11 or Lower section For MXs running firmware MX15.11 or below, the source IP that MX uses while pinging a destination is the MX IP of highest VLAN ID. If the destination is across a VPN, the MX uses the MX IP of highest VLAN ID participating in VPN. For MXs running firmware MX 15.12+, additional ping options have been added to the live tool. The ping tool now has a drop down to select the source IP address for pinging destinations from the MX. https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Ping_Live_Tool

This is because the alert mentions 802.1X failure, which is a network access control method that is used with WPA2-enterprise and RADIUS servers1.

This question is related to the topic of Wireless Access Points Quick Start in the Cisco Meraki documentation. You can find more information about this topic in the Wireless Access Points Quick Start article or the Using the Cisco Meraki Device Local Status Page page.

https://documentation.meraki.com/MR/Deployment_Guides/Mesh_Deployment_Guide

There will be a throughput reduction (~50% reduction) with each “hop” in a mesh. It is recommended that a mesh network be designed for no more than one mesh hop from the gateway to client device.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MR_Wireless/High_Density_Wi-Fi_Deployments

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MR_Wireless/Wireless_Layer_3_Roaming_Best_Practices

This is a feature of distributed Layer 3 roaming, which maintains layer 3 connections for end devices as they roam across layer 3 boundaries without a concentrator1. The first access point that a device connects to will become the anchor access point1.

Before deploying MXs as one-arm VPN concentrators, place them into Passthrough or VPN Concentrator mode on the Addressing and VLANs page. In one-armed VPN concentrator mode, the units in the pair are connected to the network "only" via their respective ‘Internet’ ports. Make sure they are NOT connected directly via their LAN ports. Each MX must be within the same IP subnet and able to communicate with each other, as well as with the Meraki dashboard. Only VPN traffic is routed to the MX, and both ingress and egress packets are sent through the same interface.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/Meraki_Auto_VPN_General_Best_Practices

You can enable intrusion prevention by setting the Mode drop-down to Prevention under Security & SD-WAN > Configure > Threat protection > Intrusion detection and prevention. Traffic will be automatically blocked by best effort if it is detected as malicious based on the detection ruleset specified above. https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection

The performance probe is a small payload (approximately 100 bytes) of UDP data sent over all established VPN tunnels every 1 second. MX appliances track the rate of successful responses and the time that elapses before receiving a response. This data allows the MX to determine the packet loss, latency, and jitter over each VPN tunnel in order to make the necessary performance-based decisions.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/Meraki_SD-WAN#Performance_Probes

https://documentation.meraki.com/SM/Monitoring_and_Reporting/Selective_Wipe_and_Device_Quarantine_in_Systems_Manager

https://www.ciscolive.com/c/dam/r/ciscolive/latam/docs/2019/pdf/BRKCRS-1579.pdf

When band steering is enabled on an SSID, APs will stop advertising that SSID in 2.4GHz beacons. Since 2.4GHz-only clients that rely on a passive scan will not “see” that SSID in beacons, they might not be able to join this SSID unless they do an active scan or have been pre-configured with the SSID name and security settings (for example, a pre-shared key). https://documentation.meraki.com/MR/Radio_Settings/Band_Steering

IOS:

• Kiosk mode
• Single App mode
• Wallpaper
• Cisco Security Connector
• Active Sync

Android:

• Kiosk mode
• Backpack
• Wallpaper
• Active Sync

This question is related to the topic of System Manager: Getting Started in the Cisco Meraki documentation. You can find more information about this topic in the [System Manager: Getting Started] article or the [System Manager Overview] page.

https://documentation.meraki.com/SM/Profiles_and_Settings/Configuration_Settings_Payloads

To clarify, when an SSID is configured with Sign-On Splash page enabled, the two settings that must be configured for unauthenticated clients to have full network access and not be allow listed are:

• Controller disconnection behavior: This setting determines how the clients are treated when the Meraki cloud controller is unreachable. The options are Restricted or Unrestricted. The former option blocks all traffic from unauthenticated clients until the controller is reachable again. The latter option allows unauthenticated clients to access the network without signing on until the controller is reachable again1.
• Captive Portal strength: This setting determines how often the clients are redirected to the splash page for authentication. The options are Block all access until sign-on is complete or Allow non-HTTP traffic prior to sign-on. The latter option allows unauthenticated clients to access other protocols such as DNS, DHCP, ICMP, etc., but blocks HTTP and HTTPS traffic until they sign on. This option is recommended for compatibility with devices that do not support web-based authentication1.

Routed Mode:

• This mode is the default mode of operation
• This mode is generally also the default gateway for devices on the LAN
• Client traffic to the internet has the source IP rewritten to match the WAN IP of the appliance
• DHCP services can be configured on the MX appliance

Passthrough Mode:

• The MX appliance acts as a layer 2 bridge
• VLANs cannot be configured
• No address translation is provided
• This mode is not recommended at the network perimeter

This question is related to the topic of MX Addressing and VLANs in the Cisco Meraki documentation. You can find more information about this topic in the MX Addressing and VLANs article or the General MX Best Practices page.