Exam 350-401 topic 1 question 341 discussion

* Answer A is for: Group-Based Access Control * Answer C is for IP-Based Access Control Policies Question: Which devices does Cisco Center configure when deploying an "IP-based access control policy"? ASWER IS CREARLY C

correct is A

i think A is the correct answer not C The IP-based access control policy applies to all devices integrating with ISE

sorry cisco but i dont have $80k for checking it myself by buying DNA center deployment :) i came here just to check answer. not covered in OCG of course.

C is correct

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/1-3-1-0/user_guide/b_cisco_dna_center_ug_1_3_1_0/b_cisco_dna_center_ug_1_3_1_0_chapter_01011.html As suggested in previous posts.

The answer is C. Sites to which a policy is applied. If you configure a wired policy, the policy is applied to all wired devices in the site scope. Likewise, if you configure a wireless policy for a selected service set identifier (SSID), the policy is applied to all of the wireless devices with the SSID defined in the scope. https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/2-1-2/user_guide/b_cisco_dna_center_ug_2_1_2/b_cisco_dna_center_ug_2_1_1_chapter_01100.html#concept_zvk_yg4_p3b

As per the CCNP: ENCOR: 30-401 CCNP Enterprise: .... Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) official practice exam.

IP-Based Access Control Policies An IP-based access control policy controls the traffic going into and coming out of a Cisco device in the same way that an Access Control List (ACL) does. As with an ACL, an IP-based access control policy contains lists of permit and deny conditions that are applied to traffic flows based on various criteria, including protocol type, source IP address, destination IP address, or destination port number. IP-based access control policies can be used to filter traffic for various purposes, including security, monitoring, route selection, and network address translation

Based upon info provided below i'm going for C.

Looks like C, from the guide - Editing an IP network group on the Policy > IP Based Access Control window is possible without Cisco ISE. But the creation of IP network groups from the IP Based Access Control window requires Cisco ISE.

This is A

Answer is C as rggod points out directly from the DNAC Guide: Workflow to Configure an IP-Based Access Control Policy Before you begin To create IP network groups from the Policy > IP Based Access Control > IP Network Groups window, make sure that you have integrated Cisco ISE with Cisco DNA Center. However, Cisco ISE is not mandatory if you are adding groups within the Policy > IP Based Access Control > IP Network Groups window while creating a new IP-based access control policy.

Provided answer is correct

The correct answer is A.

A CORRECT

The correct answer here is C. all devices in selected sites Reference: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/1-3-1-0/user_guide/b_cisco_dna_center_ug_1_3_1_0/b_cisco_dna_center_ug_1_3_1_0_chapter_01011.html Section: Deploy an IP-Based Access Control Policy/Application Policies Explanation: Cisco DNA Center takes all of these parameters and translates them into the proper device CLI commands. When you deploy the policy, Cisco DNA Center configures these commands on the devices defined in the site scope.