100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 130
An IPv6 deployment uses static gateways rather than a dynamic protocol across several redundant campus links. Which design change most directly addresses the stated requirement?
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
- Assess supported inbound traffic engineering such as scoped AS-path prepending or provider communities, recognizing remote-AS policy discretion.
- Advertise only summaries that fully cover owned reachable allocations; retain required exceptions or more-specifics at redistribution boundaries.
- Select a scalable IPv6-capable routing design with convergence and security matched to the enterprise topology.
Explanation
Correct Answer
D:The design is validated when iPv6 next-hop changes recover after a tested uplink failure without manual reconfiguration.
Incorrect Answers
A:This alternative is aimed at a different design constraint: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. The relevant control for this case is: Select a scalable IPv6-capable routing design with convergence and security matched to the enterprise topology.
B:That option concerns a separate design case: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. The relevant control here is: Select a scalable IPv6-capable routing design with convergence and security matched to the enterprise topology.
C:That option concerns a separate design case: An enterprise uses hundreds of IPv4 /24s and proposes a single /16 summary although several component /24s are outside its administrative control. The relevant control here is: Select a scalable IPv6-capable routing design with convergence and security matched to the enterprise topology.
Question 131
A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. Which design change most directly addresses the stated requirement?
- Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
- Separate service attachment across independent core fault domains and validate downstream convergence.
- Apply route filtering at intercampus boundaries to accept only explicitly authorized prefixes.
Explanation
Correct Answer
D:The design is validated when the unintended default is absent from production campus RIBs while valid branch summaries propagate.
Incorrect Answers
A:That option concerns a separate design case: A campus wants deterministic STP roots but all switches retain default bridge priorities. The relevant control here is: Apply route filtering at intercampus boundaries to accept only explicitly authorized prefixes.
B:That option concerns a separate design case: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. The relevant control here is: Apply route filtering at intercampus boundaries to accept only explicitly authorized prefixes.
C:That option concerns a separate design case: A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. The relevant control here is: Apply route filtering at intercampus boundaries to accept only explicitly authorized prefixes.
Question 132
A WAN edge has hundreds of VPN prefixes and growing TLOC paths; an all-to-all overlay approaches its platform session capacity. Which design change most directly addresses the stated requirement?
- Plan scalable overlay topology and path policy based on actual edge session, route and encryption resource limits.
- Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN.
- Use the SD-WAN control-plane and key distribution capabilities appropriate to the supported solution.
- Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
Explanation
Correct Answer
A:The design is validated when route/session counts stay within supported platform bounds and new branches join without control-plane exhaustion.
Incorrect Answers
B:That option concerns a separate design case: A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. The relevant control here is: Plan scalable overlay topology and path policy based on actual edge session, route and encryption resource limits.
C:That option concerns a separate design case: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. The relevant control here is: Plan scalable overlay topology and path policy based on actual edge session, route and encryption resource limits.
D:That option concerns a separate design case: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. The relevant control here is: Plan scalable overlay topology and path policy based on actual edge session, route and encryption resource limits.
Question 133
A hospital asks for guaranteed per-flow service across 300 branches and considers IntServ RSVP state on every core router. Which design change most directly addresses the stated requirement?
- Compare IntServ reservation scalability with a DiffServ class-based design that better matches the enterprise scale.
- Validate reconvergence of multicast RPF and join/prune state after unicast routing changes.
- Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling.
- Provide an independently reachable out-of-band management network and approved emergency access process.
Explanation
Correct Answer
A:The design is validated when the chosen design meets critical-flow service expectations without unsupportable per-flow state on core devices.
Incorrect Answers
B:That option concerns a separate design case: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. The relevant control here is: Compare IntServ reservation scalability with a DiffServ class-based design that better matches the enterprise scale.
C:That option concerns a separate design case: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. The relevant control here is: Compare IntServ reservation scalability with a DiffServ class-based design that better matches the enterprise scale.
D:That option concerns a separate design case: A core router's production data plane fails, leaving SSH reachable only through the same failed core path. The relevant control here is: Compare IntServ reservation scalability with a DiffServ class-based design that better matches the enterprise scale.
Question 134
An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. Which design change most directly addresses the stated requirement?
- Use appropriately sampled or on-change model-driven telemetry for the monitored signals, with a scalable receiver architecture.
- Use supported on-change telemetry for the interface state leaf where device and model support it.
- Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
- Prefer a supported OpenConfig model for common telemetry and document device-specific augmentations where unavoidable.
Explanation
Correct Answer
B:The design is validated when a controlled status change reaches the collector promptly without waiting for the next periodic poll.
Incorrect Answers
A:That option concerns a separate design case: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. The relevant control here is: Use supported on-change telemetry for the interface state leaf where device and model support it.
C:That option concerns a separate design case: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. The relevant control here is: Use supported on-change telemetry for the interface state leaf where device and model support it.
D:This offered choice, “Prefer a supported OpenConfig model for common telemetry and document device-specific augmentations where unavoidable”, addresses a separate concern. That option relates to this separate design case: A multivendor enterprise wants one consistent YANG representation for interface operational counters but each platform exposes vendor-specific native trees. It does not answer the current requirement.
Question 135
An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. Which design change most directly addresses the stated requirement?
- Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites.
- Specify access switch PoE capabilities and power budget that support the APs' required negotiated power levels.
- Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer.
- Design supported fabric wireless segmentation with dedicated VNs/SGTs and appropriate wireless control integration.
Explanation
Correct Answer
A:The design is validated when approved intersite traffic carries the expected segmentation context without undesired leakage.
Incorrect Answers
B:That option concerns a separate design case: A wireless access-point refresh increases PoE needs above the available 802.3at class on older switches. The relevant control here is: Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites.
C:That option concerns a separate design case: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. The relevant control here is: Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites.
D:That option concerns a separate design case: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. The relevant control here is: Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites.
Question 136
A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. Which design change most directly addresses the stated requirement?
- Apply route filtering and appropriate max-prefix safeguards proportional to approved expected routes.
- Assign distinct /64 prefixes per routed IPv6 segment from a hierarchical site allocation.
- Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
- Activate and filter the correct IPv6 unicast MP-BGP address family on the intended peers.
Explanation
Correct Answer
D:The design is validated when iPv6 NLRI appears only in the authorized address-family tables with validated next-hop reachability.
Incorrect Answers
A:That option concerns a separate design case: A company accepts routes from a newly merged BGP AS without maximum-prefix limits, and the peer mistakenly sends hundreds of thousands of prefixes. The relevant control here is: Activate and filter the correct IPv6 unicast MP-BGP address family on the intended peers.
B:That option concerns a separate design case: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. The relevant control here is: Activate and filter the correct IPv6 unicast MP-BGP address family on the intended peers.
C:That option concerns a separate design case: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. The relevant control here is: Activate and filter the correct IPv6 unicast MP-BGP address family on the intended peers.
Question 137
A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. Which design change most directly addresses the stated requirement?
- Verify correct Reverse Path Forwarding behavior and IGP unicast route alignment for multicast sources.
- Distinguish RP-rooted shared trees from source-specific shortest-path trees and design switch behavior accordingly.
- Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling.
- Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement.
Explanation
Correct Answer
D:The design is validated when multiple authorized sources reach receiver sets through the designed bidirectional shared tree.
Incorrect Answers
A:That option concerns a separate design case: A multicast source is reachable through an interface other than the one receiving the packet, but the router still forwards it to all receivers. The relevant control here is: Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement.
B:That option concerns a separate design case: A team expects multicast traffic to traverse a shared tree forever even though its design requests shortest-path switching. The relevant control here is: Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement.
C:That option concerns a separate design case: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. The relevant control here is: Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement.
Question 138
Two industrial sites require transparent delivery of a small set of Ethernet services and reject routing between their private LANs. Which design change most directly addresses the stated requirement?
- Choose a provider MPLS Layer 3 VPN with appropriate VRF route-target isolation and customer-to-provider routing.
- Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.
- Evaluate an appropriately isolated L2VPN or pseudowire with defined loop, bandwidth and MTU constraints.
- Design distinct supported transport interfaces and TLOC colors with centralized path policy.
Explanation
Correct Answer
C:The design is validated when approved Ethernet frames reach the remote service endpoint while unrelated VLANs remain excluded.
Incorrect Answers
A:That option concerns a separate design case: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. The relevant control here is: Evaluate an appropriately isolated L2VPN or pseudowire with defined loop, bandwidth and MTU constraints.
B:That option concerns a separate design case: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. The relevant control here is: Evaluate an appropriately isolated L2VPN or pseudowire with defined loop, bandwidth and MTU constraints.
D:That option concerns a separate design case: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. The relevant control here is: Evaluate an appropriately isolated L2VPN or pseudowire with defined loop, bandwidth and MTU constraints.
Question 139
A sensitive engineering VLAN needs to deny lateral guest traffic within one switched segment; existing router ACLs do not inspect intra-VLAN frames. Which design change most directly addresses the stated requirement?
- Design supported fabric wireless segmentation with dedicated VNs/SGTs and appropriate wireless control integration.
- Evaluate an appropriate VLAN access map or supported intra-segment security mechanism.
- Explicitly control default route origination and conditional advertisements at authorized borders.
- Use targeted route distribution policy and VRF containment for sensitive prefixes.
Explanation
Correct Answer
B:The design is validated when test traffic between unauthorized hosts in the VLAN is denied while approved flows continue.
Incorrect Answers
A:That option concerns a separate design case: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. The relevant control here is: Evaluate an appropriate VLAN access map or supported intra-segment security mechanism.
C:That option concerns a separate design case: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. The relevant control here is: Evaluate an appropriate VLAN access map or supported intra-segment security mechanism.
D:That option concerns a separate design case: An acquisition introduces 172.16.0.0/12 internal networks but the network must hide finance VLAN prefixes from the partner site. The relevant control here is: Evaluate an appropriate VLAN access map or supported intra-segment security mechanism.
Question 140
A branch engineer redistributes a static default route into EIGRP and advertises it to every site, overriding the intended hub defaults. Which design change most directly addresses the stated requirement?
- Filter or scope external default advertisements to the authorized EIGRP distribution boundaries.
- Remove or constrain the summary when it attracts traffic to networks not reachable through the campus boundary.
- Introduce an independently reachable redundant aggregation path with planned metrics and bounded query behavior.
- Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
Explanation
Correct Answer
A:The design is validated when only intended branches learn the approved default source and backup behavior.
Incorrect Answers
B:That option concerns a separate design case: A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. The relevant control here is: Filter or scope external default advertisements to the authorized EIGRP distribution boundaries.
C:That option concerns a separate design case: An EIGRP deployment relies on a single aggregation router and an outage cuts off all downstream branches. The relevant control here is: Filter or scope external default advertisements to the authorized EIGRP distribution boundaries.
D:That option concerns a separate design case: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. The relevant control here is: Filter or scope external default advertisements to the authorized EIGRP distribution boundaries.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests