500-220 Cisco Engineering Cisco Meraki Solutions (ECMS) v2.2 Free Practice Exam Questions (2025 Updated)

This is because the SD-WAN policy for “All Databases & cloud services” has the following settings:

Uplink selection policy: Prefer WAN1, Fail over if down

Traffic filters: Custom performance classes

Custom performance classes: Database

Database performance criteria: Maximum latency 200 ms, Maximum jitter 20 ms, Maximum loss 1%

This means that the SD-WAN traffic will be routed via WAN1 by default, unless WAN1 is down or fails to meet the database performance criteria. In that case, the traffic will be routed via WAN2, if WAN2 meets the database performance criteria. Therefore, the condition that will cause the traffic to be routed via WAN2 is when WAN1 tunnel latency is 20 ms or more (which exceeds the maximum jitter of 20 ms), and WAN2 tunnel meets the configured performance criteria (maximum latency 200 ms, maximum jitter 20 ms, maximum loss 1%).

Routed Mode:

This mode is the default mode of operation

This mode is generally also the default gateway for devices on the LAN

Client traffic to the internet has the source IP rewritten to match the WAN IP of the appliance

DHCP services can be configured on the MX appliance

Passthrough Mode:

The MX appliance acts as a layer 2 bridge

VLANs cannot be configured

No address translation is provided

This mode is not recommended at the network perimeter

This question is related to the topic of MX Addressing and VLANs in the Cisco Meraki documentation. You can find more information about this topic in the MX Addressing and VLANs article or the General MX Best Practices page.

When band steering is enabled on an SSID, APs will stop advertising that SSID in 2.4GHz beacons. Since 2.4GHz-only clients that rely on a passive scan will not “see” that SSID in beacons, they might not be able to join this SSID unless they do an active scan or have been pre-configured with the SSID name and security settings (for example, a pre-shared key). https://documentation.meraki.com/MR/Radio_Settings/Band_Steering

SM Sentry enrollment can be enabled on any MR network via the Splash page section of the Wireless > Configure > Access control page. https://documentation.meraki.com/MR/MR_Splash_Page/Systems_Manager_Sentry_Enrollment

https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/Configuring_SAML_Single_Sign-on_for_Dashboard

There are two operations in which a license can be applied, License more devices or Renew my dashboard license. This article will compare both operations and describe their behaviors. https://documentation.meraki.com/General_Administration/Licensing/Meraki_Licensing_-_License_More_Devices_vs_Renewal

These are the two operations that enable licenses to be applied in an organization that uses the Co-Termination licensing model. According to the Meraki Co-Termination Licensing Overview, there are two ways to add licenses to an organization:

Renewing the Dashboard license: This option allows you to extend the co-termination date of your organization by purchasing new licenses for the same or longer term as your existing licenses. You can renew your Dashboard license from the Organization > Configure > License Info page or from the Meraki Dashboard homepage.

Licensing more devices: This option allows you to add new devices to your organization by purchasing new licenses for them. You can license more devices from the Organization > Inventory page or from the Meraki Dashboard homepage.

Configuring a syslog server for the network is the Cisco Meraki best practice method to preserve complete historical network event logs. A syslog server can be configured to store messages for reporting purposes from MX Security Appliances, MR Access Points, and MS switches1. The syslog server can collect various types of events, such as VPN connectivity, uplink connectivity, DHCP leases, firewall rules, IDS alerts, and security events2. The syslog server can also help with troubleshooting and monitoring the network performance and security.

If you only need traffic statistics from your spoke site clients then you only need to enable insight on the spoke network as the hub site will not gather data for remote sites. https://community.meraki.com/t5/Wireless-LAN/Meraki-Insight-Licensing/m-p/152684

A license is only required for those networks where Meraki Insight functionality is desired. One license is required per network, regardless of whether that network has a single MX or HA pair. Licenses can be moved between networks, but historical data for the old network will be lost. https://meraki.cisco.com/lib/pdf/meraki_datasheet_mi.pdf

iOS devices that are using Apple's Device Enrollment Program (DEP) can be supervised and enrolled over-the-air anytime they are factory reset. DEP is the best way to permanently force your devices to be owned and managed by your organization, and it is important to assign your DEP settings properly before deployment. https://documentation.meraki.com/SM/Device_Enrollment/Enrolling_and_Supervising_iOS_Devices_using_Apple_Configurator_2.5_or_Later#:~:text=DEP%20is%20the%20best%20way,DEP%20settings%20properly%20before%20deployment .

This can be determined by looking at the concentrator routing table and finding the entry for the destination IP 10.116.32.4. The next hop for this entry is the Auto VPN peer “Store 1532 – appliance”.

This question is related to the topic of Implementing Dynamic Routing Protocols in the Engineering Cisco Meraki Solutions (ECMS) official training documentation. You can find more information about this topic in the ECMS v2.2 Course Overview or the ECMS1 v2.1 Course Overview.

See Behavior - Firmware MX 15.11 or Lower section For MXs running firmware MX15.11 or below, the source IP that MX uses while pinging a destination is the MX IP of highest VLAN ID. If the destination is across a VPN, the MX uses the MX IP of highest VLAN ID participating in VPN. For MXs running firmware MX 15.12+, additional ping options have been added to the live tool. The ping tool now has a drop down to select the source IP address for pinging destinations from the MX. https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Ping_Live_Tool

https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Setup_Guide_for_Microsoft_Azure

Route Priority

Each type of route configured on the MX has a specific priority in comparison with other types of routes. The priority is as follows:

Directly Connected

Client VPN

Static Routes

AutoVPN Routes

Non-Meraki VPN Peers

BGP learned Routes

NAT*

https://documentation.meraki.com/MX/Networks_and_Routing/MX_Routing_Behavior

https://developer.cisco.com/meraki/api-v1/#!clone-organization

You can enable intrusion prevention by setting the Mode drop-down to Prevention under Security & SD-WAN > Configure > Threat protection > Intrusion detection and prevention. Traffic will be automatically blocked by best effort if it is detected as malicious based on the detection ruleset specified above. https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection

What happens if a network loses connectivity to the Meraki cloud?

Because of Meraki’s out of band architecture, most end users are not affected if Meraki wireless APs, switches, or security appliances cannot

communicate with Meraki’s cloud services (e.g., because of a temporary WAN failure):

• Users can access the local network (printers, file shares, etc.)

• If WAN connectivity is available, users can access the Internet

• Network policies (firewall rules, QoS, etc.) continue to be enforced

• Users can authenticate via 802.1X/RADIUS and can roam wirelessly between access points

• Users can initiate and renew DHCP leases

• Established VPN tunnels continue to operate

• Local configuration tools are available (e.g., device IP configuration

https://meraki.cisco.com/lib/pdf/meraki_datasheet_cloud_management.pdf

https://documentation.meraki.com/MV/Initial_Configuration/Privacy_Windows

More hardware devices than device licenses: An organization needs to have enough device licenses to cover all the hardware devices in its network. A device license is consumed by each device that is added to the network. If the number of devices exceeds the number of licenses, the organization will be out of license and will lose access to some features and support until it purchases more licenses or removes some devices4.

Expired device license: A device license has an expiration date that depends on the license term purchased by the organization. If a device license expires, it will no longer be valid and will not count towards the license limit. The organization will need to renew the expired license or purchase a new one to avoid being out of license4.