100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 1020
A branch engineer redistributes a static default route into EIGRP and advertises it to every site, overriding the intended hub defaults. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
- Only intended branches learn the approved default source and backup behavior.
- Filter or scope external default advertisements to the authorized EIGRP distribution boundaries.
- Trace route origin and affected prefix reachability before removing the advertisement.
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible.
Explanation
Correct Answers
B:Only intended branches learn the approved default source and backup behavior. This is the observable acceptance check for the change.
C:Filter or scope external default advertisements to the authorized EIGRP distribution boundaries. This is the corrective design for the stated topology.
D:Trace route origin and affected prefix reachability before removing the advertisement. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
E:This offered choice, “Validate advertised stub route classes and redundancy if the branch has multiple uplinks”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
F:This offered choice, “Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
Question 1021
A multivendor enterprise wants one consistent YANG representation for interface operational counters but each platform exposes vendor-specific native trees. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- The collector reads comparable interface fields from Cisco and non-Cisco devices using supported model paths.
- Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
- The receiver obtains the expected measurement updates for every required signal.
- Prefer a supported OpenConfig model for common telemetry and document device-specific augmentations where unavoidable.
- Select subscription modes according to the actual leaf and device support, using periodic for counters when necessary.
Explanation
Correct Answers
A:The collector reads comparable interface fields from Cisco and non-Cisco devices using supported model paths. This is the observable acceptance check for the change.
D:Prefer a supported OpenConfig model for common telemetry and document device-specific augmentations where unavoidable. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership”, addresses a separate concern. That answer belongs to this other scenario: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. It does not establish the necessary change in this case.
C:This offered choice, “The receiver obtains the expected measurement updates for every required signal”, addresses a separate concern. That answer belongs to this other scenario: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It does not establish the necessary change in this case.
E:This offered choice, “Select subscription modes according to the actual leaf and device support, using periodic for counters when necessary”, addresses a separate concern. That answer belongs to this other scenario: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It does not establish the necessary change in this case.
Question 1022
A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
- Permitted uplinks forward under normal operation and converge cleanly on individual link loss.
- Clients retain gateway reachability after either distribution switch fails.
- Verify VLAN membership, upstream reachability and failure ownership before activating the virtual address.
- Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior.
Explanation
Correct Answers
B:Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking. This is the corrective design for the stated topology.
D:Clients retain gateway reachability after either distribution switch fails. This is the observable acceptance check for the change.
E:Verify VLAN membership, upstream reachability and failure ownership before activating the virtual address. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Review platform compatibility and perform a maintenance-window failover test before promising hitless service”, addresses a separate concern. This statement relates to a different requirement: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not address the condition described here.
C:This statement relates to a different requirement: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. It does not address the condition described here.
F:This offered choice, “Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior”, addresses a separate concern. This statement relates to a different requirement: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not address the condition described here.
Question 1023
An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy.
- Evaluate GET VPN where supported for group encryption over a trusted routable provider network.
- Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
- Authorized overlay tunnels form between intended peers without manually maintained full-mesh IKE policy.
- Approved endpoints encrypt traffic while retaining the provider's intended any-to-any routing paths.
Explanation
Correct Answers
B:Evaluate GET VPN where supported for group encryption over a trusted routable provider network. This applies directly to the reported network-design requirement.
E:Approved endpoints encrypt traffic while retaining the provider's intended any-to-any routing paths. This is the observable acceptance check for the change.
Incorrect Answers
A:That answer belongs to this other scenario: A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. It does not establish the necessary change in this case.
C:This offered choice, “Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path”, addresses a separate concern. That answer belongs to this other scenario: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It does not establish the necessary change in this case.
D:This offered choice, “Authorized overlay tunnels form between intended peers without manually maintained full-mesh IKE policy”, addresses a separate concern. That answer belongs to this other scenario: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. It does not establish the necessary change in this case.
Question 1024
An enterprise uses hundreds of IPv4 /24s and proposes a single /16 summary although several component /24s are outside its administrative control. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Confirm address-family features and topology scale on all participating platforms.
- Select a scalable IPv6-capable routing design with convergence and security matched to the enterprise topology.
- Remote forwarding toward the summary reaches all included owned networks and does not hijack unrelated space.
- Advertise only summaries that fully cover owned reachable allocations; retain required exceptions or more-specifics at redistribution boundaries.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
- Validate the summarization envelope against a current prefix inventory and discard-route behavior.
Explanation
Correct Answers
C:Remote forwarding toward the summary reaches all included owned networks and does not hijack unrelated space. This is the observable acceptance check for the change.
D:Advertise only summaries that fully cover owned reachable allocations; retain required exceptions or more-specifics at redistribution boundaries. This is the corrective design for the stated topology.
F:Validate the summarization envelope against a current prefix inventory and discard-route behavior. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Confirm address-family features and topology scale on all participating platforms”, addresses a separate concern. This statement relates to a different requirement: An IPv6 deployment uses static gateways rather than a dynamic protocol across several redundant campus links. It does not address the condition described here.
B:This offered choice, “Select a scalable IPv6-capable routing design with convergence and security matched to the enterprise topology”, addresses a separate concern. This statement relates to a different requirement: An IPv6 deployment uses static gateways rather than a dynamic protocol across several redundant campus links. It does not address the condition described here.
E:This offered choice, “Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation”, addresses a separate concern. That option relates to this separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not answer the current requirement.
Question 1025
A 10,000-receiver IPTV deployment requires one-to-many traffic from known sources but still uses RP discovery for each stream. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries.
- Intended receivers obtain the translated stream while unrelated multicast groups remain separate.
- Evaluate Source-Specific Multicast using supported IGMPv3/MLDv2 and PIM-SSM where available.
- Authorized receivers join named sources and receive streams without relying on RP registration.
- Evaluate controlled multicast service reflection or translation with explicit source/group mappings.
Explanation
Correct Answers
C:Evaluate Source-Specific Multicast using supported IGMPv3/MLDv2 and PIM-SSM where available. This applies directly to the reported network-design requirement.
D:Authorized receivers join named sources and receive streams without relying on RP registration. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries”, addresses a separate concern. That answer belongs to this other scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It does not establish the necessary change in this case.
B:This offered choice, “Intended receivers obtain the translated stream while unrelated multicast groups remain separate”, addresses a separate concern. That answer belongs to this other scenario: An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. It does not establish the necessary change in this case.
E:This offered choice, “Evaluate controlled multicast service reflection or translation with explicit source/group mappings”, addresses a separate concern. That answer belongs to this other scenario: An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. It does not establish the necessary change in this case.
Question 1026
A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Failure of the primary underlay forces traffic to a tested eligible secondary path within the service objective.
- Pair next-hop reachability and supported BFD or track-based detection with appropriate BGP convergence settings.
- Test route withdrawal and actual traffic forwarding, not just neighbor state.
- Confirm tunnel endpoints, encryption requirements and path MTU before production.
- Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
Explanation
Correct Answers
A:Failure of the primary underlay forces traffic to a tested eligible secondary path within the service objective. This is the observable acceptance check for the change.
B:Pair next-hop reachability and supported BFD or track-based detection with appropriate BGP convergence settings. This is the corrective design for the stated topology.
C:Test route withdrawal and actual traffic forwarding, not just neighbor state. This applies directly to the reported network-design requirement.
Incorrect Answers
D:This offered choice, “Confirm tunnel endpoints, encryption requirements and path MTU before production”, addresses a separate concern. This statement relates to a different requirement: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. It does not address the condition described here.
E:This offered choice, “Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed”, addresses a separate concern. This statement relates to a different requirement: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. It does not address the condition described here.
F:This offered choice, “Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation”, addresses a separate concern. That option relates to this separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not answer the current requirement.
Question 1027
Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior.
- Permitted uplinks forward under normal operation and converge cleanly on individual link loss.
- Choose a validated loop-free logical bundle or routed-access topology if active-active use is required.
- Clients retain gateway reachability after either distribution switch fails.
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
Explanation
Correct Answers
B:Permitted uplinks forward under normal operation and converge cleanly on individual link loss. This is the observable acceptance check for the change.
C:Choose a validated loop-free logical bundle or routed-access topology if active-active use is required. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior”, addresses a separate concern. That answer belongs to this other scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not establish the necessary change in this case.
D:This offered choice, “Clients retain gateway reachability after either distribution switch fails”, addresses a separate concern. That answer belongs to this other scenario: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It does not establish the necessary change in this case.
E:This offered choice, “Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking”, addresses a separate concern. That answer belongs to this other scenario: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It does not establish the necessary change in this case.
Question 1028
A video conference SD-WAN policy accepts tunnels with 1% packet loss but ignores sustained jitter above application tolerance. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Design redundant supported key servers and registration/rekey recovery for the group encryption domain.
- Compare BFD-derived observations with production application performance before selecting thresholds.
- Include latency, jitter and loss thresholds appropriate to the application class.
- Surviving key servers provide policies and secure data traffic remains operational through maintenance.
- Document centralized policy exceptions and maintain a tested device-identity revocation process.
- Selected tunnels meet the approved performance envelope during representative conference traffic.
Explanation
Correct Answers
B:Compare BFD-derived observations with production application performance before selecting thresholds. This applies directly to the reported network-design requirement.
C:Include latency, jitter and loss thresholds appropriate to the application class. This is the corrective design for the stated topology.
F:Selected tunnels meet the approved performance envelope during representative conference traffic. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Design redundant supported key servers and registration/rekey recovery for the group encryption domain”, addresses a separate concern. This statement relates to a different requirement: GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. It does not address the condition described here.
D:This offered choice, “Surviving key servers provide policies and secure data traffic remains operational through maintenance”, addresses a separate concern. This statement relates to a different requirement: GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. It does not address the condition described here.
E:This offered choice, “Document centralized policy exceptions and maintain a tested device-identity revocation process”, addresses a separate concern. This statement relates to a different requirement: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. It does not address the condition described here.
Question 1029
A design team calculates voice QoS bandwidth solely from codec payload bit rate and ignores RTP, IP and tunnel overhead. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Excess guest bursts are contained while voice packet-delay variation remains acceptable.
- Measured WAN utilization supports peak approved call volume without exceeding the voice service budget.
- Engineer a policer with an appropriate burst tolerance and separate real-time queue protection.
- Size admission and queue bandwidth using packetization and encapsulation overhead plus concurrent-call estimates.
- Extend consistent class scheduling to each actual bottleneck along the end-to-end path.
Explanation
Correct Answers
B:Measured WAN utilization supports peak approved call volume without exceeding the voice service budget. This is the observable acceptance check for the change.
D:Size admission and queue bandwidth using packetization and encapsulation overhead plus concurrent-call estimates. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Excess guest bursts are contained while voice packet-delay variation remains acceptable”, addresses a separate concern. That answer belongs to this other scenario: An enterprise edge allows a contracted 50-Mbps guest rate but users report voice degradation during microbursts despite the average staying under 50 Mbps. It does not establish the necessary change in this case.
C:This offered choice, “Engineer a policer with an appropriate burst tolerance and separate real-time queue protection”, addresses a separate concern. That answer belongs to this other scenario: An enterprise edge allows a contracted 50-Mbps guest rate but users report voice degradation during microbursts despite the average staying under 50 Mbps. It does not establish the necessary change in this case.
E:That answer belongs to this other scenario: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It does not establish the necessary change in this case.
Question 1030
Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover.
- Validate default-route behavior and NSSA translation roles during staged cutover.
- Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed.
- Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops.
- Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
- Diagram route origins and inspect tags at each redistribution handoff.
Explanation
Correct Answers
A:Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover. This is the observable acceptance check for the change.
D:Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops. This is the corrective design for the stated topology.
F:Diagram route origins and inspect tags at each redistribution handoff. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Validate default-route behavior and NSSA translation roles during staged cutover”, addresses a separate concern. This statement relates to a different requirement: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It does not address the condition described here.
C:This offered choice, “Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed”, addresses a separate concern. This statement relates to a different requirement: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It does not address the condition described here.
E:This offered choice, “Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area”, addresses a separate concern. This statement relates to a different requirement: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests