100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 190
A dual-provider BGP edge must prefer ISP A for outbound traffic, but inbound updates from A have a lower MED than B and engineers assume MED dictates every decision. Which design change most directly addresses the stated requirement?
- Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards.
- Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions.
- Use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference.
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
Explanation
Correct Answer
C:The design is validated when internal BGP best-path selection prefers ISP A where the intended routes are otherwise eligible.
Incorrect Answers
A:That option concerns a separate design case: An edge router receives a full BGP table where the security policy allows only the provider's approved default. The relevant control here is: Use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference.
B:That option concerns a separate design case: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. The relevant control here is: Use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference.
D:This alternative is aimed at a different design constraint: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. The relevant control for this case is: Use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference.
Question 191
A virtualized distribution pair uses one logical control plane and engineers assume it offers separate failure domains like two chassis in different buildings. Which design change most directly addresses the stated requirement?
- Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding.
- Plan NSF graceful-restart interoperability with compatible neighbors and realistic convergence timeouts.
- Evaluate physical fault domains and provide independent power, links, and control-plane recovery within the chosen abstraction.
- Align MST region name, revision, and VLAN-to-instance mapping on intended peers.
Explanation
Correct Answer
C:The design is validated when a tested hardware or supervisor failure meets application recovery objectives without unexpected shared dependencies.
Incorrect Answers
A:That option concerns a separate design case: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. The relevant control here is: Evaluate physical fault domains and provide independent power, links, and control-plane recovery within the chosen abstraction.
B:That option concerns a separate design case: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. The relevant control here is: Evaluate physical fault domains and provide independent power, links, and control-plane recovery within the chosen abstraction.
D:That option concerns a separate design case: A new MST campus region accidentally has a different VLAN-to-instance mapping on one distribution switch. The relevant control here is: Evaluate physical fault domains and provide independent power, links, and control-plane recovery within the chosen abstraction.
Question 192
A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. Which design change most directly addresses the stated requirement?
- Use a periodic telemetry subscription at a measured cadence suitable for trending and capacity planning.
- Use an appropriate Cisco native YANG model for supported platform-specific configuration.
- Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing.
- Classify the combined arrangement as hybrid cloud and design controlled identity, routing, and data movement policies.
Explanation
Correct Answer
C:The design is validated when authorized cloud prefixes are reachable over intended private paths after one interconnect fails.
Incorrect Answers
A:That option concerns a separate design case: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. The relevant control here is: Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing.
B:That option concerns a separate design case: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. The relevant control here is: Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing.
D:That option concerns a separate design case: An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. The relevant control here is: Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing.
Question 193
A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. Which design change most directly addresses the stated requirement?
- Rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions.
- Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
- Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
- Distinguish RP-rooted shared trees from source-specific shortest-path trees and design switch behavior accordingly.
Explanation
Correct Answer
A:The design is validated when telemetry remains within service capacity and operators can still reach consoles under load.
Incorrect Answers
B:That option concerns a separate design case: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. The relevant control here is: Rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions.
C:That option concerns a separate design case: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. The relevant control here is: Rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions.
D:That option concerns a separate design case: A team expects multicast traffic to traverse a shared tree forever even though its design requests shortest-path switching. The relevant control here is: Rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions.
Question 194
A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. Which design change most directly addresses the stated requirement?
- Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy.
- Evaluate GET VPN where supported for group encryption over a trusted routable provider network.
- Evaluate a provider Layer 2 VPN or Ethernet virtual circuit with explicit loop, MTU and broadcast containment design.
- Evaluate a DMVPN hub/spoke design using NHRP registration and supported dynamic shortcut behavior.
Explanation
Correct Answer
A:The design is validated when authorized branch prefixes appear within the appropriate VPN and survive a PE failure as contracted.
Incorrect Answers
B:That option concerns a separate design case: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. The relevant control here is: Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy.
C:That option concerns a separate design case: Two hospitals need their existing Ethernet VLANs extended across a provider circuit but their engineers incorrectly request a routed L3VPN. The relevant control here is: Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy.
D:That option concerns a separate design case: A retail chain needs many spokes to make dynamic spoke-to-spoke tunnels without permanent full-mesh configuration. The relevant control here is: Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy.
Question 195
Campus routers detect a fiber break only after long OSPF dead timers, missing a strict voice recovery target. Which design change most directly addresses the stated requirement?
- Simplify path preference at domain boundaries and choose intended transit points based on actual traffic flows.
- Apply selective redistribution, tagging and route filtering at clearly defined protocol boundaries.
- Provide independent power infrastructure for each redundant network node and validate dual-path resilience.
- Evaluate supported BFD-based fault detection and matching IGP convergence policy for the routed adjacency.
Explanation
Correct Answer
D:The design is validated when a failed path is withdrawn quickly enough that active voice sessions remain within the specified interruption budget.
Incorrect Answers
A:That option concerns a separate design case: A branch aggregation point has both IS-IS and OSPF neighbors with multiple equal-cost exits; traffic unexpectedly hairpins through a data center. The relevant control here is: Evaluate supported BFD-based fault detection and matching IGP convergence policy for the routed adjacency.
B:That option concerns a separate design case: Two intercampus routers redistribute OSPF and EIGRP in both directions, making route origin hard to track. The relevant control here is: Evaluate supported BFD-based fault detection and matching IGP convergence policy for the routed adjacency.
C:That option concerns a separate design case: Two campus distribution routers each have a single power feed from the same rack PDU, yet the architecture counts them as separate fault domains. The relevant control here is: Evaluate supported BFD-based fault detection and matching IGP convergence policy for the routed adjacency.
Question 196
A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. Which design change most directly addresses the stated requirement?
- Set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths.
- Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
- Pair next-hop reachability and supported BFD or track-based detection with appropriate BGP convergence settings.
- Assess supported inbound traffic engineering such as scoped AS-path prepending or provider communities, recognizing remote-AS policy discretion.
Explanation
Correct Answer
A:The design is validated when normal forwarding prefers the main path while failover selects the backup when primary reachability disappears.
Incorrect Answers
B:That option concerns a separate design case: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. The relevant control here is: Set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths.
C:That option concerns a separate design case: A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. The relevant control here is: Set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths.
D:That option concerns a separate design case: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. The relevant control here is: Set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths.
Question 197
A multisite SD-WAN deployment uses one manager for configuration and assumes manager reachability is necessary for every packet of user data. Which design change most directly addresses the stated requirement?
- Separate optical multiplexing requirements from routing or Ethernet tenant segmentation carried over the wavelengths.
- Select an appropriate private APN, outbound-initiated overlay, or routable-address service depending on carrier capabilities.
- Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN.
- Design control/management resilience separately from WAN edge data-plane forwarding.
Explanation
Correct Answer
D:The design is validated when existing permitted edge-to-edge tunnels continue carrying traffic across a management-plane interruption where supported.
Incorrect Answers
A:That option concerns a separate design case: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. The relevant control here is: Design control/management resilience separately from WAN edge data-plane forwarding.
B:That option concerns a separate design case: An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. The relevant control here is: Design control/management resilience separately from WAN edge data-plane forwarding.
C:That option concerns a separate design case: A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. The relevant control here is: Design control/management resilience separately from WAN edge data-plane forwarding.
Question 198
A branch policy gives every queue an equal share although its database synchronization is delaying emergency call signaling. Which design change most directly addresses the stated requirement?
- Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries.
- Classify traffic by actual application need and reserve EF treatment for suitable expedited traffic.
- Protect essential routing/control traffic within bounded QoS classes at actual bottlenecks.
- Allocate queue scheduling according to measured application criticality and minimum bandwidth needs.
Explanation
Correct Answer
D:The design is validated when critical signaling and voice meet their performance targets while bulk sync proceeds on its class.
Incorrect Answers
A:That option concerns a separate design case: Two business units share one management VLAN with unrestricted access to each other's routers. The relevant control here is: Allocate queue scheduling according to measured application criticality and minimum bandwidth needs.
B:That option concerns a separate design case: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. The relevant control here is: Allocate queue scheduling according to measured application criticality and minimum bandwidth needs.
C:That option concerns a separate design case: A campus QoS policy gives low priority to routing keepalives and network monitoring, and routing adjacencies flap during congestion. The relevant control here is: Allocate queue scheduling according to measured application criticality and minimum bandwidth needs.
Question 199
A network peers eBGP over a loopback with multiple routed hops and assumes a directly connected neighbor model. Which design change most directly addresses the stated requirement?
- Use a supported eBGP multihop design with reachable loopback endpoints and suitable TTL/security policy.
- Assign distinct /64 prefixes per routed IPv6 segment from a hierarchical site allocation.
- Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends.
- Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication.
Explanation
Correct Answer
A:The design is validated when the eBGP session establishes over the routed path and routes remain reachable during a single underlay link failure.
Incorrect Answers
B:That option concerns a separate design case: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. The relevant control here is: Use a supported eBGP multihop design with reachable loopback endpoints and suitable TTL/security policy.
C:That option concerns a separate design case: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. The relevant control here is: Use a supported eBGP multihop design with reachable loopback endpoints and suitable TTL/security policy.
D:That option concerns a separate design case: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. The relevant control here is: Use a supported eBGP multihop design with reachable loopback endpoints and suitable TTL/security policy.
Question 200
A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. Which design change most directly addresses the stated requirement?
- Plan NSF graceful-restart interoperability with compatible neighbors and realistic convergence timeouts.
- Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
- Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding.
- Plan ECMP based on actual per-flow hashing and application sensitivity rather than guaranteed per-packet load balance.
Explanation
Correct Answer
B:The design is validated when intersite overlay flows survive the engineered path and meet their measured size and latency limits.
Incorrect Answers
A:That option concerns a separate design case: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. The relevant control here is: Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
C:That option concerns a separate design case: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. The relevant control here is: Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
D:That option concerns a separate design case: A multicampus network has two equal-cost paths but the design assumes packets always alternate evenly across every individual packet. The relevant control here is: Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests