100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 1
Two BGP route reflectors share a cluster ID incorrectly with another independent cluster and some legitimate reflected updates disappear. Which design change most directly addresses the stated requirement?
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
- Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
- Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes.
- Give each route reflector a stable unique loopback/router ID and advertise reachability through the IGP.
Explanation
Correct Answer
C:The design is validated when intended client routes propagate without being discarded by false cluster-loop detection.
Incorrect Answers
A:This alternative is aimed at a different design constraint: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. The relevant control for this case is: Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes.
B:That option concerns a separate design case: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. The relevant control here is: Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes.
D:That option concerns a separate design case: A data-center team assigns the same loopback IPv4 address to two route reflectors for convenience but also uses it as unique BGP router identifiers. The relevant control here is: Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes.
Question 2
A controller issues RESTCONF PATCH to many routers but treats HTTP 200 from a reverse proxy login page as proof that config was changed. Which design change most directly addresses the stated requirement?
- Classify the offering as IaaS and document customer responsibilities for guest OS, identities and workloads.
- Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported.
- Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success.
- Use the supported gNMI service transported over gRPC with device capability and identity verification.
Explanation
Correct Answer
C:The design is validated when a readback of the exact resource confirms only the intended configuration changed.
Incorrect Answers
A:That option concerns a separate design case: A customer rents virtual machines from a provider and must patch their operating systems, but procurement classifies the service as SaaS. The relevant control here is: Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success.
B:That option concerns a separate design case: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. The relevant control here is: Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success.
D:That option concerns a separate design case: A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. The relevant control here is: Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success.
Question 3
A disaster-recovery branch depends on a 5G uplink as backup for wired MPLS, but cellular coverage varies by carrier and power failure. Which design change most directly addresses the stated requirement?
- Validate backup access, overlay establishment and route activation under simulated primary loss.
- Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.
- Define a backup-class QoS and application admission design appropriate to smaller available bandwidth.
- Introduce deliberate recovery policy or dampening to prevent repeated unstable failback.
Explanation
Correct Answer
B:The design is validated when during a controlled primary outage, the cellular path carries the approved critical application classes.
Incorrect Answers
A:That option concerns a separate design case: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. The relevant control here is: Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.
C:That option concerns a separate design case: A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. The relevant control here is: Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.
D:That option concerns a separate design case: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. The relevant control here is: Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.
Question 4
An enterprise stretches 200 VLANs end-to-end through many buildings and one STP event triggers campus-wide reconvergence. Which design change most directly addresses the stated requirement?
- Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.
- Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit.
- Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
- Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy.
Explanation
Correct Answer
B:The design is validated when an access-switch failure affects only its intended local domain rather than propagating broad STP churn.
Incorrect Answers
A:That option concerns a separate design case: A campus access layer spans large broadcast domains for print discovery despite an architecture target of small local VLANs. The relevant control here is: Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit.
C:That option concerns a separate design case: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. The relevant control here is: Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit.
D:That option concerns a separate design case: A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. The relevant control here is: Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit.
Question 5
Network automation can push config to all devices because its management subnet is allowed everywhere despite a read-only reporting requirement. Which design change most directly addresses the stated requirement?
- Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement.
- Give reporting and change tools separate scoped management identities, roles, and network paths.
- Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
- Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries.
Explanation
Correct Answer
B:The design is validated when monitoring reads succeed but change commands from the reporting service are denied.
Incorrect Answers
A:That option concerns a separate design case: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. The relevant control here is: Give reporting and change tools separate scoped management identities, roles, and network paths.
C:That option concerns a separate design case: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. The relevant control here is: Give reporting and change tools separate scoped management identities, roles, and network paths.
D:That option concerns a separate design case: Two business units share one management VLAN with unrestricted access to each other's routers. The relevant control here is: Give reporting and change tools separate scoped management identities, roles, and network paths.
Question 6
An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. Which design change most directly addresses the stated requirement?
- Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
- Refine the summary to reflect reachable networks and provide appropriate handling for withdrawn components.
- Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.
- Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
Explanation
Correct Answer
C:The design is validated when the prefix exits through the intended ASBR and remains loop-free on failover.
Incorrect Answers
A:That option concerns a separate design case: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. The relevant control here is: Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.
B:That option concerns a separate design case: Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. The relevant control here is: Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.
D:That option concerns a separate design case: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. The relevant control here is: Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.
Question 7
A new fabric edge is reachable over IP, yet Catalyst Center shows its inventory and provisioning state incomplete. Which design change most directly addresses the stated requirement?
- Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
- Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites.
- Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
- Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.
Explanation
Correct Answer
B:The design is validated when the fabric edge is inventoried, assigned its intended role, and passes overlay endpoint traffic tests.
Incorrect Answers
A:That option concerns a separate design case: In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. The relevant control here is: Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites.
C:That option concerns a separate design case: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. The relevant control here is: Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites.
D:That option concerns a separate design case: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. The relevant control here is: Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites.
Question 8
A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. Which design change most directly addresses the stated requirement?
- Separate management access into a restricted VRF, VPN, or protected OOB context with explicit source policy.
- Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
- Map internal DSCP classes onto the provider-supported service groups explicitly and consistently.
- Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract.
Explanation
Correct Answer
D:The design is validated when end-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment.
Incorrect Answers
A:That option concerns a separate design case: Remote branch routers are managed using the same public internet IP address that exposes a user web service. The relevant control here is: Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract.
B:That option concerns a separate design case: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. The relevant control here is: Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract.
C:That option concerns a separate design case: A WAN provider accepts only three traffic classes but headquarters configures eight local DSCP queues and assumes all survive the handoff. The relevant control here is: Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract.
Question 9
Two WAN routers advertise the same prefix to separate providers, but the branch returns traffic through a firewall that tracks only one side of the asymmetric flow. Which design change most directly addresses the stated requirement?
- Require physical route and carrier diversity, including demarcation and access-path audits.
- Validate backup access, overlay establishment and route activation under simulated primary loss.
- Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition.
- Design multihoming with explicit path symmetry or state-sharing controls and validate both directions.
Explanation
Correct Answer
D:The design is validated when application flows survive permitted egress changes without stateful-firewall drops.
Incorrect Answers
A:That option concerns a separate design case: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. The relevant control here is: Design multihoming with explicit path symmetry or state-sharing controls and validate both directions.
B:That option concerns a separate design case: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. The relevant control here is: Design multihoming with explicit path symmetry or state-sharing controls and validate both directions.
C:That option concerns a separate design case: Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. The relevant control here is: Design multihoming with explicit path symmetry or state-sharing controls and validate both directions.
Question 10
A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. Which design change most directly addresses the stated requirement?
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
- Use a validated stack/virtual chassis/MEC design or independent routed uplinks according to supported platform capabilities.
- Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior.
- Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.
Explanation
Correct Answer
A:The design is validated when rogue DHCP offers from access ports are dropped while authorized client leases succeed.
Incorrect Answers
B:That option concerns a separate design case: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. The relevant control here is: Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
C:That option concerns a separate design case: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. The relevant control here is: Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
D:That option concerns a separate design case: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. The relevant control here is: Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests