Free 500-220 Practice Test

Cisco Meraki Systems Manager provides a suite of "Live Tools" for real-time device troubleshooting and management. The Screenshot and Remote Desktop tools are specifically designed for desktop operating systems, namely Apple macOS and Windows PCs. These tools allow administrators to view a device's screen or take full remote control for interactive support. Due to the inherent security models and privacy restrictions of mobile operating systems, these specific invasive functionalities are not available for iOS or Android devices through the Systems Manager Live Tools feature set.

A. OS updates: Managing and forcing OS updates is a standard Mobile Device Management (MDM) function available for all supported platforms, including iOS and Android, not exclusive to desktops.
B. Send notification: Sending push notifications is a basic communication feature available across all managed device types, including mobile phones and tablets.
C. Selective wipe: This is a critical security command to remove managed configurations and applications. It is a core MDM feature available on all platforms (macOS, Windows, iOS, and Android).

1. Cisco Meraki Documentation, "Systems Manager Live Tools": This official document details the available Live Tools and their platform compatibility.

Remote Desktop Section: "Remote desktop allows an administrator to remotely control a client's macOS or Windows PC... This feature is available for macOS and Windows devices."

Screenshot Section: "The screenshot tool allows an administrator to take a live screenshot of a device's screen... This feature is available for macOS and Windows devices."

Source: Cisco Meraki Systems Manager Documentation. Retrieved from https://documentation.meraki.com/SM/MonitoringandReporting/SystemsManagerLiveTools

When a network is bound to a Cisco Meraki configuration template, it inherits its settings from that template. However, Meraki allows for site-specific exceptions. If a configuration change is made directly on the individual network, this action creates a "local override." This local override takes precedence over the corresponding setting in the template for that specific network only. The template itself remains unchanged, and other networks bound to the template are not affected. This allows administrators to maintain a standardized base configuration while accommodating unique requirements for individual sites.

A. The configuration change in the bound network is combined with the template configuration inside the template. This is incorrect. A local change on a bound network does not alter the source template; it only affects the individual network where the change was made.
B. The more restrictive configuration is preferred. This is incorrect. The system does not evaluate the "restrictiveness" of a setting; it follows a simple hierarchy where the local network-specific configuration always overrides the template configuration.
D. The template configuration overrides the configuration change in the bound network. This is incorrect. This describes the opposite of the actual behavior. The purpose of local overrides is to allow network-specific changes to take precedence over the template. ---

1. Cisco Meraki Documentation, "Configuration Templates":

Section: Local Overrides: "When a network is bound to a template, the configuration of the network is dictated by the template to which it is bound... It is also possible to make local configuration overrides on a network-by-network basis."

Section: Local Overrides: "If a configuration is changed on a network that is bound to a template, this change will be a local override and will not be propagated to any other networks. Local overrides will always take precedence over the template configuration." This directly supports the correct answer.

2. Cisco Meraki Documentation, "Configuration Templates Best Practices":

Section: Local Overrides: "Local overrides allow for network-specific configurations that differ from the template. This is useful for settings like a static IP address on a WAN interface or a unique SSID on an access point. When a setting is configured locally, it will no longer be inherited from the template." This confirms that local changes override the template settings.

Cisco Meraki's Auto VPN feature relies on two primary communication paths. First, Meraki MX peers must contact the cloud-based VPN registry to learn the IP address and port information of other peers in the organization. This orchestration traffic occurs over UDP port 9350 (and 9351). Second, once peers have the necessary information, they establish a direct IPsec tunnel between each other. The encapsulated VPN traffic for this peer-to-peer tunnel uses a high-numbered UDP port, typically within the ephemeral range of 32768 to 61000. These two mechanisms—cloud orchestration and direct peer tunneling—are fundamental to how Auto VPN functions.

C. IPsec tunnels for Auto VPN use UDP for encapsulating traffic to optimize performance and handle NAT traversal; TCP is not used for the data plane.
D. Communication with the Meraki VPN registry for Auto VPN orchestration is connectionless and uses UDP, not the connection-oriented TCP protocol.
E. While standard IPsec uses UDP ports 500/4500 for IKE negotiation, Meraki Auto VPN specifically uses high UDP ports for the established peer-to-peer data tunnel.

1. Cisco Meraki Documentation, "Upstream Firewall Rules for Cloud Connectivity." This official document explicitly lists the required ports for Meraki device operation.

Under the "Site-to-site VPN" section, it specifies:

VPN registry: Protocol: UDP, Ports: 9350-9351. This supports the correctness of option B.

Site-to-site VPN: Protocol: UDP, Ports: 32768-61000. This supports the correctness of option A.

2. Cisco Meraki Documentation, "Auto VPN - Site-to-site VPN." This guide details the functionality of Auto VPN.

In the "Auto VPN Technology" section, it states, "The MX security appliance uses UDP port 32768-61000 for sending and receiving VPN traffic to other MX security appliances." This directly confirms the port range used for peer-to-peer IPsec tunneling.

The Cisco Meraki Dashboard API is a RESTful API that adheres to standard HTTP conventions for interacting with resources. It uses specific HTTP request methods, or verbs, for CRUD (Create, Read, Update, Delete) operations. The GET method is used to retrieve or read data. The POST method is used to create new resources, such as a new network or administrator. The PUT method is used to update an existing resource. These three verbs are fundamental to performing the most common operations within the Meraki API.

A. SET: This is not a standard HTTP request verb. Actions that might be conceptually described as "set" are typically implemented using the PUT method in the Meraki API.
C. PATCH: While PATCH is a standard HTTP verb for partial resource updates, the Cisco Meraki API exclusively uses the PUT method for all update operations.
D. ADD: This is not a standard HTTP request verb. The POST method is the standard verb used to add or create new resources in a RESTful API like Meraki's.

1. Cisco Meraki Dashboard API Documentation, "Making API Requests": The official documentation explicitly lists the HTTP methods used. It states, "The Meraki Dashboard API is a RESTful API that uses HTTPS requests and JSON data formatting. All Dashboard API actions correspond to one of the four HTTP request methods: GET, POST, PUT, or DELETE." This confirms the use of GET, POST, and PUT.

Source: Cisco Meraki Developer Hub, Dashboard API v1 Documentation, "Introduction" section.

2. Cisco Meraki Dashboard API Documentation, "Networks" Endpoint: The API reference for managing networks provides clear examples of these verbs in action. For instance, POST /organizations/{organizationId}/networks is used to create a network, GET /networks/{networkId} retrieves a network, and PUT /networks/{networkId} updates a network.

Source: Cisco Meraki Developer Hub, Dashboard API v1 Documentation, API Reference > "Networks" section.

Cisco Meraki supports high availability (HA) for both MX Security Appliances and MS Series Switches through a "warm spare" configuration. This is an active/passive model where a primary device handles traffic and a secondary, identical device remains in a standby state. In the event of a primary device failure, the secondary device assumes the active role. This failover mechanism is managed using the Virtual Router Redundancy Protocol (VRRP), which presents a consistent virtual IP address to the network, ensuring a seamless transition and minimizing downtime.

A. This is incorrect because, in addition to MX Security Appliances, MS Series Switches also support high availability using the same warm spare (VRRP) mechanism.
B. This is incorrect because Meraki MX appliances utilize an active/passive (warm spare) model for high availability, not an active/active configuration.
D. This is incorrect because Meraki devices use the industry-standard Virtual Router Redundancy Protocol (VRRP), not the Cisco-proprietary Hot Standby Router Protocol (HSRP).

1. Cisco Meraki Documentation, "MX Warm Spare and High Availability": This document explicitly states, "The Meraki MX Security Appliance supports a warm spare (high availability) configuration... The two MXs in a high availability pair share a virtual IP address (VRRP)." This confirms the active/passive (warm spare) model and the use of VRRP for MX devices. (Section: "Warm Spare Operation")

2. Cisco Meraki Documentation, "MS Warm Spare (VRRP)": This source confirms HA for switches, stating, "MS series switches can be configured for warm spare (high availability) functionality... MS switches in a warm spare configuration utilize the Virtual Router Redundancy Protocol (VRRP) to provide clients with a consistent gateway IP address." This verifies the active/passive model and VRRP use for MS switches. (Section: "Overview")

The exhibit displays an Application-Aware Routing (AAR) policy that uses an SLA class named Latency20ms. This policy prioritizes the biz-internet color (WAN1) for "All Databases & cloud services" traffic. The public-internet color (WAN2) is configured as the Backup SLA Preferred Color. Traffic will failover from the preferred path (WAN1) to the backup path (WAN2) only when two conditions are met:
1. The preferred path (WAN1) no longer meets the defined SLA criteria. In this case, the latency exceeds the 20 ms threshold.
2. The backup path (WAN2) is available and meets the same SLA criteria. Therefore, traffic is routed via WAN2 only when the WAN1 tunnel's latency is 20 ms or more (violating the SLA) and the WAN2 tunnel is performing within the configured SLA limits.

A. If WAN1 latency is 20 ms or less, it meets the SLA. As the preferred path, it will be used, and no failover to WAN2 will occur.
C. This option incorrectly states that traffic would failover to WAN2 even when the preferred path (WAN1) is meeting the SLA criteria.
D. This option is incomplete. The system will not failover to the backup path (WAN2) unless that path itself is meeting the required performance criteria.

1. Cisco SD-WAN End-to-End Deployment Guide, Cisco IOS XE Release 17.2, "Application-Aware Routing" section.

This guide explains the failover mechanism: "The policy continuously monitors the performance of the paths. If a path is out of policy, the application-aware routing policy automatically directs the traffic to a path that is in policy... If all paths are out of policy, the traffic is sent to one of the paths, and the path is chosen based on the best metrics (lowest latency, lowest loss, or lowest jitter)." This confirms that the backup path must be "in policy" for a deterministic failover. The condition in option D would lead to a "best-effort" path selection, not a guaranteed failover to WAN2.

2. Cisco SD-WAN Policies Configuration Guide, Cisco vManage Release 20.5, "Application-Aware Routing" chapter, "SLA Class" section.

The documentation specifies that the values for latency, jitter, and loss in an SLA class are maximum acceptable thresholds. Any measurement exceeding these values places the path out of compliance with the SLA. This supports the first condition that WAN1 latency must be greater than the configured 20 ms.

3. Cisco SD-WAN Design Guide, "Application-Aware Routing Design" section.

This guide details the logic for preferred-color and backup-sla-preferred-color. It states that traffic is forwarded over the preferred-color tunnel(s) as long as they meet the SLA. If they fail to meet the SLA, traffic is then forwarded over the backup-sla-preferred-color tunnel(s), provided they meet the SLA. This directly supports the two-part condition described in answer B.

When using the Meraki MX Live Tools to ping a destination across a site-to-site VPN, the MX appliance must select a source IP address from one of its local VLAN interfaces. The documented behavior for this operation is that the MX will specifically use the IP address of the VLAN with the highest numerical ID that is configured to participate in the site-to-site VPN. This ensures the source network is advertised to the remote peer and that return traffic is properly routed back through the VPN tunnel.

A. The source VLAN must be configured to participate in the VPN; a VLAN set to "NO" cannot be used.
B. The selection logic uses the highest numbered VLAN ID, not the lowest, among those participating in the VPN.
D. This is incorrect on two counts: the VLAN must participate in the VPN, and the highest ID is used.

1. Cisco Meraki Documentation, "Using the Ping Live Tool". In the section "Source IP Address," the document states, "When pinging a device across a site-to-site VPN, the MX will source the ping from the highest numbered VLAN that is configured to be part of the VPN."

To gain Web App Health visibility for a specific network, the Meraki Insight (MI) license must be applied to the MX appliance on that network. According to Cisco Meraki documentation, MX appliances acting as Auto VPN Hubs (Network A) cannot analyze traffic arriving over the VPN from Spoke sites (Network B) for Insight purposes. Therefore, to gather data about traffic originating from Network B, the Insight license must be enabled directly on the Spoke MX (Network B).

Additionally, for High Availability (HA) pairs (as seen in Network A), only a single license is required per network to cover both devices.

A. A single Meraki Insight license must be configured on network A... This is incorrect because an Auto VPN Hub (Network A) cannot perform Insight analysis on traffic that arrives via a VPN tunnel from a Spoke. The Hub sees the encrypted/decapsulated packets but does not generate the necessary application performance metrics for the Spoke's dashboard.

C. A single Meraki Insight license must be configured on network A, and a single license must be configured on network B... This is incorrect because the question asks for the minimal requirement to gain visibility on network B. Licensing Network A is not required to view Network B's health data.

D. Two Meraki Insight licenses must be configured on network A... This is incorrect for two reasons:

1. Meraki licensing requires only one license per network, even if the network contains an HA pair of devices.
2. Licensing Network A does not provide visibility for Network B.

E. Two Meraki Insight licenses must be configured on network A and a single license must be configured on network B... This is incorrect because Network A requires only one license for its HA pair (not two), and the license on Network A is unnecessary for meeting the specific requirement of visibility for Network B.

Cisco Meraki Documentation: "Meraki Insight Introduction," Section: Insight Limitations. "MXs that are acting as Auto VPN Hubs will not be able to analyze traffic arriving over the VPN from Spoke sites. To gather data about traffic from Auto VPN Spoke sites, Insight must be enabled on the spoke MX."

Cisco Meraki Documentation: "Meraki Insight - Rhino Networks Datasheet," Section: Licensing Guidelines. "One license is required per network, regardless of whether that network has a single MX or HA pair."

Cisco Meraki Documentation: "Cisco Meraki MI Insight Licenses," Section: Licensing Guidelines. "One license is required per network, regardless of whether that network has a single MX or HA pair."

Cisco Meraki Insight is designed to monitor the performance of web-based applications. According to official Cisco Meraki documentation, when configuring a custom application for monitoring, the supported protocols are explicitly limited to HTTP and HTTPS. The configuration allows for specifying both standard ports (e.g., 80 for HTTP, 443 for HTTPS) and non-standard ports (e.g., 8080). Therefore, configuring an application using HTTP on a non-standard port like 8080, or HTTPS on its standard port 443, are both valid and necessary configurations to cover different deployment scenarios.

A. This is too generic. While HTTPS uses TLS, Meraki Insight specifically monitors the application-layer protocol (HTTPS), making option C a more precise and correct answer.
D. Meraki Insight's custom application monitoring does not support file-sharing protocols like SMB/CIFS; it is exclusively for HTTP and HTTPS traffic.
E. While this is a technically valid configuration, choosing both C and E would only cover the HTTPS protocol. The best answer set (B and C) demonstrates knowledge of both supported protocols (HTTP and HTTPS).

1. Cisco Meraki Documentation, "Configuring Custom Applications in Meraki Insight."

Section: Adding a Custom Application

Details: This document explicitly states the configurable options for custom applications. It specifies, "Protocol: The protocol used by the application. The options are HTTP and HTTPS." It further clarifies port configuration: "Port: The port number used by the application... If your application uses a non-standard port, you can specify it here." This directly supports options B (HTTP on a non-standard port) and C (HTTPS on its standard port).

2. Cisco Meraki Documentation, "Meraki Insight Overview."

Section: Custom Applications

Details: This overview document confirms the feature's scope, stating, "Meraki Insight will then automatically begin to track the performance of any HTTP or HTTPS traffic to that server." This reinforces that only web protocols are supported, invalidating option D.

In a wireless mesh network, each hop introduces significant throughput degradation. This is because a repeater access point (AP) must receive a transmission and then re-transmit it using the same radio, a half-duplex operation that effectively halves the available airtime. Consequently, each mesh hop reduces the maximum possible throughput by approximately 50%. Due to this substantial performance impact, the official Cisco Meraki best practice for designing a high-performance wireless network is to limit the mesh to a single hop from the gateway AP. While multiple hops are technically possible, they are not recommended where performance is a key consideration.

A. The throughput loss per hop is approximately 50%, not 25%, due to the half-duplex nature of wireless repeating.
B. The throughput loss is 50%, not 25%. Additionally, a 2-hop maximum is not the recommended best practice for performance.
D. While the 50% throughput loss is correct, the best practice for optimal performance is a 1-hop maximum, not 2 hops.

1. Cisco Meraki Documentation, "Mesh Deployment Guide."

Section: Mesh Limitations and Considerations

Quote/Content: "Each mesh hop will reduce the available throughput by about 50%. For best performance, it is recommended to limit a mesh network to a single hop. While it is possible to have multiple mesh hops, it is not recommended for performance-critical networks." This source directly confirms both the 50% throughput loss and the 1-hop maximum best practice.