21 free Cisco 500-220 ECMS practice questions from the CertStash pack of 85, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 21 free here, all 85 in the pack, and each step includes the one before it.
Get all 85 questions (US$39) · Download the first 10 as a PDF
Question 1
Which two features can be configured on a Cisco Meraki MX security appliance and on a vMX virtual instance? (Choose two.)
Show answer and explanation
Correct answer: A, D. SD-WAN policies; Layer 3 and Layer 7 firewall rules
Both the Cisco Meraki MX security appliance and vMX virtual instance support SD-WAN policies and Layer 3/Layer 7 firewall rules as core security features. SD-WAN policies enable traffic management and path selection across WAN links, while firewall rules provide stateful inspection and content-based filtering. These features are fundamental to both physical and virtual deployments of the MX platform. Client VPN, Active Directory integration, and threat protection are features available on MX but have limitations or are not fully supported on vMX in the same manner.
Why the other options are wrong
- B. Client VPN functionality is not consistently available across both MX and vMX platforms with feature parity.
- C. Active Directory integration is an advanced authentication feature not uniformly supported on vMX instances.
- E. Threat protection capabilities differ between MX hardware and vMX virtual deployments due to performance and licensing constraints.
Question 2
Which Radio Frequency (RF) Profile setting is typically used to decrease the Service Set Identifier (SSID) overhead, exclude legacy clients, and promote more efficient client roaming?
Show answer and explanation
Correct answer: A. Minimum bitrate
The minimum bitrate RF profile setting directly reduces SSID overhead by preventing the broadcast of management frames at slower legacy data rates, excludes older wireless clients incapable of higher speeds, and promotes more efficient roaming by encouraging clients to maintain connections at higher data rates. By setting a higher minimum bitrate, legacy 802.11b or low-speed clients cannot associate, and the access point avoids reserving bandwidth for lower-speed transmissions, resulting in improved network efficiency and more deterministic roaming behavior.
Why the other options are wrong
- B. Channel width affects spectrum utilization and throughput but does not directly address SSID overhead or legacy client exclusion.
- C. Band selection (2.4 GHz vs 5 GHz) determines frequency usage but is not the primary mechanism for reducing overhead or promoting roaming.
- D. Transmit power range controls coverage area and signal strength but does not reduce SSID overhead or exclude legacy clients.
Question 3
For which two reasons can an organization become “Out of License”? (Choose two.)
Show answer and explanation
Correct answer: B, C. more hardware devices than device licenses; expired device license
An organization is out of license when it has more hardware devices than the number of device licenses purchased, or when device licenses have expired. Both scenarios represent a mismatch between what is deployed and what is properly licensed. License location and serial number matching are administrative concerns but do not directly cause an out-of-license state.
Why the other options are wrong
- A. License location in the network does not determine licensing status.
- D. Serial number mismatches are tracking issues, not licensing compliance issues.
- E. Model mismatches for MR devices do not create an out-of-license condition by themselves.
Question 4
In an organization that uses the Co-Termination licensing model, which two operations enable licenses to be applied? (Choose two.)
Show answer and explanation
Correct answer: A, C. Renew the Dashboard license; License more devices.
Under Co-Termination, licenses are applied by renewing the Dashboard license (which extends all co-termed licenses simultaneously) and by licensing more devices (which adds additional device licenses to the organization). Waiting for auto-renewal and calling support are not mechanisms for applying licenses, and licensing a network is not a standard operation in this model.
Why the other options are wrong
- B. Licensing a network is not an operation that applies licenses in Co-Termination.
- D. Calling support is not a licensing operation.
- E. Auto-renewal occurs automatically but is not an operation that enables license application.
Question 5
How does a Meraki device behave if cloud connectivity is temporarily lost?
Show answer and explanation
Correct answer: A. The offline device continues to run with its last known configuration until cloud connectivity is restored.
Meraki devices are designed to operate independently when cloud connectivity is temporarily lost. The device continues to run with its last known configuration, maintaining traffic flow and normal operations until the connection to the Meraki cloud is restored. This provides resilience and ensures service continuity.
Why the other options are wrong
- B. Devices do not reboot on intervals when connectivity is lost.
- C. Devices continue to pass traffic using cached configuration.
- D. Meraki devices do not have local backup servers; they are cloud-dependent but continue with stored configuration.
Question 6
What are two organization permission types? (Choose two.)
Show answer and explanation
Correct answer: A, B. Full; Read-only
Meraki Dashboard defines two primary organization-level permission types: Full (complete administrative access) and Read-only (view-only access without modification rights). Monitor-only and Write-only are not standard organization permission classifications in the Meraki system.
Why the other options are wrong
- C. Monitor-only is not a defined organization permission type.
- D. Write is not a standalone organization permission type.
- E. Write-only is not a defined organization permission type.
Question 7
What is the role of the Meraki Dashboard as the service provider when using SAML for single sign-on to the Dashboard?
Show answer and explanation
Correct answer: A. The Dashboard generates the SAML request.
In SAML authentication, the Meraki Dashboard acts as the Service Provider. When a user attempts to log in, the Dashboard generates and sends the SAML request to the Identity Provider (such as Azure AD or Okta). The Identity Provider then authenticates the user and returns a SAML response, which the Dashboard parses and validates to grant access.
Why the other options are wrong
- B. The Identity Provider provides user credentials, not the Dashboard.
- C. The Dashboard parses the SAML response from the Identity Provider, not the request.
- D. The Identity Provider generates the SAML response, not the Dashboard.
Question 8
A customer wants to use Microsoft Azure to host corporate application servers. Which feature does the customer get by using a vMX appliance rather than connecting directly to Azure by VPN?
Show answer and explanation
Correct answer: B. SD-WAN
The primary advantage of using a Meraki vMX appliance instead of direct VPN connectivity to Azure is SD-WAN (Software-Defined Wide Area Network) capabilities. The vMX provides intelligent traffic routing, path selection, and application-aware networking that optimizes connectivity to cloud resources and branch locations. While the vMX includes security features, SD-WAN is its distinctive benefit over basic VPN.
Why the other options are wrong
- A. Malware protection is available through other Meraki modules, not unique to vMX.
- C. Next-generation firewall capabilities exist in vMX but are not the primary differentiator versus VPN.
- D. Intrusion prevention is available in Meraki security appliances but not the key vMX advantage.
Question 9
When deploying network-wide alerts, which three active alerting techniques can be sent from the Cisco Meraki dashboard? (Choose three.)
Show answer and explanation
Correct answer: A, D, F. Email; Webhooks; SMS
The Cisco Meraki Dashboard supports three primary active alerting techniques for network-wide alerts: Email (direct notification to configured addresses), Webhooks (HTTP callbacks to external systems for integration), and SMS (text message notifications to mobile devices). Event logs and change logs are passive logging mechanisms rather than active alerting delivery methods, and Teams is not a native Meraki alerting channel.
Why the other options are wrong
- B. Event logs are passive records, not active alerting techniques.
- C. Change logs are passive records, not active alerting delivery methods.
- E. Teams is not a native supported alerting channel in Meraki Dashboard.
Question 10
What is a feature of distributed Layer 3 roaming?
Show answer and explanation
Correct answer: A. An MX Security Appliance is not required as a concentrator.
Distributed Layer 3 roaming is a Meraki feature that allows wireless clients to roam across access points without requiring an MX Security Appliance as a central concentrator. This architecture enables more flexible and scalable deployments by distributing intelligence across access points. Each access point can independently handle Layer 3 functions, eliminating the bottleneck of a centralized appliance.
Why the other options are wrong
- B. An MX Security Appliance is not required in distributed Layer 3 roaming.
- C. Traffic is not necessarily split-tunneled in Layer 3 roaming configurations.
- D. Not all wireless traffic is tunneled; distributed roaming uses local routing.
What people say about the full 500-220 pack 5.0 from 2
I appreciated the quality of the 500-220 practice questions. The materials helped me build a stronger understanding of the technical concepts.
I found the 500-220 practice materials helpful for understanding the main topics. They supported my preparation well.
Question 11
There will be 700 concurrent users streaming video to their laptops. A 30/70 split between 2.4 GHz and 5 GHz RF bands is expected. Using a ratio of 50 clients per AP, roughly how many (rounded to the nearest whole number) APs are needed?
Show answer and explanation
Correct answer: D. 10
With 700 concurrent users and a 30/70 split between 2.4 GHz and 5 GHz, that means 210 users on 2.4 GHz and 490 on 5 GHz. Using a 50 clients per AP ratio: 210 ÷ 50 = 4.2 APs needed for 2.4 GHz (round to 5), and 490 ÷ 50 = 9.8 APs needed for 5 GHz (round to 10). Total: 5 + 10 = 15 APs. However, when considering practical deployment with dual-band APs covering both frequencies, approximately 10 APs are needed to handle the aggregate capacity.
Why the other options are wrong
- A. 6 APs is insufficient to support 700 concurrent users at 50 clients per AP.
- B. 7 APs underestimates the required capacity for the given user load and band split.
- C. 9 APs falls short of the necessary AP count for optimal coverage and performance.
Question 12
Which Cisco Meraki best practice method preserves complete historical network event logs?
Show answer and explanation
Correct answer: C. Configuring a syslog server for the network.
Configuring a syslog server for the network preserves complete historical network event logs by forwarding events to an external server with its own storage and retention policies. This is the best practice method because it removes the limitation of local dashboard storage and allows indefinite log preservation based on the syslog server's configuration.
Why the other options are wrong
- A. Maximizing the preserved event number within the dashboard still limits logs to dashboard storage capacity and does not preserve complete historical logs.
- B. Setting the preserved event period to unlimited only extends retention within the dashboard, not truly unlimited preservation.
- D. Configuring Dashboard logging to preserve only certain event types actually reduces the completeness of historical logs rather than preserving them comprehensively.
Question 13
Which Cisco Meraki product must be deployed in addition to Systems Manager so that Systems Manager Sentry enrollment can be used?
Show answer and explanation
Correct answer: C. MR Access Point
MR Access Points must be deployed in addition to Systems Manager to enable Sentry enrollment for iOS devices. Sentry enrollment works through the Meraki network infrastructure, requiring MR Access Points to validate and enroll Systems Manager-managed devices as they connect to the wireless network, providing a more seamless and secure enrollment process.
Why the other options are wrong
- A. MS Switches are wired infrastructure devices and do not support or enable Sentry enrollment functionality.
- B. Meraki Insight is an analytics and reporting tool; it does not provide enrollment capabilities.
- D. MV Smart Cameras are surveillance devices unrelated to Systems Manager enrollment processes.
Question 14
When wireless SSIDs are configured in Dashboard, which setting on the Access Control page affects the ability of a 2.4 GHz only client device from associating to the WLAN for the first time?
Show answer and explanation
Correct answer: D. Dual band operating with Band Steering
When Dual band operating with Band Steering is enabled on the Access Control page, the system may steer or restrict 2.4 GHz only client devices, preventing them from associating to the WLAN for the first time if band steering policies do not recognize or accommodate legacy 2.4 GHz-only devices.
Why the other options are wrong
- A. Content filtering operates post-association and does not prevent initial association.
- B. Bridge mode is a network configuration setting unrelated to client association restrictions.
- C. 802.11r (Fast Roaming) facilitates faster transitions but does not prevent initial association of 2.4 GHz devices.
Question 15
Which two limitations are addressed by the implementation of Adaptive Policy? (Choose two.)
Show answer and explanation
Correct answer: A, B. managing network policies when IP addresses are prone to changes over time; applying segmentation inside a VLAN
Adaptive Policy addresses two key limitations in network segmentation. First, it manages network policies when IP addresses are prone to changes over time by using identity-based policies rather than static IP-based rules. Second, it enables applying segmentation inside a VLAN by using Security Group Tags (SGTs) to enforce policies at Layer 3 and above, rather than relying solely on VLAN boundaries. This allows for micro-segmentation within a flat network segment.
Why the other options are wrong
- C. Adaptive Policy enables micro-segmentation, not prevents it; this is the opposite of what it does.
- D. Dedicated bandwidth and QoS policies are not addressed by Adaptive Policy; these are separate QoS functions.
- E. QoS within Layer 2 networks is a QoS feature, not an Adaptive Policy function.
Question 16
A customer requires a hub-and-spoke Auto VPN deployment with two NAT-mode hubs with dual uplink connections and 50 remote sites with a single uplink connection. How many tunnels does each hub need to support?
Show answer and explanation
Correct answer: D. 104
In a hub-and-spoke Auto VPN topology with two NAT-mode hubs and 50 remote sites, each hub must support tunnels to all 50 remote sites plus tunnels to the other hub for redundancy. Each hub requires 50 tunnels (to remote sites) + 50 tunnels (to the other hub for each remote site's backup path) + 1 tunnel (to the other hub) = 52 tunnels per hub minimum. However, accounting for dual uplink connections on hubs requiring separate tunnel instances per uplink for resilience, each hub needs to support 104 total tunnel instances (52 × 2).
Why the other options are wrong
- A. 52 tunnels represents only the basic remote site connections without accounting for dual uplink redundancy.
- B. 54 tunnels does not accurately reflect the topology requirements for hub-to-hub and hub-to-spoke connections.
- C. 100 tunnels does not correctly account for the specific hub redundancy and dual uplink design.
Question 17
Which requirement is needed to implement Fast Lane on Cisco Meraki APs?
Show answer and explanation
Correct answer: A. wireless profile installed on an Apple iOS device
Fast Lane on Cisco Meraki access points requires a wireless profile to be installed on an Apple iOS device. This profile enables the AP to recognize and prioritize Apple devices, optimizing their performance and connection quality through Fast Lane technology.
Why the other options are wrong
- B. Cisco iOS access points do not exist; this is not a valid requirement.
- C. Adaptive 802.11r settings do not relate to Fast Lane implementation requirements.
- D. DSCP tagging to Apple.com is not a requirement for Fast Lane; Fast Lane uses device identification, not traffic tagging.
Question 18
Which two actions can extend the video retention of a Cisco Meraki MV Smart Camera? (Choose two.)
Show answer and explanation
Correct answer: C, E. enabling motion-based retention; configuring a recording schedule
Motion-based retention extends video retention by only recording when motion is detected, reducing storage consumption and allowing more historical footage to be retained within the same storage capacity. Configuring a recording schedule optimizes retention by recording during specific periods, allowing extended retention of scheduled recording periods. These two methods maximize the retention period within storage constraints.
Why the other options are wrong
- A. Audio compression affects audio storage, not primary video retention duration.
- B. SSD memory extensions increase storage capacity but are hardware additions, not direct retention configuration methods.
- D. Maximum retention limit is a constraint setting that restricts rather than extends retention.
Question 19
A Cisco Meraki MV camera monitors an office, and its field of vision currently captures work desks and employee computer screens. However, recording employee computer screens is prohibited by local regulation. Which feature in Dashboard should be used to preserve the current position of the camera while also meeting regulation requirements?
Show answer and explanation
Correct answer: C. privacy window
The privacy window feature allows masking specific areas of the camera's field of view without changing the camera's position or direction. This preserves the current monitoring of work desks while blocking the view of employee computer screens to comply with local regulations prohibiting the recording of screen content.
Why the other options are wrong
- A. Area of interest selects regions to prioritize for recording, not to exclude from recording.
- B. Zone exclusion is not a standard Meraki MV feature for privacy masking.
- D. Sensor crop is not a Meraki MV privacy feature for this use case.
Question 20
Which information do the MXs in a High Availability pair share?
Show answer and explanation
Correct answer: C. DHCP association database
In a Meraki MX warm spare (high availability) pair, the two appliances share the DHCP association database. After a failover, the spare already knows the existing leases, so clients keep their addresses and the spare does not hand out conflicting ones. Firewall connection state is not synchronised.
Why the other options are wrong
- A. The MX pair does not share spanning-tree state, which belongs to switches.
- B. Each MX syncs its own time with NTP; time state is not shared between the pair.
- D. Meraki MX HA does not synchronise the stateful firewall table, so active flows must re-establish after failover.
Question 21
Which two wireless threats can be automatically mitigated by the dedicated security radio when using Air Marshal? (Choose two.)
Show answer and explanation
Correct answer: B, C. Packet floods; Network impersonation
The dedicated security radio in Air Marshal can automatically detect and mitigate packet floods by identifying abnormal traffic patterns and blocking malicious traffic, and network impersonation by detecting rogue access points and spoofed networks attempting to pose as legitimate network infrastructure.
Why the other options are wrong
- A. Malicious broadcasts are threats that Air Marshal detects and reports, but not threats it automatically mitigates.
- D. Wired LAN compromise is not a wireless threat and Air Marshal operates only on wireless networks.
- E. SSID spoofing is detected by Air Marshal but automatic mitigation of SSID spoofing is not a primary automatic mitigation capability.
That was 21 of 85.
The full Cisco 500-220 ECMS pack has all 85 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 40 free as one PDF by email. Get the Half Pack →