100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 1010
An IPv6 deployment uses static gateways rather than a dynamic protocol across several redundant campus links. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Confirm address-family features and topology scale on all participating platforms.
- Advertise only summaries that fully cover owned reachable allocations; retain required exceptions or more-specifics at redistribution boundaries.
- Remote forwarding toward the summary reaches all included owned networks and does not hijack unrelated space.
- Select a scalable IPv6-capable routing design with convergence and security matched to the enterprise topology.
- IPv6 next-hop changes recover after a tested uplink failure without manual reconfiguration.
- Validate the summarization envelope against a current prefix inventory and discard-route behavior.
Explanation
Correct Answers
A:Confirm address-family features and topology scale on all participating platforms. This applies directly to the reported network-design requirement.
D:Select a scalable IPv6-capable routing design with convergence and security matched to the enterprise topology. This is the corrective design for the stated topology.
E:IPv6 next-hop changes recover after a tested uplink failure without manual reconfiguration. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Advertise only summaries that fully cover owned reachable allocations; retain required exceptions or more-specifics at redistribution boundaries”, addresses a separate concern. This statement relates to a different requirement: An enterprise uses hundreds of IPv4 /24s and proposes a single /16 summary although several component /24s are outside its administrative control. It does not address the condition described here.
C:This offered choice, “Remote forwarding toward the summary reaches all included owned networks and does not hijack unrelated space”, addresses a separate concern. This statement relates to a different requirement: An enterprise uses hundreds of IPv4 /24s and proposes a single /16 summary although several component /24s are outside its administrative control. It does not address the condition described here.
F:This offered choice, “Validate the summarization envelope against a current prefix inventory and discard-route behavior”, addresses a separate concern. This statement relates to a different requirement: An enterprise uses hundreds of IPv4 /24s and proposes a single /16 summary although several component /24s are outside its administrative control. It does not address the condition described here.
Question 1011
A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
- Separate service attachment across independent core fault domains and validate downstream convergence.
- The unintended default is absent from production campus RIBs while valid branch summaries propagate.
- Apply route filtering at intercampus boundaries to accept only explicitly authorized prefixes.
- A core-device failure leaves required services available through the alternate attachment.
Explanation
Correct Answers
C:The unintended default is absent from production campus RIBs while valid branch summaries propagate. This is the observable acceptance check for the change.
D:Apply route filtering at intercampus boundaries to accept only explicitly authorized prefixes. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: A campus wants deterministic STP roots but all switches retain default bridge priorities. It does not establish the necessary change in this case.
B:This offered choice, “Separate service attachment across independent core fault domains and validate downstream convergence”, addresses a separate concern. That answer belongs to this other scenario: A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. It does not establish the necessary change in this case.
E:This offered choice, “A core-device failure leaves required services available through the alternate attachment”, addresses a separate concern. That answer belongs to this other scenario: A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. It does not establish the necessary change in this case.
Question 1012
A WAN edge has hundreds of VPN prefixes and growing TLOC paths; an all-to-all overlay approaches its platform session capacity. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Model expected site growth and redundancy before choosing hub/spoke or regional topology.
- Authorized overlay tunnels form between intended peers without manually maintained full-mesh IKE policy.
- Document centralized policy exceptions and maintain a tested device-identity revocation process.
- Use the SD-WAN control-plane and key distribution capabilities appropriate to the supported solution.
- Route/session counts stay within supported platform bounds and new branches join without control-plane exhaustion.
- Plan scalable overlay topology and path policy based on actual edge session, route and encryption resource limits.
Explanation
Correct Answers
A:Model expected site growth and redundancy before choosing hub/spoke or regional topology. This applies directly to the reported network-design requirement.
E:Route/session counts stay within supported platform bounds and new branches join without control-plane exhaustion. This is the observable acceptance check for the change.
F:Plan scalable overlay topology and path policy based on actual edge session, route and encryption resource limits. This is the corrective design for the stated topology.
Incorrect Answers
B:This offered choice, “Authorized overlay tunnels form between intended peers without manually maintained full-mesh IKE policy”, addresses a separate concern. This statement relates to a different requirement: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. It does not address the condition described here.
C:This offered choice, “Document centralized policy exceptions and maintain a tested device-identity revocation process”, addresses a separate concern. This statement relates to a different requirement: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. It does not address the condition described here.
D:This offered choice, “Use the SD-WAN control-plane and key distribution capabilities appropriate to the supported solution”, addresses a separate concern. This statement relates to a different requirement: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. It does not address the condition described here.
Question 1013
A hospital asks for guaranteed per-flow service across 300 branches and considers IntServ RSVP state on every core router. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Compare IntServ reservation scalability with a DiffServ class-based design that better matches the enterprise scale.
- The chosen design meets critical-flow service expectations without unsupportable per-flow state on core devices.
- Provide an independently reachable out-of-band management network and approved emergency access process.
- Operators can reach device management after production routing is intentionally removed.
- Validate reconvergence of multicast RPF and join/prune state after unicast routing changes.
Explanation
Correct Answers
A:Compare IntServ reservation scalability with a DiffServ class-based design that better matches the enterprise scale. This applies directly to the reported network-design requirement.
B:The chosen design meets critical-flow service expectations without unsupportable per-flow state on core devices. This is the observable acceptance check for the change.
Incorrect Answers
C:This offered choice, “Provide an independently reachable out-of-band management network and approved emergency access process”, addresses a separate concern. That answer belongs to this other scenario: A core router's production data plane fails, leaving SSH reachable only through the same failed core path. It does not establish the necessary change in this case.
D:This offered choice, “Operators can reach device management after production routing is intentionally removed”, addresses a separate concern. That answer belongs to this other scenario: A core router's production data plane fails, leaving SSH reachable only through the same failed core path. It does not establish the necessary change in this case.
E:This offered choice, “Validate reconvergence of multicast RPF and join/prune state after unicast routing changes”, addresses a separate concern. That answer belongs to this other scenario: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. It does not establish the necessary change in this case.
Question 1014
An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Use supported on-change telemetry for the interface state leaf where device and model support it.
- A controlled status change reaches the collector promptly without waiting for the next periodic poll.
- Data volumes fall while five-minute trend accuracy still meets planning requirements.
- Increase the periodic interval and narrow the subscribed paths to the needed capacity metrics.
- Measure aggregation accuracy after downsampling before changing alert thresholds.
- Confirm the chosen leaf supports on-change and implement appropriate event deduplication.
Explanation
Correct Answers
A:Use supported on-change telemetry for the interface state leaf where device and model support it. This is the corrective design for the stated topology.
B:A controlled status change reaches the collector promptly without waiting for the next periodic poll. This is the observable acceptance check for the change.
F:Confirm the chosen leaf supports on-change and implement appropriate event deduplication. This applies directly to the reported network-design requirement.
Incorrect Answers
C:This offered choice, “Data volumes fall while five-minute trend accuracy still meets planning requirements”, addresses a separate concern. This statement relates to a different requirement: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It does not address the condition described here.
D:This offered choice, “Increase the periodic interval and narrow the subscribed paths to the needed capacity metrics”, addresses a separate concern. This statement relates to a different requirement: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It does not address the condition described here.
E:This offered choice, “Measure aggregation accuracy after downsampling before changing alert thresholds”, addresses a separate concern. This statement relates to a different requirement: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It does not address the condition described here.
Question 1015
An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites.
- Guest clients roam as designed and cannot access restricted enterprise segments.
- Design supported fabric wireless segmentation with dedicated VNs/SGTs and appropriate wireless control integration.
- Approved intersite traffic carries the expected segmentation context without undesired leakage.
- Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer.
Explanation
Correct Answers
A:Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites. This applies directly to the reported network-design requirement.
D:Approved intersite traffic carries the expected segmentation context without undesired leakage. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Guest clients roam as designed and cannot access restricted enterprise segments”, addresses a separate concern. That answer belongs to this other scenario: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It does not establish the necessary change in this case.
C:This offered choice, “Design supported fabric wireless segmentation with dedicated VNs/SGTs and appropriate wireless control integration”, addresses a separate concern. That answer belongs to this other scenario: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It does not establish the necessary change in this case.
E:This offered choice, “Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer”, addresses a separate concern. That answer belongs to this other scenario: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. It does not establish the necessary change in this case.
Question 1016
A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Activate and filter the correct IPv6 unicast MP-BGP address family on the intended peers.
- Check protocol payloads, bidirectional addressing and security logs before deployment.
- Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
- IPv6 NLRI appears only in the authorized address-family tables with validated next-hop reachability.
- Keep IPv4 and IPv6 export/import policies separately reviewed to prevent route leaks.
- Authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path.
Explanation
Correct Answers
A:Activate and filter the correct IPv6 unicast MP-BGP address family on the intended peers. This is the corrective design for the stated topology.
D:IPv6 NLRI appears only in the authorized address-family tables with validated next-hop reachability. This is the observable acceptance check for the change.
E:Keep IPv4 and IPv6 export/import policies separately reviewed to prevent route leaks. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Check protocol payloads, bidirectional addressing and security logs before deployment”, addresses a separate concern. This statement relates to a different requirement: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It does not address the condition described here.
C:This offered choice, “Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary”, addresses a separate concern. This statement relates to a different requirement: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It does not address the condition described here.
F:This offered choice, “Authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path”, addresses a separate concern. This statement relates to a different requirement: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It does not address the condition described here.
Question 1017
A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement.
- Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling.
- Distinguish RP-rooted shared trees from source-specific shortest-path trees and design switch behavior accordingly.
- Multiple authorized sources reach receiver sets through the designed bidirectional shared tree.
- Receiver forwarding follows the intended tree state after source discovery and any supported SPT transition.
Explanation
Correct Answers
A:Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement. This applies directly to the reported network-design requirement.
D:Multiple authorized sources reach receiver sets through the designed bidirectional shared tree. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling”, addresses a separate concern. That answer belongs to this other scenario: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It does not establish the necessary change in this case.
C:This offered choice, “Distinguish RP-rooted shared trees from source-specific shortest-path trees and design switch behavior accordingly”, addresses a separate concern. That answer belongs to this other scenario: A team expects multicast traffic to traverse a shared tree forever even though its design requests shortest-path switching. It does not establish the necessary change in this case.
E:This offered choice, “Receiver forwarding follows the intended tree state after source discovery and any supported SPT transition”, addresses a separate concern. That answer belongs to this other scenario: A team expects multicast traffic to traverse a shared tree forever even though its design requests shortest-path switching. It does not establish the necessary change in this case.
Question 1018
Two industrial sites require transparent delivery of a small set of Ethernet services and reject routing between their private LANs. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.
- The edge establishes intended tunnels over both transports and applications use their approved paths.
- Limit the extended broadcast domain and verify provider OAM and failover.
- Validate underlay next hops and NAT traversal on each WAN interface independently.
- Evaluate an appropriately isolated L2VPN or pseudowire with defined loop, bandwidth and MTU constraints.
- Approved Ethernet frames reach the remote service endpoint while unrelated VLANs remain excluded.
Explanation
Correct Answers
C:Limit the extended broadcast domain and verify provider OAM and failover. This applies directly to the reported network-design requirement.
E:Evaluate an appropriately isolated L2VPN or pseudowire with defined loop, bandwidth and MTU constraints. This is the corrective design for the stated topology.
F:Approved Ethernet frames reach the remote service endpoint while unrelated VLANs remain excluded. This is the observable acceptance check for the change.
Incorrect Answers
A:This statement relates to a different requirement: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It does not address the condition described here.
B:This offered choice, “The edge establishes intended tunnels over both transports and applications use their approved paths”, addresses a separate concern. This statement relates to a different requirement: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It does not address the condition described here.
D:This offered choice, “Validate underlay next hops and NAT traversal on each WAN interface independently”, addresses a separate concern. This statement relates to a different requirement: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It does not address the condition described here.
Question 1019
A sensitive engineering VLAN needs to deny lateral guest traffic within one switched segment; existing router ACLs do not inspect intra-VLAN frames. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Guest clients roam as designed and cannot access restricted enterprise segments.
- Test traffic between unauthorized hosts in the VLAN is denied while approved flows continue.
- Design supported fabric wireless segmentation with dedicated VNs/SGTs and appropriate wireless control integration.
- Evaluate an appropriate VLAN access map or supported intra-segment security mechanism.
- Use targeted route distribution policy and VRF containment for sensitive prefixes.
Explanation
Correct Answers
B:Test traffic between unauthorized hosts in the VLAN is denied while approved flows continue. This is the observable acceptance check for the change.
D:Evaluate an appropriate VLAN access map or supported intra-segment security mechanism. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Guest clients roam as designed and cannot access restricted enterprise segments”, addresses a separate concern. That answer belongs to this other scenario: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It does not establish the necessary change in this case.
C:This offered choice, “Design supported fabric wireless segmentation with dedicated VNs/SGTs and appropriate wireless control integration”, addresses a separate concern. That answer belongs to this other scenario: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It does not establish the necessary change in this case.
E:That answer belongs to this other scenario: An acquisition introduces 172.16.0.0/12 internal networks but the network must hide finance VLAN prefixes from the partner site. It does not establish the necessary change in this case.
Question 1020
A branch engineer redistributes a static default route into EIGRP and advertises it to every site, overriding the intended hub defaults. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
- Only intended branches learn the approved default source and backup behavior.
- Filter or scope external default advertisements to the authorized EIGRP distribution boundaries.
- Trace route origin and affected prefix reachability before removing the advertisement.
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible.
Explanation
Correct Answers
B:Only intended branches learn the approved default source and backup behavior. This is the observable acceptance check for the change.
C:Filter or scope external default advertisements to the authorized EIGRP distribution boundaries. This is the corrective design for the stated topology.
D:Trace route origin and affected prefix reachability before removing the advertisement. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
E:This offered choice, “Validate advertised stub route classes and redundancy if the branch has multiple uplinks”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
F:This offered choice, “Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
