100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 1090
IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- All approved powered endpoints boot under full load and stay powered after one permitted PSU failure.
- Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
- Validate device power negotiation and high-priority endpoint allocations before production.
- Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile.
- The rogue bridge cannot become campus root and protected access interfaces enter their intended security state.
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
Explanation
Correct Answers
A:All approved powered endpoints boot under full load and stay powered after one permitted PSU failure. This is the observable acceptance check for the change.
B:Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom. This is the corrective design for the stated topology.
C:Validate device power negotiation and high-priority endpoint allocations before production. This applies directly to the reported network-design requirement.
Incorrect Answers
D:This offered choice, “Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile”, addresses a separate concern. This statement relates to a different requirement: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It does not address the condition described here.
E:This offered choice, “The rogue bridge cannot become campus root and protected access interfaces enter their intended security state”, addresses a separate concern. This statement relates to a different requirement: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It does not address the condition described here.
F:This offered choice, “Consider IP phones, virtual machines and MAC mobility before selecting the maximum”, addresses a separate concern. This statement relates to a different requirement: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It does not address the condition described here.
Question 1091
New routers have valid IP addresses but IS-IS peers in separate areas never form a level-1 adjacency. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication.
- The intended adjacency comes up at the correct level and interarea destinations remain reachable.
- Align IS-IS area addresses for L1 neighbor formation or use supported level-2 adjacency where the topology requires interarea routing.
- Route reachability between distant IS-IS areas is present through level-2 adjacencies.
- Design an appropriate level-2 backbone with level-1/level-2 routers at area boundaries.
Explanation
Correct Answers
B:The intended adjacency comes up at the correct level and interarea destinations remain reachable. This is the observable acceptance check for the change.
C:Align IS-IS area addresses for L1 neighbor formation or use supported level-2 adjacency where the topology requires interarea routing. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. It does not establish the necessary change in this case.
D:This offered choice, “Route reachability between distant IS-IS areas is present through level-2 adjacencies”, addresses a separate concern. That answer belongs to this other scenario: A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. It does not establish the necessary change in this case.
E:This offered choice, “Design an appropriate level-2 backbone with level-1/level-2 routers at area boundaries”, addresses a separate concern. That answer belongs to this other scenario: A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. It does not establish the necessary change in this case.
Question 1092
Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Test the OOB path and escalation workflow periodically.
- Telemetry remains within service capacity and operators can still reach consoles under load.
- Rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions.
- Estimate collector volume and sample rates before enabling streams.
- Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
- A WAN outage still produces actionable diagnostics and authorized operator access.
Explanation
Correct Answers
A:Test the OOB path and escalation workflow periodically. This applies directly to the reported network-design requirement.
E:Provide independent telemetry or out-of-band access appropriate to site criticality and budget. This is the corrective design for the stated topology.
F:A WAN outage still produces actionable diagnostics and authorized operator access. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Telemetry remains within service capacity and operators can still reach consoles under load”, addresses a separate concern. This statement relates to a different requirement: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It does not address the condition described here.
C:This offered choice, “Rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions”, addresses a separate concern. This statement relates to a different requirement: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It does not address the condition described here.
D:This offered choice, “Estimate collector volume and sample rates before enabling streams”, addresses a separate concern. This statement relates to a different requirement: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It does not address the condition described here.
Question 1093
A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Only authorized multicast receivers on selected sites receive the required production feed.
- Multicast protocol control and user traffic traverse the overlay while mandated encryption tests also pass where enabled.
- Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
- Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN.
- Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.
Explanation
Correct Answers
B:Multicast protocol control and user traffic traverse the overlay while mandated encryption tests also pass where enabled. This is the observable acceptance check for the change.
C:Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Only authorized multicast receivers on selected sites receive the required production feed”, addresses a separate concern. That answer belongs to this other scenario: A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. It does not establish the necessary change in this case.
D:This offered choice, “Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN”, addresses a separate concern. That answer belongs to this other scenario: A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. It does not establish the necessary change in this case.
E:That answer belongs to this other scenario: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It does not establish the necessary change in this case.
Question 1094
A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- A controlled status change reaches the collector promptly without waiting for the next periodic poll.
- Validate module namespace and device-supported YANG library before generating requests.
- Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
- Use supported on-change telemetry for the interface state leaf where device and model support it.
- Schema registry entries identify the correct module namespace and revisions for each controller operation.
- Detect device capability and model revision before applying vendor-specific settings.
Explanation
Correct Answers
B:Validate module namespace and device-supported YANG library before generating requests. This applies directly to the reported network-design requirement.
C:Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership. This is the corrective design for the stated topology.
E:Schema registry entries identify the correct module namespace and revisions for each controller operation. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “A controlled status change reaches the collector promptly without waiting for the next periodic poll”, addresses a separate concern. This statement relates to a different requirement: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. It does not address the condition described here.
D:This offered choice, “Use supported on-change telemetry for the interface state leaf where device and model support it”, addresses a separate concern. This statement relates to a different requirement: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. It does not address the condition described here.
F:This statement relates to a different requirement: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It does not address the condition described here.
Question 1095
Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
- Underlay nodes reach fabric RLOCs while user endpoints are mapped and forwarded through the correct overlay VN.
- Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.
- Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
- Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes.
Explanation
Correct Answers
A:Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames. This applies directly to the reported network-design requirement.
E:Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Underlay nodes reach fabric RLOCs while user endpoints are mapped and forwarded through the correct overlay VN”, addresses a separate concern. That answer belongs to this other scenario: In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. It does not establish the necessary change in this case.
C:That answer belongs to this other scenario: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. It does not establish the necessary change in this case.
D:This offered choice, “Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks”, addresses a separate concern. That answer belongs to this other scenario: In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. It does not establish the necessary change in this case.
Question 1096
A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Diagram route origins and inspect tags at each redistribution handoff.
- Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover.
- The intended exit preference propagates across internal BGP speakers.
- Verify route preference at more than one internal router before completing migration.
- Use local preference or another AS-wide BGP policy rather than relying on locally significant weight.
- Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops.
Explanation
Correct Answers
C:The intended exit preference propagates across internal BGP speakers. This is the observable acceptance check for the change.
D:Verify route preference at more than one internal router before completing migration. This applies directly to the reported network-design requirement.
E:Use local preference or another AS-wide BGP policy rather than relying on locally significant weight. This is the corrective design for the stated topology.
Incorrect Answers
A:This offered choice, “Diagram route origins and inspect tags at each redistribution handoff”, addresses a separate concern. This statement relates to a different requirement: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It does not address the condition described here.
B:This offered choice, “Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover”, addresses a separate concern. This statement relates to a different requirement: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It does not address the condition described here.
F:This offered choice, “Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops”, addresses a separate concern. This statement relates to a different requirement: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It does not address the condition described here.
Question 1097
A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Large application sessions succeed with correct effective packet sizing over each approved transport.
- Use the SD-WAN control-plane and key distribution capabilities appropriate to the supported solution.
- Authorized overlay tunnels form between intended peers without manually maintained full-mesh IKE policy.
- Plan scalable overlay topology and path policy based on actual edge session, route and encryption resource limits.
- Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
Explanation
Correct Answers
B:Use the SD-WAN control-plane and key distribution capabilities appropriate to the supported solution. This applies directly to the reported network-design requirement.
C:Authorized overlay tunnels form between intended peers without manually maintained full-mesh IKE policy. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Large application sessions succeed with correct effective packet sizing over each approved transport”, addresses a separate concern. That answer belongs to this other scenario: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It does not establish the necessary change in this case.
D:That answer belongs to this other scenario: A WAN edge has hundreds of VPN prefixes and growing TLOC paths; an all-to-all overlay approaches its platform session capacity. It does not establish the necessary change in this case.
E:This offered choice, “Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path”, addresses a separate concern. That answer belongs to this other scenario: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It does not establish the necessary change in this case.
Question 1098
A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Packet captures across both sites show correct class markings before and after provider handoff.
- Standardize classification and remarking policy across all controlled network trust boundaries.
- Backup operations continue at lower priority without violating interactive video quality.
- Combine trusted traffic classification and marking with a suitable egress priority queue and bandwidth admission design.
- Coordinate DSCP mapping at the interconnect and verify markings on both sides.
- Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
Explanation
Correct Answers
C:Backup operations continue at lower priority without violating interactive video quality. This is the observable acceptance check for the change.
E:Coordinate DSCP mapping at the interconnect and verify markings on both sides. This applies directly to the reported network-design requirement.
F:Remap backup traffic to a less-preferred class and protect media queues for their intended applications. This is the corrective design for the stated topology.
Incorrect Answers
A:This offered choice, “Packet captures across both sites show correct class markings before and after provider handoff”, addresses a separate concern. This statement relates to a different requirement: Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. It does not address the condition described here.
B:This offered choice, “Standardize classification and remarking policy across all controlled network trust boundaries”, addresses a separate concern. This statement relates to a different requirement: Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. It does not address the condition described here.
D:This offered choice, “Combine trusted traffic classification and marking with a suitable egress priority queue and bandwidth admission design”, addresses a separate concern. That option relates to this separate design case: A regional WAN prioritizes voice using a DiffServ marking but provides no scheduler preference on its congested egress link. It does not answer the current requirement.
Question 1099
Two intercampus routers redistribute OSPF and EIGRP in both directions, making route origin hard to track. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Evaluate supported BFD-based fault detection and matching IGP convergence policy for the routed adjacency.
- Apply selective redistribution, tagging and route filtering at clearly defined protocol boundaries.
- A failed path is withdrawn quickly enough that active voice sessions remain within the specified interruption budget.
- A representative prefix crosses the boundary once and retains deterministic return routing.
- Simplify path preference at domain boundaries and choose intended transit points based on actual traffic flows.
Explanation
Correct Answers
B:Apply selective redistribution, tagging and route filtering at clearly defined protocol boundaries. This applies directly to the reported network-design requirement.
D:A representative prefix crosses the boundary once and retains deterministic return routing. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Evaluate supported BFD-based fault detection and matching IGP convergence policy for the routed adjacency”, addresses a separate concern. That answer belongs to this other scenario: Campus routers detect a fiber break only after long OSPF dead timers, missing a strict voice recovery target. It does not establish the necessary change in this case.
C:This offered choice, “A failed path is withdrawn quickly enough that active voice sessions remain within the specified interruption budget”, addresses a separate concern. That answer belongs to this other scenario: Campus routers detect a fiber break only after long OSPF dead timers, missing a strict voice recovery target. It does not establish the necessary change in this case.
E:That answer belongs to this other scenario: A branch aggregation point has both IS-IS and OSPF neighbors with multiple equal-cost exits; traffic unexpectedly hairpins through a data center. It does not establish the necessary change in this case.
Question 1100
A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
- Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
- Each site advertises unique prefixes and the regional summarization boundary routes traffic to the correct branch.
Explanation
Correct Answers
B:Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites. This applies directly to the reported network-design requirement.
D:Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation. This is the corrective design for the stated topology.
F:Each site advertises unique prefixes and the regional summarization boundary routes traffic to the correct branch. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits”, addresses a separate concern. This statement concerns a different technical circumstance: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is not the needed action, result or safeguard for this case.
C:This offered choice, “Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards”, addresses a separate concern. This statement relates to a different requirement: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It does not address the condition described here.
E:This offered choice, “Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements”, addresses a separate concern. This statement concerns a different technical circumstance: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is not the needed action, result or safeguard for this case.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
