Cisco 300-420 Exam Dumps, Practice Test Questions

100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Cisco 300-420 Premium Bundle
$79.97
$59.98

300-420 Premium Bundle

  • Premium File: 416 Questions & Answers. Last update: Nov 9, 2026
  • Training Course: 75 Video Lectures
  • Study Guide: 812 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

300-420 Premium Bundle

Cisco 300-420 Premium Bundle
  • Premium File: 416 Questions & Answers. Last update: Nov 9, 2026
  • Training Course: 75 Video Lectures
  • Study Guide: 812 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Cisco 300-420 Practice Test 1

Question 1

Two BGP route reflectors share a cluster ID incorrectly with another independent cluster and some legitimate reflected updates disappear. Which design change most directly addresses the stated requirement?

  1. Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
  2. Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
  3. Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes.
  4. Give each route reflector a stable unique loopback/router ID and advertise reachability through the IGP.

Explanation

Correct Answer

C:

The design is validated when intended client routes propagate without being discarded by false cluster-loop detection.

Incorrect Answers

A:

This alternative is aimed at a different design constraint: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. The relevant control for this case is: Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes.

B:

That option concerns a separate design case: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. The relevant control here is: Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes.

D:

That option concerns a separate design case: A data-center team assigns the same loopback IPv4 address to two route reflectors for convenience but also uses it as unique BGP router identifiers. The relevant control here is: Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes.

Question 2

A controller issues RESTCONF PATCH to many routers but treats HTTP 200 from a reverse proxy login page as proof that config was changed. Which design change most directly addresses the stated requirement?

  1. Classify the offering as IaaS and document customer responsibilities for guest OS, identities and workloads.
  2. Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported.
  3. Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success.
  4. Use the supported gNMI service transported over gRPC with device capability and identity verification.

Explanation

Correct Answer

C:

The design is validated when a readback of the exact resource confirms only the intended configuration changed.

Incorrect Answers

A:

That option concerns a separate design case: A customer rents virtual machines from a provider and must patch their operating systems, but procurement classifies the service as SaaS. The relevant control here is: Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success.

B:

That option concerns a separate design case: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. The relevant control here is: Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success.

D:

That option concerns a separate design case: A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. The relevant control here is: Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success.

Question 3

A disaster-recovery branch depends on a 5G uplink as backup for wired MPLS, but cellular coverage varies by carrier and power failure. Which design change most directly addresses the stated requirement?

  1. Validate backup access, overlay establishment and route activation under simulated primary loss.
  2. Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.
  3. Define a backup-class QoS and application admission design appropriate to smaller available bandwidth.
  4. Introduce deliberate recovery policy or dampening to prevent repeated unstable failback.

Explanation

Correct Answer

B:

The design is validated when during a controlled primary outage, the cellular path carries the approved critical application classes.

Incorrect Answers

A:

That option concerns a separate design case: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. The relevant control here is: Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.

C:

That option concerns a separate design case: A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. The relevant control here is: Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.

D:

That option concerns a separate design case: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. The relevant control here is: Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.

Question 4

An enterprise stretches 200 VLANs end-to-end through many buildings and one STP event triggers campus-wide reconvergence. Which design change most directly addresses the stated requirement?

  1. Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.
  2. Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit.
  3. Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
  4. Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy.

Explanation

Correct Answer

B:

The design is validated when an access-switch failure affects only its intended local domain rather than propagating broad STP churn.

Incorrect Answers

A:

That option concerns a separate design case: A campus access layer spans large broadcast domains for print discovery despite an architecture target of small local VLANs. The relevant control here is: Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit.

C:

That option concerns a separate design case: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. The relevant control here is: Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit.

D:

That option concerns a separate design case: A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. The relevant control here is: Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit.

Question 5

Network automation can push config to all devices because its management subnet is allowed everywhere despite a read-only reporting requirement. Which design change most directly addresses the stated requirement?

  1. Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement.
  2. Give reporting and change tools separate scoped management identities, roles, and network paths.
  3. Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
  4. Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries.

Explanation

Correct Answer

B:

The design is validated when monitoring reads succeed but change commands from the reporting service are denied.

Incorrect Answers

A:

That option concerns a separate design case: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. The relevant control here is: Give reporting and change tools separate scoped management identities, roles, and network paths.

C:

That option concerns a separate design case: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. The relevant control here is: Give reporting and change tools separate scoped management identities, roles, and network paths.

D:

That option concerns a separate design case: Two business units share one management VLAN with unrestricted access to each other's routers. The relevant control here is: Give reporting and change tools separate scoped management identities, roles, and network paths.

Question 6

An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. Which design change most directly addresses the stated requirement?

  1. Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
  2. Refine the summary to reflect reachable networks and provide appropriate handling for withdrawn components.
  3. Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.
  4. Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.

Explanation

Correct Answer

C:

The design is validated when the prefix exits through the intended ASBR and remains loop-free on failover.

Incorrect Answers

A:

That option concerns a separate design case: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. The relevant control here is: Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.

B:

That option concerns a separate design case: Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. The relevant control here is: Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.

D:

That option concerns a separate design case: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. The relevant control here is: Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.

Question 7

A new fabric edge is reachable over IP, yet Catalyst Center shows its inventory and provisioning state incomplete. Which design change most directly addresses the stated requirement?

  1. Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
  2. Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites.
  3. Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
  4. Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.

Explanation

Correct Answer

B:

The design is validated when the fabric edge is inventoried, assigned its intended role, and passes overlay endpoint traffic tests.

Incorrect Answers

A:

That option concerns a separate design case: In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. The relevant control here is: Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites.

C:

That option concerns a separate design case: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. The relevant control here is: Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites.

D:

That option concerns a separate design case: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. The relevant control here is: Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites.

Question 8

A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. Which design change most directly addresses the stated requirement?

  1. Separate management access into a restricted VRF, VPN, or protected OOB context with explicit source policy.
  2. Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
  3. Map internal DSCP classes onto the provider-supported service groups explicitly and consistently.
  4. Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract.

Explanation

Correct Answer

D:

The design is validated when end-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment.

Incorrect Answers

A:

That option concerns a separate design case: Remote branch routers are managed using the same public internet IP address that exposes a user web service. The relevant control here is: Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract.

B:

That option concerns a separate design case: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. The relevant control here is: Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract.

C:

That option concerns a separate design case: A WAN provider accepts only three traffic classes but headquarters configures eight local DSCP queues and assumes all survive the handoff. The relevant control here is: Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract.

Question 9

Two WAN routers advertise the same prefix to separate providers, but the branch returns traffic through a firewall that tracks only one side of the asymmetric flow. Which design change most directly addresses the stated requirement?

  1. Require physical route and carrier diversity, including demarcation and access-path audits.
  2. Validate backup access, overlay establishment and route activation under simulated primary loss.
  3. Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition.
  4. Design multihoming with explicit path symmetry or state-sharing controls and validate both directions.

Explanation

Correct Answer

D:

The design is validated when application flows survive permitted egress changes without stateful-firewall drops.

Incorrect Answers

A:

That option concerns a separate design case: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. The relevant control here is: Design multihoming with explicit path symmetry or state-sharing controls and validate both directions.

B:

That option concerns a separate design case: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. The relevant control here is: Design multihoming with explicit path symmetry or state-sharing controls and validate both directions.

C:

That option concerns a separate design case: Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. The relevant control here is: Design multihoming with explicit path symmetry or state-sharing controls and validate both directions.

Question 10

A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. Which design change most directly addresses the stated requirement?

  1. Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
  2. Use a validated stack/virtual chassis/MEC design or independent routed uplinks according to supported platform capabilities.
  3. Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior.
  4. Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.

Explanation

Correct Answer

A:

The design is validated when rogue DHCP offers from access ports are dropped while authorized client leases succeed.

Incorrect Answers

B:

That option concerns a separate design case: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. The relevant control here is: Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.

C:

That option concerns a separate design case: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. The relevant control here is: Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.

D:

That option concerns a separate design case: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. The relevant control here is: Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.

Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests

UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.