A collaboration engineer is designing a secure B2B video communication solution using a Cisco Expressway-C/E pair. The security policy mandates that all media streams between the organization and its partners must be encrypted. However, one key partner uses a legacy H.323 system that does not support SRTP. Which SIP media encryption mode on the traversal zone connecting to the Expressway-E would best balance the security policy with the need for interoperability with this specific partner?
Answer and explanation
Correct answer: C
The 'Best effort' mode is the optimal choice in this scenario. It attempts to establish an encrypted SRTP call first, satisfying the security policy for all capable partners. If the remote party (the legacy H.323 system) does not support SRTP, Expressway will allow the call to proceed with unencrypted RTP. 'Force encrypted' would block the call to the legacy partner. 'Force unencrypted' would violate the security policy for all other partners. 'Auto' is a valid option but 'Best effort' is more explicit about preferring encryption while allowing fallback.
Question 2
A network administrator is troubleshooting a new Mobile and Remote Access (MRA) deployment. Jabber clients outside the network can successfully register with CUCM and see presence status, but they experience no audio or video when placing calls. Internal Jabber clients function correctly. The following diagram shows the network topology:
Given this scenario, which is the most likely cause of the one-way media issue?
Answer and explanation
Correct answer: C
Successful registration and presence indicate that the signaling path (typically TCP) is working correctly. The absence of audio/video points to a problem with the media path (RTP/SRTP), which uses UDP. The most common cause for this specific symptom in an MRA deployment is the external firewall blocking the inbound UDP port range required for media to reach the Expressway-E from the internet. A missing SRV record or certificate issue would typically cause registration to fail entirely.
Question 3
Multiple answers
An organization is migrating its legacy H.323 video conferencing network to SIP. During the transition, they need their new Cisco Expressway to route calls between the two environments. Which two Expressway components are essential for enabling this H.323-to-SIP interworking? (Select TWO)
Answer and explanation
Correct answers: B, C
A neighbor zone for H.323 is required to establish a peering relationship with the H.323 Gatekeeper or endpoints.
The global 'Interworking mode' setting must be turned on (set to On) to allow the Expressway to translate calls between H.323 and SIP.
Question 4
A junior administrator is configuring a search rule on a Cisco Expressway to route calls starting with the digit '9' followed by a 7-digit number to a specific SIP trunk zone. Which regular expression correctly matches this dialing pattern?
Answer and explanation
Correct answer: D
In Expressway regular expressions, the pattern '9[0-9]{7}' correctly matches the literal digit '9' followed by exactly seven digits (any number from 0 to 9). While '9\d{7}' is a common regex syntax in other systems, Expressway often prefers the more explicit '[0-9]'. '9.{7}' would match '9' followed by any seven characters, not just digits. The parentheses in '(9\d{7})' create a capture group, which is not necessary for a simple match pattern.
Question 5
True or False: When using Cisco SMART licenses for an Expressway cluster, a separate Rich Media Session license is consumed for each active MRA registration on every node in the cluster.
Answer and explanation
Correct answer: B
This statement is false. In an Expressway cluster, licenses are shared across all nodes. A single Rich Media Session license is consumed for each active MRA registration, regardless of which node in the cluster the user is registered to. The license pool is managed centrally for the entire cluster.
Question 6
A financial services firm is implementing a high-availability Expressway-C cluster. To meet compliance requirements, all configuration changes must be logged and a disaster recovery plan must be in place. When performing a backup on a clustered Expressway, what is the correct procedure?
Answer and explanation
Correct answer: C
In an Expressway cluster, the configuration database is replicated from the primary (master) node to all other peer nodes. Therefore, performing a backup operation on the primary node is sufficient to capture the complete configuration for the entire cluster. This single backup file can be used to restore the configuration to the primary node, which will then replicate it to the other nodes upon re-clustering.
Question 7
A collaboration engineer is setting up a new Expressway-E server in a DMZ. The server will be used for both MRA and B2B traffic. According to Cisco best practices, which network interface configuration is recommended for this deployment?
Answer and explanation
Correct answer: C
The recommended and most common configuration for an Expressway-E in a DMZ is to use a single LAN interface with a single private IP address. The external firewall then performs Static 1:1 NAT to map a public IP address to the Expressway-E's private IP. This configuration simplifies routing and enhances security by not exposing the server's real IP address directly to the internet. The Expressway-E must be configured to be NAT-aware in this setup.
Question 8
Case Study: GlobalPharma Inc.
GlobalPharma Inc. is a multinational pharmaceutical company with a central headquarters in New York and major research hubs in London and Tokyo. They have an existing on-premises Cisco Unified Communications Manager (CUCM) cluster at version 12.5, which handles all internal voice and video calls. They are now planning a major B2B collaboration rollout to connect securely with dozens of research partners and regulatory agencies worldwide.
The network team has deployed a new Cisco Expressway-C and Expressway-E pair. The primary requirement is to prevent any unauthorized calls from traversing their Expressway infrastructure, specifically targeting the prevention of toll fraud. The Chief Information Security Officer (CISO) has explicitly forbidden the use of any custom Call Processing Language (CPL) scripts due to maintenance overhead.
The goal is to create a default routing policy that blocks all calls to external numbers unless they are explicitly allowed. Specifically, they want to route calls destined for known partner domains (e.g., partner.com) to a 'B2B_Partners' neighbor zone, while rejecting all other call attempts to unknown domains or E.164 numbers.
Which configuration on the Expressway-C would most effectively meet these toll fraud prevention requirements without using custom CPL scripts?
Answer and explanation
Correct answer: C
This solution creates an explicit 'allow list' and a default 'deny' policy, which is a highly effective method for toll fraud prevention without CPL. The high-priority rules explicitly permit calls to known partners by routing them to the correct zone. The final, low-priority 'catch-all' rule (matching '.*') ensures that any call not matching a specific partner rule is stopped immediately. This directly prevents unauthorized calls to any other destination, fulfilling the CISO's requirement.
Question 9
Multiple answers
An administrator is configuring a SIP trunk from a Cisco Expressway-C to a Cisco UCM cluster for a B2B solution. The UCM requires that all incoming SIP traffic on this trunk be encrypted. Which three settings are required to establish this secure connection? (Select THREE)
Answer and explanation
Correct answers: A, C, E
Setting the TLS verify mode to 'On' on the Expressway-C's neighbor zone forces it to validate the UCM's certificate, which is essential for a secure connection.
This setting on the UCM security profile mandates that signaling for this trunk must be encrypted using TLS.
Port 5061 is the standard port for SIP over TLS (secure SIP). The UCM must be configured to listen for secure connections on this port.
Question 10
A user reports that they are unable to connect to their company's collaboration services via MRA from their home office. The administrator suspects a DNS issue. Which command should the administrator ask the user to run from their home computer's command prompt to verify the crucial SRV record for MRA service discovery?
Answer and explanation
Correct answer: D
The nslookup -q=srv _collab-edge._tls.company.com command is used to query the public DNS for the specific SRV record that Jabber and other MRA clients use to discover the Expressway-E server. A successful response to this query is the first critical step in the MRA registration process. The _cisco-uds record is for internal service discovery, not external MRA.
