Refer to the exhibit. An engineer must connect an on-premises network to the public cloud using Cisco Umbrella as a Cloud Access Security Broker. The indicated configuration was applied to router…

Question

Exhibits

Options

• AConfigure the Open DNS servers with the ip name-server command.
• BConfigure a DHCP scope using the ip dhcp pool command.
• CAdd the opendns in command to the interface configuration.
• DAdd the opendns out command to the interface configuration.

• A
  12% (6)
• B
  78% (39)
• C
  4% (2)
• D
  6% (3)

Explanation

Configuring a DHCP scope with ip dhcp pool is necessary because Cisco Umbrella on IOS works by having the router act as a DNS proxy for LAN clients - the DHCP pool must advertise the router's own IP as the clients' DNS server so that their queries are intercepted and forwarded to Umbrella's cloud resolvers. Without this, client DNS traffic bypasses the router entirely, leaving the Umbrella connector with no DNS to process, which triggers the %OPENDNS-3-DNS_RES_FAILURE error.

Why the distractors are wrong:

• A (ip name-server) configures DNS resolution for the router itself, not for redirecting client DNS traffic through Umbrella - the router may already reach external DNS fine, but Umbrella needs client DNS flowing through it.
• C (opendns in) and D (opendns out) are interface-level commands that activate Umbrella inspection on traffic flows, but if the exhibit shows these are already present (or the DHCP gap is the root cause), adding them won't resolve the failure - Umbrella can't inspect DNS it never receives.

Memory tip: Think "DHCP is the on-ramp to Umbrella" - before the router can redirect anyone to the cloud security broker, it must first be the DNS server clients actually talk to, and DHCP is what puts the router's IP in clients' hands as their DNS destination.

No community discussion yet for this question.