100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 1070
A dual-provider BGP edge must prefer ISP A for outbound traffic, but inbound updates from A have a lower MED than B and engineers assume MED dictates every decision. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Internal BGP best-path selection prefers ISP A where the intended routes are otherwise eligible.
- Test withdrawal of the default and preserve the required local and internal routes.
- Confirm local preference propagation and check business-specific exception prefixes.
- Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions.
- The accepted RIB contains the permitted default and no unintended provider prefixes.
- Use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference.
Explanation
Correct Answers
A:Internal BGP best-path selection prefers ISP A where the intended routes are otherwise eligible. This is the observable acceptance check for the change.
C:Confirm local preference propagation and check business-specific exception prefixes. This applies directly to the reported network-design requirement.
F:Use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference. This is the corrective design for the stated topology.
Incorrect Answers
B:This offered choice, “Test withdrawal of the default and preserve the required local and internal routes”, addresses a separate concern. This statement relates to a different requirement: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It does not address the condition described here.
D:This offered choice, “Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions”, addresses a separate concern. This statement relates to a different requirement: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It does not address the condition described here.
E:This offered choice, “The accepted RIB contains the permitted default and no unintended provider prefixes”, addresses a separate concern. This statement relates to a different requirement: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It does not address the condition described here.
Question 1071
A virtualized distribution pair uses one logical control plane and engineers assume it offers separate failure domains like two chassis in different buildings. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Evaluate physical fault domains and provide independent power, links, and control-plane recovery within the chosen abstraction.
- Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding.
- A tested hardware or supervisor failure meets application recovery objectives without unexpected shared dependencies.
- Control-plane endpoint mappings resolve and separate packet captures show VXLAN data forwarding between fabric edges.
- Plan NSF graceful-restart interoperability with compatible neighbors and realistic convergence timeouts.
Explanation
Correct Answers
A:Evaluate physical fault domains and provide independent power, links, and control-plane recovery within the chosen abstraction. This applies directly to the reported network-design requirement.
C:A tested hardware or supervisor failure meets application recovery objectives without unexpected shared dependencies. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding”, addresses a separate concern. That answer belongs to this other scenario: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It does not establish the necessary change in this case.
D:This offered choice, “Control-plane endpoint mappings resolve and separate packet captures show VXLAN data forwarding between fabric edges”, addresses a separate concern. That answer belongs to this other scenario: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It does not establish the necessary change in this case.
E:That answer belongs to this other scenario: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. It does not establish the necessary change in this case.
Question 1072
A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Map shared responsibility and data residency requirements at each boundary.
- Approved burst workloads operate across the private and public boundaries without unrestricted network trust.
- Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing.
- Examine cloud service limits, BGP policy and regional diversity before committing to circuits.
- Prefer a supported OpenConfig model for common telemetry and document device-specific augmentations where unavoidable.
- Authorized cloud prefixes are reachable over intended private paths after one interconnect fails.
Explanation
Correct Answers
C:Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing. This is the corrective design for the stated topology.
D:Examine cloud service limits, BGP policy and regional diversity before committing to circuits. This applies directly to the reported network-design requirement.
F:Authorized cloud prefixes are reachable over intended private paths after one interconnect fails. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Map shared responsibility and data residency requirements at each boundary”, addresses a separate concern. This statement relates to a different requirement: An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. It does not address the condition described here.
B:This offered choice, “Approved burst workloads operate across the private and public boundaries without unrestricted network trust”, addresses a separate concern. This statement relates to a different requirement: An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. It does not address the condition described here.
E:This offered choice, “Prefer a supported OpenConfig model for common telemetry and document device-specific augmentations where unavoidable”, addresses a separate concern. That option relates to this separate design case: A multivendor enterprise wants one consistent YANG representation for interface operational counters but each platform exposes vendor-specific native trees. It does not answer the current requirement.
Question 1073
A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
- Rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions.
- Telemetry remains within service capacity and operators can still reach consoles under load.
- Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
- Backup operations continue at lower priority without violating interactive video quality.
Explanation
Correct Answers
B:Rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions. This applies directly to the reported network-design requirement.
C:Telemetry remains within service capacity and operators can still reach consoles under load. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Remap backup traffic to a less-preferred class and protect media queues for their intended applications”, addresses a separate concern. That answer belongs to this other scenario: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It does not establish the necessary change in this case.
D:This offered choice, “Provide independent telemetry or out-of-band access appropriate to site criticality and budget”, addresses a separate concern. That answer belongs to this other scenario: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It does not establish the necessary change in this case.
E:This offered choice, “Backup operations continue at lower priority without violating interactive video quality”, addresses a separate concern. That answer belongs to this other scenario: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It does not establish the necessary change in this case.
Question 1074
A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Confirm NHRP authentication, routing protocol compatibility and suitable tunnel security.
- Add separate encryption where the threat model requires it and verify provider SLA.
- Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy.
- Evaluate a DMVPN hub/spoke design using NHRP registration and supported dynamic shortcut behavior.
- Evaluate a provider Layer 2 VPN or Ethernet virtual circuit with explicit loop, MTU and broadcast containment design.
- Authorized branch prefixes appear within the appropriate VPN and survive a PE failure as contracted.
Explanation
Correct Answers
B:Add separate encryption where the threat model requires it and verify provider SLA. This applies directly to the reported network-design requirement.
C:Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy. This is the corrective design for the stated topology.
F:Authorized branch prefixes appear within the appropriate VPN and survive a PE failure as contracted. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Confirm NHRP authentication, routing protocol compatibility and suitable tunnel security”, addresses a separate concern. This statement relates to a different requirement: A retail chain needs many spokes to make dynamic spoke-to-spoke tunnels without permanent full-mesh configuration. It does not address the condition described here.
D:This offered choice, “Evaluate a DMVPN hub/spoke design using NHRP registration and supported dynamic shortcut behavior”, addresses a separate concern. This statement relates to a different requirement: A retail chain needs many spokes to make dynamic spoke-to-spoke tunnels without permanent full-mesh configuration. It does not address the condition described here.
E:This offered choice, “Evaluate a provider Layer 2 VPN or Ethernet virtual circuit with explicit loop, MTU and broadcast containment design”, addresses a separate concern. That option relates to this separate design case: Two hospitals need their existing Ethernet VLANs extended across a provider circuit but their engineers incorrectly request a routed L3VPN. It does not answer the current requirement.
Question 1075
Campus routers detect a fiber break only after long OSPF dead timers, missing a strict voice recovery target. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Apply selective redistribution, tagging and route filtering at clearly defined protocol boundaries.
- Evaluate supported BFD-based fault detection and matching IGP convergence policy for the routed adjacency.
- A failed path is withdrawn quickly enough that active voice sessions remain within the specified interruption budget.
- Provide independent power infrastructure for each redundant network node and validate dual-path resilience.
- A representative prefix crosses the boundary once and retains deterministic return routing.
Explanation
Correct Answers
B:Evaluate supported BFD-based fault detection and matching IGP convergence policy for the routed adjacency. This applies directly to the reported network-design requirement.
C:A failed path is withdrawn quickly enough that active voice sessions remain within the specified interruption budget. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Apply selective redistribution, tagging and route filtering at clearly defined protocol boundaries”, addresses a separate concern. That answer belongs to this other scenario: Two intercampus routers redistribute OSPF and EIGRP in both directions, making route origin hard to track. It does not establish the necessary change in this case.
D:That answer belongs to this other scenario: Two campus distribution routers each have a single power feed from the same rack PDU, yet the architecture counts them as separate fault domains. It does not establish the necessary change in this case.
E:This offered choice, “A representative prefix crosses the boundary once and retains deterministic return routing”, addresses a separate concern. That answer belongs to this other scenario: Two intercampus routers redistribute OSPF and EIGRP in both directions, making route origin hard to track. It does not establish the necessary change in this case.
Question 1076
A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Check protocol payloads, bidirectional addressing and security logs before deployment.
- Set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths.
- Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
- Test bidirectional traffic and confirm no inadvertent ECMP over low-capacity links.
- Normal forwarding prefers the main path while failover selects the backup when primary reachability disappears.
- Authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path.
Explanation
Correct Answers
B:Set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths. This is the corrective design for the stated topology.
D:Test bidirectional traffic and confirm no inadvertent ECMP over low-capacity links. This applies directly to the reported network-design requirement.
E:Normal forwarding prefers the main path while failover selects the backup when primary reachability disappears. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Check protocol payloads, bidirectional addressing and security logs before deployment”, addresses a separate concern. This statement relates to a different requirement: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It does not address the condition described here.
C:This offered choice, “Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary”, addresses a separate concern. This statement relates to a different requirement: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It does not address the condition described here.
F:This offered choice, “Authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path”, addresses a separate concern. This statement relates to a different requirement: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It does not address the condition described here.
Question 1077
A multisite SD-WAN deployment uses one manager for configuration and assumes manager reachability is necessary for every packet of user data. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Services over the optical circuit remain isolated by the appropriate higher-layer controls.
- Select an appropriate private APN, outbound-initiated overlay, or routable-address service depending on carrier capabilities.
- Evaluate a provider Layer 2 VPN or Ethernet virtual circuit with explicit loop, MTU and broadcast containment design.
- Design control/management resilience separately from WAN edge data-plane forwarding.
- Existing permitted edge-to-edge tunnels continue carrying traffic across a management-plane interruption where supported.
Explanation
Correct Answers
D:Design control/management resilience separately from WAN edge data-plane forwarding. This applies directly to the reported network-design requirement.
E:Existing permitted edge-to-edge tunnels continue carrying traffic across a management-plane interruption where supported. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Services over the optical circuit remain isolated by the appropriate higher-layer controls”, addresses a separate concern. That answer belongs to this other scenario: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. It does not establish the necessary change in this case.
B:This offered choice, “Select an appropriate private APN, outbound-initiated overlay, or routable-address service depending on carrier capabilities”, addresses a separate concern. That answer belongs to this other scenario: An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. It does not establish the necessary change in this case.
C:This offered choice, “Evaluate a provider Layer 2 VPN or Ethernet virtual circuit with explicit loop, MTU and broadcast containment design”, addresses a separate concern. That option relates to this separate design case: Two hospitals need their existing Ethernet VLANs extended across a provider circuit but their engineers incorrectly request a routed L3VPN. It does not answer the current requirement.
Question 1078
A branch policy gives every queue an equal share although its database synchronization is delaying emergency call signaling. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Verify traffic profile and congestion points before adjusting class percentages.
- Allocate queue scheduling according to measured application criticality and minimum bandwidth needs.
- Audit markings at endpoint, access and WAN boundaries before rewriting application policies.
- Critical signaling and voice meet their performance targets while bulk sync proceeds on its class.
- Protect essential routing/control traffic within bounded QoS classes at actual bottlenecks.
- Control-plane adjacencies and monitoring remain stable during representative congestion.
Explanation
Correct Answers
A:Verify traffic profile and congestion points before adjusting class percentages. This applies directly to the reported network-design requirement.
B:Allocate queue scheduling according to measured application criticality and minimum bandwidth needs. This is the corrective design for the stated topology.
D:Critical signaling and voice meet their performance targets while bulk sync proceeds on its class. This is the observable acceptance check for the change.
Incorrect Answers
C:This offered choice, “Audit markings at endpoint, access and WAN boundaries before rewriting application policies”, addresses a separate concern. This statement relates to a different requirement: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It does not address the condition described here.
E:This offered choice, “Protect essential routing/control traffic within bounded QoS classes at actual bottlenecks”, addresses a separate concern. This statement relates to a different requirement: A campus QoS policy gives low priority to routing keepalives and network monitoring, and routing adjacencies flap during congestion. It does not address the condition described here.
F:This offered choice, “Control-plane adjacencies and monitoring remain stable during representative congestion”, addresses a separate concern. This statement relates to a different requirement: A campus QoS policy gives low priority to routing keepalives and network monitoring, and routing adjacencies flap during congestion. It does not address the condition described here.
Question 1079
A network peers eBGP over a loopback with multiple routed hops and assumes a directly connected neighbor model. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- OSPF adjacencies establish only between intended authenticated peers and survive planned key changes.
- Assign distinct /64 prefixes per routed IPv6 segment from a hierarchical site allocation.
- Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends.
- Use a supported eBGP multihop design with reachable loopback endpoints and suitable TTL/security policy.
- The eBGP session establishes over the routed path and routes remain reachable during a single underlay link failure.
Explanation
Correct Answers
D:Use a supported eBGP multihop design with reachable loopback endpoints and suitable TTL/security policy. This applies directly to the reported network-design requirement.
E:The eBGP session establishes over the routed path and routes remain reachable during a single underlay link failure. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “OSPF adjacencies establish only between intended authenticated peers and survive planned key changes”, addresses a separate concern. That answer belongs to this other scenario: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It does not establish the necessary change in this case.
B:That answer belongs to this other scenario: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It does not establish the necessary change in this case.
C:This offered choice, “Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends”, addresses a separate concern. That answer belongs to this other scenario: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It does not establish the necessary change in this case.
Question 1080
A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Intersite overlay flows survive the engineered path and meet their measured size and latency limits.
- Guest clients roam as designed and cannot access restricted enterprise segments.
- Plan ECMP based on actual per-flow hashing and application sensitivity rather than guaranteed per-packet load balance.
- Validate WLC and AP fabric roles against platform support and target mobility scope.
- Test the full supported transit profile rather than relying on basic IP ping success.
- Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
Explanation
Correct Answers
A:Intersite overlay flows survive the engineered path and meet their measured size and latency limits. This is the observable acceptance check for the change.
E:Test the full supported transit profile rather than relying on basic IP ping success. This applies directly to the reported network-design requirement.
F:Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints. This is the corrective design for the stated topology.
Incorrect Answers
B:This offered choice, “Guest clients roam as designed and cannot access restricted enterprise segments”, addresses a separate concern. This statement relates to a different requirement: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It does not address the condition described here.
C:This statement relates to a different requirement: A multicampus network has two equal-cost paths but the design assumes packets always alternate evenly across every individual packet. It does not address the condition described here.
D:This offered choice, “Validate WLC and AP fabric roles against platform support and target mobility scope”, addresses a separate concern. This statement relates to a different requirement: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
