100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 160
A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. Which design change most directly addresses the stated requirement?
- Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.
- Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
- Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops.
- Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.
Explanation
Correct Answer
B:The design is validated when required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed.
Incorrect Answers
A:That option concerns a separate design case: An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. The relevant control here is: Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
C:That option concerns a separate design case: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. The relevant control here is: Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
D:That option concerns a separate design case: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. The relevant control here is: Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
Question 161
A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. Which design change most directly addresses the stated requirement?
- Evaluate BFD and appropriate OSPF timers with a realistic detection budget and hardware scale.
- Choose the appropriate stub-area variant or redesign to preserve required interarea summaries.
- Assign distinct /64 prefixes per routed IPv6 segment from a hierarchical site allocation.
- Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends.
Explanation
Correct Answer
D:The design is validated when oSPF adjacencies establish only between intended authenticated peers and survive planned key changes.
Incorrect Answers
A:That option concerns a separate design case: A design team wants fast OSPF failure detection on long-running optical links without dropping stable adjacencies during occasional control-plane delay. The relevant control here is: Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends.
B:That option concerns a separate design case: A branch OSPF design selects a totally stubby area but an application requires type-3 interarea routes rather than only the default. The relevant control here is: Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends.
C:That option concerns a separate design case: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. The relevant control here is: Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends.
Question 162
A campus firewall isolates management VRFs but its shared-services route leaking exports all loopbacks to the guest VRF. Which design change most directly addresses the stated requirement?
- Constrain route leaking to the precise management service endpoints and permitted directions.
- Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement.
- Police untrusted guest ingress traffic to an appropriate rate and violation action at the policy boundary.
- Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
Explanation
Correct Answer
A:The design is validated when guest routing tables contain no unauthorized management loopback routes.
Incorrect Answers
B:That option concerns a separate design case: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. The relevant control here is: Constrain route leaking to the precise management service endpoints and permitted directions.
C:That option concerns a separate design case: A guest wireless SSID creates burst traffic exceeding its contracted share and disrupts campus applications. The relevant control here is: Constrain route leaking to the precise management service endpoints and permitted directions.
D:That option concerns a separate design case: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. The relevant control here is: Constrain route leaking to the precise management service endpoints and permitted directions.
Question 163
A financial application needs multicast delivery across SDA sites, but all validation has covered unicast endpoint maps only. Which design change most directly addresses the stated requirement?
- Design supported multicast replication and routed multicast services across the intended fabric transit.
- Specify access switch PoE capabilities and power budget that support the APs' required negotiated power levels.
- Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites.
- Explicitly control default route origination and conditional advertisements at authorized borders.
Explanation
Correct Answer
A:The design is validated when authorized multicast receivers obtain packets while uninvolved VNs and sites remain isolated.
Incorrect Answers
B:That option concerns a separate design case: A wireless access-point refresh increases PoE needs above the available 802.3at class on older switches. The relevant control here is: Design supported multicast replication and routed multicast services across the intended fabric transit.
C:That option concerns a separate design case: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. The relevant control here is: Design supported multicast replication and routed multicast services across the intended fabric transit.
D:That option concerns a separate design case: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. The relevant control here is: Design supported multicast replication and routed multicast services across the intended fabric transit.
Question 164
A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. Which design change most directly addresses the stated requirement?
- Apply topology or centralized control policy at the appropriate site/VPN scope.
- Separate service VPNs/segments and apply centralized policy matching approved guest and corporate destinations.
- Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
- Define a backup-class QoS and application admission design appropriate to smaller available bandwidth.
Explanation
Correct Answer
D:The design is validated when voice sessions remain inside the approved quality budget over the constrained backup link.
Incorrect Answers
A:That option concerns a separate design case: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. The relevant control here is: Define a backup-class QoS and application admission design appropriate to smaller available bandwidth.
B:That option concerns a separate design case: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. The relevant control here is: Define a backup-class QoS and application admission design appropriate to smaller available bandwidth.
C:That option concerns a separate design case: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. The relevant control here is: Define a backup-class QoS and application admission design appropriate to smaller available bandwidth.
Question 165
A security operations service needs authoritative interface state changes, not a dashboard that replays stale telemetry after collector failure. Which design change most directly addresses the stated requirement?
- Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
- Increase the periodic interval and narrow the subscribed paths to the needed capacity metrics.
- Use a periodic telemetry subscription at a measured cadence suitable for trending and capacity planning.
- Design timestamped telemetry with source identification and collector reconnection/backfill policy as supported.
Explanation
Correct Answer
D:The design is validated when a controlled interface-down event arrives with correct device identity and event ordering after reconnection.
Incorrect Answers
A:That option concerns a separate design case: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. The relevant control here is: Design timestamped telemetry with source identification and collector reconnection/backfill policy as supported.
B:That option concerns a separate design case: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. The relevant control here is: Design timestamped telemetry with source identification and collector reconnection/backfill policy as supported.
C:That option concerns a separate design case: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. The relevant control here is: Design timestamped telemetry with source identification and collector reconnection/backfill policy as supported.
Question 166
A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. Which design change most directly addresses the stated requirement?
- Assess supported inbound traffic engineering such as scoped AS-path prepending or provider communities, recognizing remote-AS policy discretion.
- Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks.
- Use local preference or another AS-wide BGP policy rather than relying on locally significant weight.
- Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
Explanation
Correct Answer
B:The design is validated when the optimal successor forwards normally and eligible backup takes over without a network-wide query where feasible.
Incorrect Answers
A:That option concerns a separate design case: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. The relevant control here is: Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks.
C:That option concerns a separate design case: A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. The relevant control here is: Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks.
D:That option concerns a separate design case: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. The relevant control here is: Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks.
Question 167
A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. Which design change most directly addresses the stated requirement?
- Design VRF-aware border handoffs or supported segmentation-preserving transit consistent with the policy boundary.
- Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding.
- Plan NSF graceful-restart interoperability with compatible neighbors and realistic convergence timeouts.
- Plan redundant supported fabric control-plane nodes with resilient underlay reachability.
Explanation
Correct Answer
D:The design is validated when endpoint moves are learned through the surviving control-plane node and authorized traffic resumes.
Incorrect Answers
A:That option concerns a separate design case: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. The relevant control here is: Plan redundant supported fabric control-plane nodes with resilient underlay reachability.
B:That option concerns a separate design case: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. The relevant control here is: Plan redundant supported fabric control-plane nodes with resilient underlay reachability.
C:That option concerns a separate design case: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. The relevant control here is: Plan redundant supported fabric control-plane nodes with resilient underlay reachability.
Question 168
Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. Which design change most directly addresses the stated requirement?
- Choose a provider MPLS Layer 3 VPN with appropriate VRF route-target isolation and customer-to-provider routing.
- Evaluate an appropriately isolated L2VPN or pseudowire with defined loop, bandwidth and MTU constraints.
- Evaluate a provider Layer 2 VPN or Ethernet virtual circuit with explicit loop, MTU and broadcast containment design.
- Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition.
Explanation
Correct Answer
D:The design is validated when expected tagged traffic traverses the authorized EVC and unrelated tags are isolated.
Incorrect Answers
A:That option concerns a separate design case: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. The relevant control here is: Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition.
B:That option concerns a separate design case: Two industrial sites require transparent delivery of a small set of Ethernet services and reject routing between their private LANs. The relevant control here is: Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition.
C:That option concerns a separate design case: Two hospitals need their existing Ethernet VLANs extended across a provider circuit but their engineers incorrectly request a routed L3VPN. The relevant control here is: Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition.
Question 169
A SaaS contact center requires both 200-ms maximum application response and clear separation of media and control classes. Which design change most directly addresses the stated requirement?
- Evaluate controlled multicast service reflection or translation with explicit source/group mappings.
- Evaluate Source-Specific Multicast using supported IGMPv3/MLDv2 and PIM-SSM where available.
- Map actual application traffic to appropriate DiffServ classes and engineering budget across each congested hop.
- Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees.
Explanation
Correct Answer
C:The design is validated when end-to-end probes confirm intended latency and drop treatment for each business-critical class.
Incorrect Answers
A:That option concerns a separate design case: An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. The relevant control here is: Map actual application traffic to appropriate DiffServ classes and engineering budget across each congested hop.
B:That option concerns a separate design case: A 10,000-receiver IPTV deployment requires one-to-many traffic from known sources but still uses RP discovery for each stream. The relevant control here is: Map actual application traffic to appropriate DiffServ classes and engineering budget across each congested hop.
D:That option concerns a separate design case: Video and voice both use one strict-priority queue, causing voice jitter when video surges. The relevant control here is: Map actual application traffic to appropriate DiffServ classes and engineering budget across each congested hop.
Question 170
A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. Which design change most directly addresses the stated requirement?
- Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.
- Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
- Assign distinct /64 prefixes per routed IPv6 segment from a hierarchical site allocation.
- Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication.
Explanation
Correct Answer
D:The design is validated when clients reach the headquarters destination over the routed path using the approved office prefix.
Incorrect Answers
A:That option concerns a separate design case: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. The relevant control here is: Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication.
B:That option concerns a separate design case: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. The relevant control here is: Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication.
C:That option concerns a separate design case: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. The relevant control here is: Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests