Engineering Cisco Meraki Solutions (ECMS) 500-220 — Questions and Answers

Question 1: What is the role of the 'Umbrella' integration available on Meraki MX appliances?

It synchronizes firewall rules with Cisco Umbrella policies
It provides SD-WAN link bonding for Umbrella-branded ISPs
It acts as a backup WAN connection through Umbrella PoPs
It redirects DNS queries to Cisco Umbrella for cloud-based DNS security (Correct answer)

Correct answer: It redirects DNS queries to Cisco Umbrella for cloud-based DNS security

Meraki MX Umbrella integration redirects DNS traffic to Cisco Umbrella, enabling cloud-based DNS-layer security and threat intelligence.

Question 2: In Meraki dashboard, what is an 'RF Profile' used for?

Managing AP firmware rollout groups
Defining SSID broadcast schedules
Configuring channel, power, and band steering settings for a group of APs (Correct answer)
Setting VLAN assignments per AP

Correct answer: Configuring channel, power, and band steering settings for a group of APs

RF Profiles in Meraki allow administrators to define radio settings including channel width, minimum bitrate, and band steering behavior and apply them to APs by group.

Question 3: Which Meraki dashboard tool allows administrators to trace the network path a packet takes from one client to another across Meraki devices?

Event Log search
Live Tools > Ping / Traceroute (Correct answer)
Network topology
Packet capture

Correct answer: Live Tools > Ping / Traceroute

Meraki Live Tools includes ping and traceroute capabilities that can be run directly from the dashboard, allowing path tracing without needing CLI access to individual devices.

Question 4: When a Meraki MR access point shows a 'Rogue AP' alert in Air Marshal, what action can an administrator take directly from the dashboard?

Classify the AP as 'Known' to suppress alerts, or contain it by sending de-authentication frames (Correct answer)
Push a firmware update to the rogue AP
Physically locate and remove the AP using GPS
Automatically block the AP at the ISP level

Correct answer: Classify the AP as 'Known' to suppress alerts, or contain it by sending de-authentication frames

Air Marshal allows administrators to classify rogue APs as 'Known' (benign neighbor) to stop alerting, or actively contain them using de-authentication frames to disrupt client connections.

Question 5: When a Meraki MS switch loses connectivity to the Meraki cloud, what happens to its switching and routing functions?

It reverts to factory default settings automatically
All ports shut down until cloud connectivity is restored
It sends an alert and waits for admin confirmation before continuing
It continues forwarding traffic using its last known configuration (Correct answer)

Correct answer: It continues forwarding traffic using its last known configuration

Meraki devices are designed with local intelligence; they store their configuration locally and continue to operate normally even when cloud connectivity is temporarily unavailable.

Question 6: Which Meraki MX feature enforces consistent security policy for remote worker laptops connecting from home without the need for a physical MX at each home?

Client VPN with Meraki MX as server plus Group Policies applied dynamically via RADIUS (Correct answer)
Auto VPN extended to home offices
Meraki Systems Manager MDM with firewall profiles
Umbrella DNS protection via Cisco Secure Client

Correct answer: Client VPN with Meraki MX as server plus Group Policies applied dynamically via RADIUS

Remote workers connect via Client VPN (or AnyConnect) to the MX; Group Policies returned by the RADIUS authentication server apply consistent firewall rules and segmentation to each user session.

Question 7: When sizing a Meraki MX for a branch deployment, what throughput specification should be the primary consideration?

Number of VLANs supported
Maximum number of Meraki cloud API calls per second
Stateful firewall throughput matching expected WAN bandwidth plus headroom for growth (Correct answer)
Number of SSIDs the MX can broadcast

Correct answer: Stateful firewall throughput matching expected WAN bandwidth plus headroom for growth

The MX stateful firewall throughput rating should match or exceed the site's WAN link capacity, with additional headroom to account for traffic growth and inspection overhead.

Question 8: What does enabling 'Rapid Spanning Tree Protocol (RSTP)' on a Meraki MS switch prevent?

Unauthorized devices from connecting to access ports
Layer 2 switching loops that cause broadcast storms and MAC table instability (Correct answer)
VLAN flooding across trunk links
Broadcast storms caused by routing loops at Layer 3

Correct answer: Layer 2 switching loops that cause broadcast storms and MAC table instability

RSTP (IEEE 802.1w) prevents Layer 2 switching loops by placing redundant switch ports into blocking state while maintaining near-instant convergence when a primary path fails.

Question 9: In Meraki network design, what is the function of a 'Concentrator' MX at a data center in an Auto VPN hub-and-spoke topology?

It inspects all internet traffic for branch users
It terminates all spoke VPN tunnels and provides a routing point for inter-branch and datacenter traffic (Correct answer)
It manages firmware deployment for all hub-connected spokes
It serves as the primary DHCP server for all branch sites

Correct answer: It terminates all spoke VPN tunnels and provides a routing point for inter-branch and datacenter traffic

An MX acting as a VPN concentrator at the data center terminates Auto VPN tunnels from all spoke sites, providing a routing hub for inter-site traffic and access to centralized resources.

Question 10: How does Meraki Systems Manager integrate with Meraki MX appliances to provide VPN access for enrolled devices?

SM pushes a Client VPN profile with MX credentials to enrolled devices, enabling automatic IKEv2 or L2TP/IPsec VPN connection (Correct answer)
SM provisions an SD-WAN policy that routes device traffic through the Meraki cloud before reaching the MX
SM configures a site-to-site AutoVPN tunnel between the device and the nearest MX using BGP routing
SM installs a proprietary Meraki VPN agent on the device that uses proprietary encryption to the MX

Correct answer: SM pushes a Client VPN profile with MX credentials to enrolled devices, enabling automatic IKEv2 or L2TP/IPsec VPN connection

Systems Manager can push a Client VPN profile to enrolled devices containing the MX's Client VPN hostname, pre-shared key or certificate, and user credentials, enabling automatic and seamless VPN establishment.

Question 11: Which of the following is NOT a cloud advantage in Cisco Meraki's solution?

Global network management from any location with internet access.
Real-time updates on network status and health.
Automatic configuration backups in the cloud.
Distributed control across all network devices. (Correct answer)

Correct answer: Distributed control across all network devices.

Cisco Meraki's cloud architecture provides *centralized* control and management, not distributed control. All network devices are managed from a single Meraki dashboard in the cloud, offering a unified and simplified approach to network administration from any location with internet access. Distributed control would imply independent management of individual devices, which is contrary to Meraki's core advantage.

Question 12: What Meraki feature provides external syslog forwarding for integration with a SIEM or log management system?

SNMP v3 trap forwarding
Syslog server configuration under Network > Alerts and administration (Correct answer)
Meraki Dashboard API export only
Cloud archive download

Correct answer: Syslog server configuration under Network > Alerts and administration

Meraki supports syslog export to an external syslog server, allowing security teams to integrate Meraki event data with SIEM platforms for centralized log analysis.

Question 13: What Meraki feature enables administrators to generate scheduled summary reports of network activity, clients, and device status?

Manual CSV download only
Live dashboard auto-export
Summary Report emailed on a schedule from Organization > Summary Report (Correct answer)
Syslog export to external server

Correct answer: Summary Report emailed on a schedule from Organization > Summary Report

Meraki's Summary Report feature generates and emails periodic reports on network usage, top clients, application traffic, and device health on a configurable schedule.

Question 14: In a Meraki deployment, what is the significance of placing the Meraki dashboard in 'Monitor Only' mode for a network?

Device traffic is limited to monitoring protocols like SNMP
Administrators can view the network but cannot make configuration changes until the mode is changed (Correct answer)
The network devices lose connectivity to the cloud
The network stops generating Event Log entries

Correct answer: Administrators can view the network but cannot make configuration changes until the mode is changed

Monitor Only mode is a role-based access restriction that allows read-only dashboard access, preventing configuration changes while still enabling visibility and troubleshooting.

Question 15: What is the purpose of creating a 'Switch Virtual Interface (SVI)' on a Meraki MS Layer 3 switch?

It creates a virtual AP for wireless clients on the switch
It defines a dedicated management VLAN separate from all other VLANs
It mirrors all traffic from a VLAN to a monitoring tool
It provides a Layer 3 IP interface for a VLAN, enabling inter-VLAN routing on the switch itself (Correct answer)

Correct answer: It provides a Layer 3 IP interface for a VLAN, enabling inter-VLAN routing on the switch itself

An SVI is a logical IP interface assigned to a VLAN that allows the switch to route traffic between VLANs and serve as the default gateway for hosts in that VLAN.

Question 16: In a Meraki SD-WAN deployment, what is the role of the 'Hub' site in an Auto VPN topology?

It provides internet breakout for all spoke sites
It serves as a central aggregation point that spoke sites connect to for VPN and shared resource access (Correct answer)
It performs deep packet inspection on behalf of spoke devices
It manages firmware updates for all spoke devices

Correct answer: It serves as a central aggregation point that spoke sites connect to for VPN and shared resource access

The Hub site in Meraki Auto VPN serves as the central termination point for spoke-to-hub VPN tunnels, enabling spokes to access data center resources and shared services through the hub.

Question 17: Which Meraki MX feature allows administrators to create policies that block or allow traffic based on application type?

VLAN tagging
Layer 3 ACL
Port mirroring
Layer 7 firewall (Correct answer)

Correct answer: Layer 7 firewall

The Meraki MX Layer 7 firewall enables traffic control based on application identity, not just IP and port.

Question 18: What is the purpose of configuring outbound firewall rules on a Meraki MX appliance?

To define VPN split tunneling rules
To control traffic leaving the local network toward the internet or WAN (Correct answer)
To block inbound traffic from reaching LAN hosts
To prioritize traffic for QoS marking

Correct answer: To control traffic leaving the local network toward the internet or WAN

Outbound firewall rules on the MX control which local clients can communicate with which external destinations, based on source, destination, and protocol.

Question 19: What Meraki organization-level feature allows a network engineer to push a firmware upgrade to hundreds of sites during a scheduled maintenance window?

Organization-wide firmware upgrade scheduling via Organization > Firmware upgrades (Correct answer)
Individual device reboot scheduling only
CLI push via SSH to each device
Automatic upgrades cannot be scheduled in Meraki

Correct answer: Organization-wide firmware upgrade scheduling via Organization > Firmware upgrades

Meraki's firmware upgrade management at the Organization level allows administrators to schedule upgrades across all devices in specified networks during off-peak maintenance windows.

Question 20: What is the primary Meraki SD-WAN feature that allows administrators to define preferred WAN paths for specific applications based on performance?

Static default route with metric
SD-WAN policies with performance classes (Correct answer)
WAN load balancing
PBR using ACLs

Correct answer: SD-WAN policies with performance classes

Meraki SD-WAN performance classes allow administrators to define latency, jitter, and loss thresholds and automatically route specific application traffic to the best-performing WAN link.

Question 21: When deploying Meraki Systems Manager in an environment with both iOS and Windows endpoints, which enrollment approach is supported for Windows devices?

Windows devices are managed exclusively via SNMP polling from the SM cloud and do not require an agent
Windows devices are enrolled using the SM Windows agent installer, which can be deployed via GPO, Intune, or manual install (Correct answer)
Windows devices can only be enrolled via Group Policy pushing a custom SM ADMX template
Windows enrollment requires installing the SM iOS companion app on a paired iPhone to proxy device management commands

Correct answer: Windows devices are enrolled using the SM Windows agent installer, which can be deployed via GPO, Intune, or manual install

Windows devices are enrolled by installing the Meraki SM Windows agent, which can be deployed via Group Policy (GPO), Microsoft Intune, SCCM, or manually, after which the device appears in the SM dashboard for management.

Question 22: What Meraki MX Live Tool helps verify whether a specific remote host is reachable and measures round-trip time?

DNS lookup
Traceroute only
Ping from appliance (Correct answer)
ARP cache flush

Correct answer: Ping from appliance

The Ping from appliance Live Tool sends ICMP echo requests from the MX to a specified host, confirming reachability and measuring latency directly from the appliance.

Question 23: In the Meraki dashboard, where can administrators view a history of configuration changes made to the network?

Network > Event Log
Organization > Change Log (Correct answer)
Monitor > Summary
Help > Diagnostics

Correct answer: Organization > Change Log

The Organization > Change Log records all configuration changes including who made the change, when, and what was modified, providing a complete audit trail.

Question 24: What Meraki feature enables branch sites to send internet-bound traffic directly to the internet rather than backhauling it through a hub data center?

MPLS replacement with dedicated VPN for internet traffic
Content filtering must be disabled for local breakout
Local internet breakout configured via SD-WAN traffic policies (Correct answer)
Internet traffic is always sent to the hub in Meraki

Correct answer: Local internet breakout configured via SD-WAN traffic policies

Meraki SD-WAN supports local internet breakout by configuring SD-WAN policies to route internet traffic directly out of the local WAN interface rather than through the Auto VPN tunnel to the hub.

Question 25: Which Meraki product provides cloud-managed Layer 2 and Layer 3 switching capabilities?

Meraki MS (Correct answer)
Meraki MX
Meraki MV
Meraki MR

Correct answer: Meraki MS

The Meraki MS series represents Cisco Meraki's line of cloud-managed switches. These devices offer both Layer 2 and Layer 3 switching capabilities, providing robust and scalable network connectivity with simplified management through the Meraki dashboard. They enable centralized control over port configurations, VLANs, and QoS settings.

Question 26: What is the primary function of the Cisco Meraki MX series?

Security and SD-WAN appliances with firewall, VPN, and content filtering features. (Correct answer)
Wireless access points for secure Wi-Fi networks.
Network video cameras for physical security.
Cloud-managed Layer 3 switches.

Correct answer: Security and SD-WAN appliances with firewall, VPN, and content filtering features.

The Cisco Meraki MX series consists of cloud-managed security and SD-WAN appliances. Their primary function is to provide comprehensive network security, including firewall capabilities, VPN connectivity, content filtering, and traffic shaping, making them ideal for securing branch offices and distributed environments.

Question 27: What SM feature provides a hardware and software inventory of enrolled endpoints, including installed applications, OS version, and device hardware specifications?

The SM network adapter, which passively monitors device traffic to infer installed software
The SM compliance engine, which runs periodic scans and reports policy violations
The SM device details page and inventory report, populated automatically by the SM agent (Correct answer)
The SM SCEP integration, which queries device attributes during certificate enrollment

Correct answer: The SM device details page and inventory report, populated automatically by the SM agent

The Systems Manager agent running on enrolled endpoints regularly reports hardware specs, OS version, and installed application inventory to the Meraki dashboard, making it accessible on the device details page and exportable as inventory reports.

Question 28: How are Cisco Meraki licenses typically sold?

One-time purchase licenses without renewal requirements.
Subscription-based licenses with terms such as 1, 3, 5, 7 or 10 years. (Correct answer)
Only available for 3 years.
Perpetual Licenses with no expiration date.

Correct answer: Subscription-based licenses with terms such as 1, 3, 5, 7 or 10 years.

Cisco Meraki licenses are sold on a subscription basis, typically for terms like 1, 3, 5, 7, or 10 years. This model includes access to the cloud management dashboard, ongoing software updates, and 24/7 technical support for the duration of the subscription. It ensures continuous access to Meraki's cloud services and features.

Question 29: When deploying Meraki devices at a site without a local IT administrator, what feature ensures the devices automatically connect and receive configuration without manual setup?

USB configuration file import
Manual staging by Meraki TAC
Zero-Touch Provisioning (ZTP) via Meraki cloud (Correct answer)
TFTP-based configuration bootstrap

Correct answer: Zero-Touch Provisioning (ZTP) via Meraki cloud

Meraki's Zero-Touch Provisioning allows devices to be shipped directly to a site where they automatically connect to the cloud using pre-claimed licensing and receive their full configuration.

Engineering Cisco Meraki Solutions (ECMS) 500-220

The ECMS exam (500-220) validates skills in designing, implementing, operating, and troubleshooting Cisco Meraki cloud-managed networking solutions including MR wireless access points, MS switching, MX security appliances, and SD-WAN deployments.

Questions

90 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cisco.com — Passing score, retake policy, eligibility, renewal, score validity, score release, fees, time limit, exam information · verified Oct 2026
home.pearsonvue.com — Test delivery · verified Oct 2026