100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 1040
A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed.
- Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
- Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover.
- Validate default-route behavior and NSSA translation roles during staged cutover.
- Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
Explanation
Correct Answers
A:Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed. This is the observable acceptance check for the change.
B:Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area. This is the corrective design for the stated topology.
D:Validate default-route behavior and NSSA translation roles during staged cutover. This applies directly to the reported network-design requirement.
Incorrect Answers
C:This offered choice, “Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover”, addresses a separate concern. This statement relates to a different requirement: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It does not address the condition described here.
E:This offered choice, “Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops”, addresses a separate concern. This statement relates to a different requirement: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It does not address the condition described here.
F:This offered choice, “Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation”, addresses a separate concern. That option relates to this separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not answer the current requirement.
Question 1041
A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Choose the appropriate stub-area variant or redesign to preserve required interarea summaries.
- Assign distinct /64 prefixes per routed IPv6 segment from a hierarchical site allocation.
- A genuine path failure is detected within the target interval while benign load does not flap sessions.
- Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends.
- OSPF adjacencies establish only between intended authenticated peers and survive planned key changes.
Explanation
Correct Answers
D:Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends. This applies directly to the reported network-design requirement.
E:OSPF adjacencies establish only between intended authenticated peers and survive planned key changes. This is the observable acceptance check for the change.
Incorrect Answers
A:That answer belongs to this other scenario: A branch OSPF design selects a totally stubby area but an application requires type-3 interarea routes rather than only the default. It does not establish the necessary change in this case.
B:That answer belongs to this other scenario: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It does not establish the necessary change in this case.
C:That answer belongs to this other scenario: A design team wants fast OSPF failure detection on long-running optical links without dropping stable adjacencies during occasional control-plane delay. It does not establish the necessary change in this case.
Question 1042
A campus firewall isolates management VRFs but its shared-services route leaking exports all loopbacks to the guest VRF. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Police untrusted guest ingress traffic to an appropriate rate and violation action at the policy boundary.
- Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths.
- Guest routing tables contain no unauthorized management loopback routes.
- Constrain route leaking to the precise management service endpoints and permitted directions.
- A WAN outage still produces actionable diagnostics and authorized operator access.
- Review both route advertisements and actual access-policy decisions.
Explanation
Correct Answers
C:Guest routing tables contain no unauthorized management loopback routes. This is the observable acceptance check for the change.
D:Constrain route leaking to the precise management service endpoints and permitted directions. This is the corrective design for the stated topology.
F:Review both route advertisements and actual access-policy decisions. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This statement relates to a different requirement: A guest wireless SSID creates burst traffic exceeding its contracted share and disrupts campus applications. It does not address the condition described here.
B:This offered choice, “Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths”, addresses a separate concern. This statement relates to a different requirement: Two business units share one management VLAN with unrestricted access to each other's routers. It does not address the condition described here.
E:This statement relates to a different requirement: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It does not address the condition described here.
Question 1043
A financial application needs multicast delivery across SDA sites, but all validation has covered unicast endpoint maps only. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Approved intersite traffic carries the expected segmentation context without undesired leakage.
- Explicitly control default route origination and conditional advertisements at authorized borders.
- Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites.
- Design supported multicast replication and routed multicast services across the intended fabric transit.
- Authorized multicast receivers obtain packets while uninvolved VNs and sites remain isolated.
Explanation
Correct Answers
D:Design supported multicast replication and routed multicast services across the intended fabric transit. This applies directly to the reported network-design requirement.
E:Authorized multicast receivers obtain packets while uninvolved VNs and sites remain isolated. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Approved intersite traffic carries the expected segmentation context without undesired leakage”, addresses a separate concern. That answer belongs to this other scenario: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It does not establish the necessary change in this case.
B:This offered choice, “Explicitly control default route origination and conditional advertisements at authorized borders”, addresses a separate concern. That answer belongs to this other scenario: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. It does not establish the necessary change in this case.
C:This offered choice, “Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites”, addresses a separate concern. That answer belongs to this other scenario: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It does not establish the necessary change in this case.
Question 1044
A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Define a backup-class QoS and application admission design appropriate to smaller available bandwidth.
- Voice sessions remain inside the approved quality budget over the constrained backup link.
- Measure real failover link capacity and decide which applications must be deprioritized.
- Apply topology or centralized control policy at the appropriate site/VPN scope.
- Test both accepted routes and explicitly denied spoke-to-spoke paths.
- Guest prefixes and traffic stay isolated from production routes and data tunnels.
Explanation
Correct Answers
A:Define a backup-class QoS and application admission design appropriate to smaller available bandwidth. This is the corrective design for the stated topology.
B:Voice sessions remain inside the approved quality budget over the constrained backup link. This is the observable acceptance check for the change.
C:Measure real failover link capacity and decide which applications must be deprioritized. This applies directly to the reported network-design requirement.
Incorrect Answers
D:This offered choice, “Apply topology or centralized control policy at the appropriate site/VPN scope”, addresses a separate concern. This statement relates to a different requirement: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. It does not address the condition described here.
E:This offered choice, “Test both accepted routes and explicitly denied spoke-to-spoke paths”, addresses a separate concern. This statement relates to a different requirement: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. It does not address the condition described here.
F:This offered choice, “Guest prefixes and traffic stay isolated from production routes and data tunnels”, addresses a separate concern. This statement relates to a different requirement: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. It does not address the condition described here.
Question 1045
A security operations service needs authoritative interface state changes, not a dashboard that replays stale telemetry after collector failure. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Use a periodic telemetry subscription at a measured cadence suitable for trending and capacity planning.
- A controlled interface-down event arrives with correct device identity and event ordering after reconnection.
- Design timestamped telemetry with source identification and collector reconnection/backfill policy as supported.
- The receiver continues receiving timestamped samples during steady-state operation.
- Increase the periodic interval and narrow the subscribed paths to the needed capacity metrics.
Explanation
Correct Answers
B:A controlled interface-down event arrives with correct device identity and event ordering after reconnection. This is the observable acceptance check for the change.
C:Design timestamped telemetry with source identification and collector reconnection/backfill policy as supported. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Use a periodic telemetry subscription at a measured cadence suitable for trending and capacity planning”, addresses a separate concern. That answer belongs to this other scenario: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It does not establish the necessary change in this case.
D:This offered choice, “The receiver continues receiving timestamped samples during steady-state operation”, addresses a separate concern. That answer belongs to this other scenario: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It does not establish the necessary change in this case.
E:That answer belongs to this other scenario: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It does not establish the necessary change in this case.
Question 1046
A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible.
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks.
- Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
- The optimal successor forwards normally and eligible backup takes over without a network-wide query where feasible.
- Use topology-table evidence and controlled link-failure testing to validate backup eligibility.
Explanation
Correct Answers
C:Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks. This is the corrective design for the stated topology.
E:The optimal successor forwards normally and eligible backup takes over without a network-wide query where feasible. This is the observable acceptance check for the change.
F:Use topology-table evidence and controlled link-failure testing to validate backup eligibility. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
B:This offered choice, “Validate advertised stub route classes and redundancy if the branch has multiple uplinks”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
D:This offered choice, “Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
Question 1047
A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Plan redundant supported fabric control-plane nodes with resilient underlay reachability.
- Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding.
- Endpoint moves are learned through the surviving control-plane node and authorized traffic resumes.
- Design VRF-aware border handoffs or supported segmentation-preserving transit consistent with the policy boundary.
- External routes and flows remain segmented by approved virtual network.
Explanation
Correct Answers
A:Plan redundant supported fabric control-plane nodes with resilient underlay reachability. This applies directly to the reported network-design requirement.
C:Endpoint moves are learned through the surviving control-plane node and authorized traffic resumes. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding”, addresses a separate concern. That answer belongs to this other scenario: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It does not establish the necessary change in this case.
D:This offered choice, “Design VRF-aware border handoffs or supported segmentation-preserving transit consistent with the policy boundary”, addresses a separate concern. That answer belongs to this other scenario: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It does not establish the necessary change in this case.
E:This offered choice, “External routes and flows remain segmented by approved virtual network”, addresses a separate concern. That answer belongs to this other scenario: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It does not establish the necessary change in this case.
Question 1048
Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Each branch exchanges only authorized VPN routes while the provider backbone transports traffic without L2 extension.
- Choose a provider MPLS Layer 3 VPN with appropriate VRF route-target isolation and customer-to-provider routing.
- Validate the true need for L2 extension and the risk of spanning a failure domain between facilities.
- Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition.
- Expected tagged traffic traverses the authorized EVC and unrelated tags are isolated.
- Verify UNI/ENNI behavior and available MTU across the provider boundary.
Explanation
Correct Answers
D:Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition. This is the corrective design for the stated topology.
E:Expected tagged traffic traverses the authorized EVC and unrelated tags are isolated. This is the observable acceptance check for the change.
F:Verify UNI/ENNI behavior and available MTU across the provider boundary. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Each branch exchanges only authorized VPN routes while the provider backbone transports traffic without L2 extension”, addresses a separate concern. This statement relates to a different requirement: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It does not address the condition described here.
B:This offered choice, “Choose a provider MPLS Layer 3 VPN with appropriate VRF route-target isolation and customer-to-provider routing”, addresses a separate concern. This statement relates to a different requirement: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It does not address the condition described here.
C:This statement relates to a different requirement: Two hospitals need their existing Ethernet VLANs extended across a provider circuit but their engineers incorrectly request a routed L3VPN. It does not address the condition described here.
Question 1049
A SaaS contact center requires both 200-ms maximum application response and clear separation of media and control classes. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Evaluate Source-Specific Multicast using supported IGMPv3/MLDv2 and PIM-SSM where available.
- Voice delay stays within SLA during video bursts while other classes retain scheduled service.
- End-to-end probes confirm intended latency and drop treatment for each business-critical class.
- Map actual application traffic to appropriate DiffServ classes and engineering budget across each congested hop.
- Evaluate controlled multicast service reflection or translation with explicit source/group mappings.
Explanation
Correct Answers
C:End-to-end probes confirm intended latency and drop treatment for each business-critical class. This is the observable acceptance check for the change.
D:Map actual application traffic to appropriate DiffServ classes and engineering budget across each congested hop. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: A 10,000-receiver IPTV deployment requires one-to-many traffic from known sources but still uses RP discovery for each stream. It does not establish the necessary change in this case.
B:That answer belongs to this other scenario: Video and voice both use one strict-priority queue, causing voice jitter when video surges. It does not establish the necessary change in this case.
E:This offered choice, “Evaluate controlled multicast service reflection or translation with explicit source/group mappings”, addresses a separate concern. That answer belongs to this other scenario: An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. It does not establish the necessary change in this case.
Question 1050
A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Neighbor discovery and SLAAC operate independently on both VLANs with no on-link ambiguity.
- Assign distinct /64 prefixes per routed IPv6 segment from a hierarchical site allocation.
- Reserve a contiguous per-site allocation and validate all router advertisements during cutover.
- Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication.
- Audit DHCP and static address assignments prior to moving the site to its routed block.
- Clients reach the headquarters destination over the routed path using the approved office prefix.
Explanation
Correct Answers
D:Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication. This is the corrective design for the stated topology.
E:Audit DHCP and static address assignments prior to moving the site to its routed block. This applies directly to the reported network-design requirement.
F:Clients reach the headquarters destination over the routed path using the approved office prefix. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Neighbor discovery and SLAAC operate independently on both VLANs with no on-link ambiguity”, addresses a separate concern. This statement relates to a different requirement: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It does not address the condition described here.
B:This offered choice, “Assign distinct /64 prefixes per routed IPv6 segment from a hierarchical site allocation”, addresses a separate concern. This statement relates to a different requirement: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It does not address the condition described here.
C:This offered choice, “Reserve a contiguous per-site allocation and validate all router advertisements during cutover”, addresses a separate concern. This statement relates to a different requirement: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
