100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 1060
A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Review route reachability and summary boundaries before introducing stub behavior.
- Failed-route convergence completes without broad stuck-in-active propagation.
- Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms.
- Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible.
- Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
Explanation
Correct Answers
A:Validate advertised stub route classes and redundancy if the branch has multiple uplinks. This applies directly to the reported network-design requirement.
E:Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible. This is the observable acceptance check for the change.
F:Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs. This is the corrective design for the stated topology.
Incorrect Answers
B:This offered choice, “Review route reachability and summary boundaries before introducing stub behavior”, addresses a separate concern. This statement relates to a different requirement: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It does not address the condition described here.
C:This offered choice, “Failed-route convergence completes without broad stuck-in-active propagation”, addresses a separate concern. This statement relates to a different requirement: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It does not address the condition described here.
D:This statement relates to a different requirement: An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. It does not address the condition described here.
Question 1061
A distribution pair advertises the same summary at two locations, but one has a 100-Mbps backhaul and receives half of campus traffic. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Normal flow distribution avoids congesting the slow backhaul and failover still reaches the destination.
- Align advertised costs and path policy with available bandwidth and acceptable backup behavior.
- Use a validated stack/virtual chassis/MEC design or independent routed uplinks according to supported platform capabilities.
- Evaluate physical fault domains and provide independent power, links, and control-plane recovery within the chosen abstraction.
- Both access links forward as designed and a chassis failure retains authorized connectivity.
Explanation
Correct Answers
A:Normal flow distribution avoids congesting the slow backhaul and failover still reaches the destination. This is the observable acceptance check for the change.
B:Align advertised costs and path policy with available bandwidth and acceptable backup behavior. This applies directly to the reported network-design requirement.
Incorrect Answers
C:This offered choice, “Use a validated stack/virtual chassis/MEC design or independent routed uplinks according to supported platform capabilities”, addresses a separate concern. That answer belongs to this other scenario: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It does not establish the necessary change in this case.
D:This offered choice, “Evaluate physical fault domains and provide independent power, links, and control-plane recovery within the chosen abstraction”, addresses a separate concern. That answer belongs to this other scenario: A virtualized distribution pair uses one logical control plane and engineers assume it offers separate failure domains like two chassis in different buildings. It does not establish the necessary change in this case.
E:This offered choice, “Both access links forward as designed and a chassis failure retains authorized connectivity”, addresses a separate concern. That answer belongs to this other scenario: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It does not establish the necessary change in this case.
Question 1062
A design team wants fast OSPF failure detection on long-running optical links without dropping stable adjacencies during occasional control-plane delay. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- OSPF adjacencies establish only between intended authenticated peers and survive planned key changes.
- Evaluate BFD and appropriate OSPF timers with a realistic detection budget and hardware scale.
- Stage keys and document overlap windows before activation.
- Validate BFD support, timer negotiation and control-plane capacity on each neighbor pair.
- Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends.
- A genuine path failure is detected within the target interval while benign load does not flap sessions.
Explanation
Correct Answers
B:Evaluate BFD and appropriate OSPF timers with a realistic detection budget and hardware scale. This is the corrective design for the stated topology.
D:Validate BFD support, timer negotiation and control-plane capacity on each neighbor pair. This applies directly to the reported network-design requirement.
F:A genuine path failure is detected within the target interval while benign load does not flap sessions. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “OSPF adjacencies establish only between intended authenticated peers and survive planned key changes”, addresses a separate concern. This statement relates to a different requirement: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It does not address the condition described here.
C:This offered choice, “Stage keys and document overlap windows before activation”, addresses a separate concern. This statement relates to a different requirement: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It does not address the condition described here.
E:This offered choice, “Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends”, addresses a separate concern. This statement relates to a different requirement: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It does not address the condition described here.
Question 1063
Remote branch routers are managed using the same public internet IP address that exposes a user web service. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Evaluate controlled multicast service reflection or translation with explicit source/group mappings.
- Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract.
- Separate management access into a restricted VRF, VPN, or protected OOB context with explicit source policy.
- Only authorized operators can connect to device management while public services remain available.
- End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment.
Explanation
Correct Answers
C:Separate management access into a restricted VRF, VPN, or protected OOB context with explicit source policy. This applies directly to the reported network-design requirement.
D:Only authorized operators can connect to device management while public services remain available. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Evaluate controlled multicast service reflection or translation with explicit source/group mappings”, addresses a separate concern. That answer belongs to this other scenario: An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. It does not establish the necessary change in this case.
B:This offered choice, “Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract”, addresses a separate concern. That answer belongs to this other scenario: A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. It does not establish the necessary change in this case.
E:This offered choice, “End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment”, addresses a separate concern. That answer belongs to this other scenario: A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. It does not establish the necessary change in this case.
Question 1064
A development team consumes a managed runtime that deploys application code without administering underlying servers and calls it raw IaaS. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Approved configuration changes use the negotiated datastore and produce attributable RPC replies.
- Deployment responsibilities correctly assign code and app security to the customer while platform maintenance follows provider terms.
- Verify candidate/running datastore support and rollback-on-error capabilities before edits.
- Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported.
- Classify the hosted runtime as PaaS and document the application versus platform operations boundary.
- Validate the service contract's supported runtime and data-management obligations.
Explanation
Correct Answers
B:Deployment responsibilities correctly assign code and app security to the customer while platform maintenance follows provider terms. This is the observable acceptance check for the change.
E:Classify the hosted runtime as PaaS and document the application versus platform operations boundary. This is the corrective design for the stated topology.
F:Validate the service contract's supported runtime and data-management obligations. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Approved configuration changes use the negotiated datastore and produce attributable RPC replies”, addresses a separate concern. This statement relates to a different requirement: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It does not address the condition described here.
C:This offered choice, “Verify candidate/running datastore support and rollback-on-error capabilities before edits”, addresses a separate concern. This statement relates to a different requirement: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It does not address the condition described here.
D:This offered choice, “Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported”, addresses a separate concern. This statement relates to a different requirement: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It does not address the condition described here.
Question 1065
A site-to-site tunnel must protect financial payload confidentiality and integrity across the public internet. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.
- Choose a supported IPsec design with appropriate IKE authentication, encryption proposals and key rotation.
- Design distinct supported transport interfaces and TLOC colors with centralized path policy.
- The edge establishes intended tunnels over both transports and applications use their approved paths.
- Protected traffic crosses an established security association and is unreadable on the public underlay.
Explanation
Correct Answers
B:Choose a supported IPsec design with appropriate IKE authentication, encryption proposals and key rotation. This applies directly to the reported network-design requirement.
E:Protected traffic crosses an established security association and is unreadable on the public underlay. This is the observable acceptance check for the change.
Incorrect Answers
A:That answer belongs to this other scenario: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It does not establish the necessary change in this case.
C:This offered choice, “Design distinct supported transport interfaces and TLOC colors with centralized path policy”, addresses a separate concern. That answer belongs to this other scenario: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It does not establish the necessary change in this case.
D:This offered choice, “The edge establishes intended tunnels over both transports and applications use their approved paths”, addresses a separate concern. That answer belongs to this other scenario: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It does not establish the necessary change in this case.
Question 1066
A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Inventory application dependencies and DNS behavior before choosing the translation mechanism.
- IPv6 connections to protected applications are blocked or allowed consistently with approved policy.
- The IPv6 client resolves and accesses the approved IPv4 service without adopting IPv4 on the client.
- Test both A and AAAA record resolution from representative client networks.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
- Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions.
Explanation
Correct Answers
A:Inventory application dependencies and DNS behavior before choosing the translation mechanism. This applies directly to the reported network-design requirement.
C:The IPv6 client resolves and accesses the approved IPv4 service without adopting IPv4 on the client. This is the observable acceptance check for the change.
F:Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions. This is the corrective design for the stated topology.
Incorrect Answers
B:This offered choice, “IPv6 connections to protected applications are blocked or allowed consistently with approved policy”, addresses a separate concern. This statement relates to a different requirement: A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. It does not address the condition described here.
D:This offered choice, “Test both A and AAAA record resolution from representative client networks”, addresses a separate concern. This statement relates to a different requirement: A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. It does not address the condition described here.
E:This offered choice, “Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation”, addresses a separate concern. That option relates to this separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not answer the current requirement.
Question 1067
Branch-specific prefix updates flood every campus router; a proposed aggregate crosses two distinct WAN egress sites. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Place route summarization at contiguous ownership boundaries and preserve specific exceptions needed for proper egress.
- Design a routed intercampus topology with appropriate direct or regional paths and deterministic failover.
- Explicitly control default route origination and conditional advertisements at authorized borders.
- Prefix changes within a campus no longer cause unnecessary global churn while remote packets use the proper border.
- The corporate campus receives only the approved default from designated egress nodes.
Explanation
Correct Answers
A:Place route summarization at contiguous ownership boundaries and preserve specific exceptions needed for proper egress. This applies directly to the reported network-design requirement.
D:Prefix changes within a campus no longer cause unnecessary global churn while remote packets use the proper border. This is the observable acceptance check for the change.
Incorrect Answers
B:That answer belongs to this other scenario: Three campus sites peer with a shared WAN hub; every site transits through the hub even for cross-campus traffic and voice suffers latency. It does not establish the necessary change in this case.
C:This offered choice, “Explicitly control default route origination and conditional advertisements at authorized borders”, addresses a separate concern. That answer belongs to this other scenario: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. It does not establish the necessary change in this case.
E:This offered choice, “The corporate campus receives only the approved default from designated egress nodes”, addresses a separate concern. That answer belongs to this other scenario: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. It does not establish the necessary change in this case.
Question 1068
An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Verify per-VPN OMP routes, firewall rules and destination reachability during staging.
- Guest prefixes and traffic stay isolated from production routes and data tunnels.
- Trace the full data path and perform local edge failover testing before approval.
- Align the signed device identity, organization name and controller trust requirements for supported secure onboarding.
- Separate service VPNs/segments and apply centralized policy matching approved guest and corporate destinations.
- The site retains approved application reachability after losing one WAN edge or carrier path.
Explanation
Correct Answers
A:Verify per-VPN OMP routes, firewall rules and destination reachability during staging. This applies directly to the reported network-design requirement.
B:Guest prefixes and traffic stay isolated from production routes and data tunnels. This is the observable acceptance check for the change.
E:Separate service VPNs/segments and apply centralized policy matching approved guest and corporate destinations. This is the corrective design for the stated topology.
Incorrect Answers
C:This offered choice, “Trace the full data path and perform local edge failover testing before approval”, addresses a separate concern. This statement relates to a different requirement: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It does not address the condition described here.
D:This statement relates to a different requirement: A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. It does not address the condition described here.
F:This offered choice, “The site retains approved application reachability after losing one WAN edge or carrier path”, addresses a separate concern. This statement relates to a different requirement: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It does not address the condition described here.
Question 1069
A WAN provider accepts only three traffic classes but headquarters configures eight local DSCP queues and assumes all survive the handoff. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment.
- Map internal DSCP classes onto the provider-supported service groups explicitly and consistently.
- Each business traffic class receives the agreed provider class and treatment across the WAN.
- Establish an explicit QoS trust boundary that remarks or rejects unauthorized markings at ingress.
- Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
Explanation
Correct Answers
B:Map internal DSCP classes onto the provider-supported service groups explicitly and consistently. This applies directly to the reported network-design requirement.
C:Each business traffic class receives the agreed provider class and treatment across the WAN. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment”, addresses a separate concern. That answer belongs to this other scenario: A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. It does not establish the necessary change in this case.
D:That answer belongs to this other scenario: An enterprise WAN receives DSCP values from untrusted guest clients and propagates them unchanged into privileged queues. It does not establish the necessary change in this case.
E:This offered choice, “Remap backup traffic to a less-preferred class and protect media queues for their intended applications”, addresses a separate concern. That answer belongs to this other scenario: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It does not establish the necessary change in this case.
Question 1070
A dual-provider BGP edge must prefer ISP A for outbound traffic, but inbound updates from A have a lower MED than B and engineers assume MED dictates every decision. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Internal BGP best-path selection prefers ISP A where the intended routes are otherwise eligible.
- Test withdrawal of the default and preserve the required local and internal routes.
- Confirm local preference propagation and check business-specific exception prefixes.
- Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions.
- The accepted RIB contains the permitted default and no unintended provider prefixes.
- Use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference.
Explanation
Correct Answers
A:Internal BGP best-path selection prefers ISP A where the intended routes are otherwise eligible. This is the observable acceptance check for the change.
C:Confirm local preference propagation and check business-specific exception prefixes. This applies directly to the reported network-design requirement.
F:Use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference. This is the corrective design for the stated topology.
Incorrect Answers
B:This offered choice, “Test withdrawal of the default and preserve the required local and internal routes”, addresses a separate concern. This statement relates to a different requirement: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It does not address the condition described here.
D:This offered choice, “Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions”, addresses a separate concern. This statement relates to a different requirement: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It does not address the condition described here.
E:This offered choice, “The accepted RIB contains the permitted default and no unintended provider prefixes”, addresses a separate concern. This statement relates to a different requirement: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
