100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 1030
Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover.
- Validate default-route behavior and NSSA translation roles during staged cutover.
- Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed.
- Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops.
- Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
- Diagram route origins and inspect tags at each redistribution handoff.
Explanation
Correct Answers
A:Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover. This is the observable acceptance check for the change.
D:Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops. This is the corrective design for the stated topology.
F:Diagram route origins and inspect tags at each redistribution handoff. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Validate default-route behavior and NSSA translation roles during staged cutover”, addresses a separate concern. This statement relates to a different requirement: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It does not address the condition described here.
C:This offered choice, “Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed”, addresses a separate concern. This statement relates to a different requirement: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It does not address the condition described here.
E:This offered choice, “Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area”, addresses a separate concern. This statement relates to a different requirement: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It does not address the condition described here.
Question 1031
A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.
- Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.
- Preserve a supported link and endpoint power/wake capability along the intended WoL packet delivery path.
- Target PCs wake under a controlled off-hours test without exposing unnecessary broadcast reachability.
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
Explanation
Correct Answers
C:Preserve a supported link and endpoint power/wake capability along the intended WoL packet delivery path. This applies directly to the reported network-design requirement.
D:Target PCs wake under a controlled off-hours test without exposing unnecessary broadcast reachability. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports”, addresses a separate concern. That answer belongs to this other scenario: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. It does not establish the necessary change in this case.
B:This offered choice, “Reclassify the specific supported bridge-facing port and retain edge protection elsewhere”, addresses a separate concern. That answer belongs to this other scenario: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. It does not establish the necessary change in this case.
E:This offered choice, “Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted”, addresses a separate concern. That answer belongs to this other scenario: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not establish the necessary change in this case.
Question 1032
An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Validate SIM/APN addressing and tunnel establishment from each cellular provider.
- Trace encryption and tenant isolation needs at the service layer before activating capacity.
- Existing permitted edge-to-edge tunnels continue carrying traffic across a management-plane interruption where supported.
- Select an appropriate private APN, outbound-initiated overlay, or routable-address service depending on carrier capabilities.
- Separate optical multiplexing requirements from routing or Ethernet tenant segmentation carried over the wavelengths.
- The branch establishes the required controlled overlay sessions without depending on unsupported unsolicited inbound access.
Explanation
Correct Answers
A:Validate SIM/APN addressing and tunnel establishment from each cellular provider. This applies directly to the reported network-design requirement.
D:Select an appropriate private APN, outbound-initiated overlay, or routable-address service depending on carrier capabilities. This is the corrective design for the stated topology.
F:The branch establishes the required controlled overlay sessions without depending on unsupported unsolicited inbound access. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Trace encryption and tenant isolation needs at the service layer before activating capacity”, addresses a separate concern. This statement relates to a different requirement: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. It does not address the condition described here.
C:This statement relates to a different requirement: A multisite SD-WAN deployment uses one manager for configuration and assumes manager reachability is necessary for every packet of user data. It does not address the condition described here.
E:This offered choice, “Separate optical multiplexing requirements from routing or Ethernet tenant segmentation carried over the wavelengths”, addresses a separate concern. This statement relates to a different requirement: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. It does not address the condition described here.
Question 1033
An enterprise WAN receives DSCP values from untrusted guest clients and propagates them unchanged into privileged queues. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Extend consistent class scheduling to each actual bottleneck along the end-to-end path.
- Map internal DSCP classes onto the provider-supported service groups explicitly and consistently.
- Establish an explicit QoS trust boundary that remarks or rejects unauthorized markings at ingress.
- Guest traffic uses its approved classes without consuming the premium real-time queue.
- Each business traffic class receives the agreed provider class and treatment across the WAN.
Explanation
Correct Answers
C:Establish an explicit QoS trust boundary that remarks or rejects unauthorized markings at ingress. This applies directly to the reported network-design requirement.
D:Guest traffic uses its approved classes without consuming the premium real-time queue. This is the observable acceptance check for the change.
Incorrect Answers
A:That answer belongs to this other scenario: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It does not establish the necessary change in this case.
B:This offered choice, “Map internal DSCP classes onto the provider-supported service groups explicitly and consistently”, addresses a separate concern. That answer belongs to this other scenario: A WAN provider accepts only three traffic classes but headquarters configures eight local DSCP queues and assumes all survive the handoff. It does not establish the necessary change in this case.
E:This offered choice, “Each business traffic class receives the agreed provider class and treatment across the WAN”, addresses a separate concern. That answer belongs to this other scenario: A WAN provider accepts only three traffic classes but headquarters configures eight local DSCP queues and assumes all survive the handoff. It does not establish the necessary change in this case.
Question 1034
A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Use the supported gNMI service transported over gRPC with device capability and identity verification.
- Confirm TLS certificate trust, model revision and supported RPC modes before enabling subscriptions.
- The client negotiates capabilities and receives model-based Get/Subscribe responses from the intended target.
- Verify candidate/running datastore support and rollback-on-error capabilities before edits.
- Approved configuration changes use the negotiated datastore and produce attributable RPC replies.
- Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported.
Explanation
Correct Answers
A:Use the supported gNMI service transported over gRPC with device capability and identity verification. This is the corrective design for the stated topology.
B:Confirm TLS certificate trust, model revision and supported RPC modes before enabling subscriptions. This applies directly to the reported network-design requirement.
C:The client negotiates capabilities and receives model-based Get/Subscribe responses from the intended target. This is the observable acceptance check for the change.
Incorrect Answers
D:This offered choice, “Verify candidate/running datastore support and rollback-on-error capabilities before edits”, addresses a separate concern. This statement relates to a different requirement: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It does not address the condition described here.
E:This offered choice, “Approved configuration changes use the negotiated datastore and produce attributable RPC replies”, addresses a separate concern. This statement relates to a different requirement: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It does not address the condition described here.
F:This offered choice, “Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported”, addresses a separate concern. This statement relates to a different requirement: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It does not address the condition described here.
Question 1035
A branch OSPF adjacency across a pseudowire drops after interface network type changes, even though both neighbors are reachable by ping. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.
- Choose the appropriate stub-area variant or redesign to preserve required interarea summaries.
- Both peers reach FULL and maintain the expected DR or point-to-point behavior.
- Align compatible OSPF network type, timers, authentication and neighbor discovery model for that link.
- Local access failures generate bounded LSDB changes without disrupting unrelated branches.
Explanation
Correct Answers
C:Both peers reach FULL and maintain the expected DR or point-to-point behavior. This is the observable acceptance check for the change.
D:Align compatible OSPF network type, timers, authentication and neighbor discovery model for that link. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope”, addresses a separate concern. That answer belongs to this other scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It does not establish the necessary change in this case.
B:That answer belongs to this other scenario: A branch OSPF design selects a totally stubby area but an application requires type-3 interarea routes rather than only the default. It does not establish the necessary change in this case.
E:This offered choice, “Local access failures generate bounded LSDB changes without disrupting unrelated branches”, addresses a separate concern. That answer belongs to this other scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It does not establish the necessary change in this case.
Question 1036
A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Measure control-plane convergence and endpoint mapping age under a controlled node failure.
- Confirm route leaking and firewall context capacity before moving the border.
- External routes and flows remain segmented by approved virtual network.
- Design VRF-aware border handoffs or supported segmentation-preserving transit consistent with the policy boundary.
- Endpoint moves are learned through the surviving control-plane node and authorized traffic resumes.
- Plan redundant supported fabric control-plane nodes with resilient underlay reachability.
Explanation
Correct Answers
B:Confirm route leaking and firewall context capacity before moving the border. This applies directly to the reported network-design requirement.
C:External routes and flows remain segmented by approved virtual network. This is the observable acceptance check for the change.
D:Design VRF-aware border handoffs or supported segmentation-preserving transit consistent with the policy boundary. This is the corrective design for the stated topology.
Incorrect Answers
A:This offered choice, “Measure control-plane convergence and endpoint mapping age under a controlled node failure”, addresses a separate concern. This statement relates to a different requirement: A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. It does not address the condition described here.
E:This offered choice, “Endpoint moves are learned through the surviving control-plane node and authorized traffic resumes”, addresses a separate concern. This statement relates to a different requirement: A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. It does not address the condition described here.
F:This offered choice, “Plan redundant supported fabric control-plane nodes with resilient underlay reachability”, addresses a separate concern. This statement relates to a different requirement: A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. It does not address the condition described here.
Question 1037
A branch uses a shaper on voice and bulk traffic together, and the business assumes shaping guarantees that voice always transmits first. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Classify traffic by actual application need and reserve EF treatment for suitable expedited traffic.
- Under congestion, voice receives its intended service while total egress stays within the shaped rate.
- Pair shaping with explicit class-based queuing and suitable real-time priority policy.
- End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment.
- Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract.
Explanation
Correct Answers
B:Under congestion, voice receives its intended service while total egress stays within the shaped rate. This is the observable acceptance check for the change.
C:Pair shaping with explicit class-based queuing and suitable real-time priority policy. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It does not establish the necessary change in this case.
D:This offered choice, “End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment”, addresses a separate concern. That answer belongs to this other scenario: A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. It does not establish the necessary change in this case.
E:This offered choice, “Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract”, addresses a separate concern. That answer belongs to this other scenario: A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. It does not establish the necessary change in this case.
Question 1038
Several data centers need high-capacity optical transport over metropolitan dark fiber without converting each tenant VLAN to an IP tunnel. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Provide independent edge and transport paths when required; treat controller redundancy as a separate failure domain.
- Evaluate DWDM wavelength services with optics, reach, dispersion and protection appropriate to the fiber plant.
- Trace the full data path and perform local edge failover testing before approval.
- The site retains approved application reachability after losing one WAN edge or carrier path.
- Review line-system compatibility, service channels and redundancy before selecting wavelengths.
- Protected optical channels carry authorized client services with measured bit-error and failover performance.
Explanation
Correct Answers
B:Evaluate DWDM wavelength services with optics, reach, dispersion and protection appropriate to the fiber plant. This is the corrective design for the stated topology.
E:Review line-system compatibility, service channels and redundancy before selecting wavelengths. This applies directly to the reported network-design requirement.
F:Protected optical channels carry authorized client services with measured bit-error and failover performance. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Provide independent edge and transport paths when required; treat controller redundancy as a separate failure domain”, addresses a separate concern. This statement relates to a different requirement: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It does not address the condition described here.
C:This offered choice, “Trace the full data path and perform local edge failover testing before approval”, addresses a separate concern. This statement relates to a different requirement: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It does not address the condition described here.
D:This offered choice, “The site retains approved application reachability after losing one WAN edge or carrier path”, addresses a separate concern. This statement relates to a different requirement: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It does not address the condition described here.
Question 1039
A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Gateway traffic survives a controlled supervisor transition within the approved outage budget.
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
- Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior.
- Rogue DHCP offers from access ports are dropped while authorized client leases succeed.
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
Explanation
Correct Answers
A:Gateway traffic survives a controlled supervisor transition within the approved outage budget. This is the observable acceptance check for the change.
C:Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking”, addresses a separate concern. That answer belongs to this other scenario: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It does not establish the necessary change in this case.
D:This offered choice, “Rogue DHCP offers from access ports are dropped while authorized client leases succeed”, addresses a separate concern. That answer belongs to this other scenario: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not establish the necessary change in this case.
E:This offered choice, “Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted”, addresses a separate concern. That answer belongs to this other scenario: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not establish the necessary change in this case.
Question 1040
A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed.
- Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
- Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover.
- Validate default-route behavior and NSSA translation roles during staged cutover.
- Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
Explanation
Correct Answers
A:Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed. This is the observable acceptance check for the change.
B:Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area. This is the corrective design for the stated topology.
D:Validate default-route behavior and NSSA translation roles during staged cutover. This applies directly to the reported network-design requirement.
Incorrect Answers
C:This offered choice, “Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover”, addresses a separate concern. This statement relates to a different requirement: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It does not address the condition described here.
E:This offered choice, “Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops”, addresses a separate concern. This statement relates to a different requirement: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It does not address the condition described here.
F:This offered choice, “Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation”, addresses a separate concern. That option relates to this separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not answer the current requirement.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
