100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 200
A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. Which design change most directly addresses the stated requirement?
- Plan NSF graceful-restart interoperability with compatible neighbors and realistic convergence timeouts.
- Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
- Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding.
- Plan ECMP based on actual per-flow hashing and application sensitivity rather than guaranteed per-packet load balance.
Explanation
Correct Answer
B:The design is validated when intersite overlay flows survive the engineered path and meet their measured size and latency limits.
Incorrect Answers
A:That option concerns a separate design case: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. The relevant control here is: Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
C:That option concerns a separate design case: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. The relevant control here is: Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
D:That option concerns a separate design case: A multicampus network has two equal-cost paths but the design assumes packets always alternate evenly across every individual packet. The relevant control here is: Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
Question 201
An acquisition introduces 172.16.0.0/12 internal networks but the network must hide finance VLAN prefixes from the partner site. Which design change most directly addresses the stated requirement?
- Preserve a supported link and endpoint power/wake capability along the intended WoL packet delivery path.
- Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer.
- Align MST region name, revision, and VLAN-to-instance mapping on intended peers.
- Use targeted route distribution policy and VRF containment for sensitive prefixes.
Explanation
Correct Answer
D:The design is validated when partner routing tables contain only the approved shared-services routes.
Incorrect Answers
A:That option concerns a separate design case: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. The relevant control here is: Use targeted route distribution policy and VRF containment for sensitive prefixes.
B:That option concerns a separate design case: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. The relevant control here is: Use targeted route distribution policy and VRF containment for sensitive prefixes.
C:That option concerns a separate design case: A new MST campus region accidentally has a different VLAN-to-instance mapping on one distribution switch. The relevant control here is: Use targeted route distribution policy and VRF containment for sensitive prefixes.
Question 202
A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. Which design change most directly addresses the stated requirement?
- Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries.
- Correct receiver membership handling and ensure snooping querier or routing interface behavior is consistent.
- Extend consistent class scheduling to each actual bottleneck along the end-to-end path.
- Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees.
Explanation
Correct Answer
C:The design is validated when delay-sensitive traffic receives scheduled treatment at both campus and WAN congestion points.
Incorrect Answers
A:That option concerns a separate design case: Two business units share one management VLAN with unrestricted access to each other's routers. The relevant control here is: Extend consistent class scheduling to each actual bottleneck along the end-to-end path.
B:That option concerns a separate design case: A multicast network has active PIM neighbors but one edge switch suppresses IGMP reports after an access-layer topology change. The relevant control here is: Extend consistent class scheduling to each actual bottleneck along the end-to-end path.
D:That option concerns a separate design case: Video and voice both use one strict-priority queue, causing voice jitter when video surges. The relevant control here is: Extend consistent class scheduling to each actual bottleneck along the end-to-end path.
Question 203
An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. Which design change most directly addresses the stated requirement?
- Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported.
- Classify the hosted runtime as PaaS and document the application versus platform operations boundary.
- Use the supported gNMI service transported over gRPC with device capability and identity verification.
- Subscribe only to required model paths with appropriate update mode and cadence.
Explanation
Correct Answer
A:The design is validated when approved configuration changes use the negotiated datastore and produce attributable RPC replies.
Incorrect Answers
B:That option concerns a separate design case: A development team consumes a managed runtime that deploys application code without administering underlying servers and calls it raw IaaS. The relevant control here is: Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported.
C:That option concerns a separate design case: A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. The relevant control here is: Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported.
D:That option concerns a separate design case: A fleet telemetry design streams all available operational leaves every second over a constrained management link. The relevant control here is: Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported.
Question 204
A global company uses the old terms vSmart, vManage and vBond in documentation but assigns control and management functions to the wrong products. Which design change most directly addresses the stated requirement?
- Map Cisco SD-WAN Controller, Manager and Validator functions to their actual roles, including legacy labels.
- Design control/management resilience separately from WAN edge data-plane forwarding.
- Design controlled interprovider VRF routing and CE route policy with explicit security and resiliency boundaries.
- Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
Explanation
Correct Answer
A:The design is validated when operations diagrams identify correct components for onboarding, OMP routes and policy distribution.
Incorrect Answers
B:That option concerns a separate design case: A multisite SD-WAN deployment uses one manager for configuration and assumes manager reachability is necessary for every packet of user data. The relevant control here is: Map Cisco SD-WAN Controller, Manager and Validator functions to their actual roles, including legacy labels.
C:That option concerns a separate design case: A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. The relevant control here is: Map Cisco SD-WAN Controller, Manager and Validator functions to their actual roles, including legacy labels.
D:That option concerns a separate design case: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. The relevant control here is: Map Cisco SD-WAN Controller, Manager and Validator functions to their actual roles, including legacy labels.
Question 205
An EIGRP deployment relies on a single aggregation router and an outage cuts off all downstream branches. Which design change most directly addresses the stated requirement?
- Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
- Refine the summary to reflect reachable networks and provide appropriate handling for withdrawn components.
- Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks.
- Introduce an independently reachable redundant aggregation path with planned metrics and bounded query behavior.
Explanation
Correct Answer
D:The design is validated when branch routes remain reachable through the surviving aggregation router after failure.
Incorrect Answers
A:That option concerns a separate design case: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. The relevant control here is: Introduce an independently reachable redundant aggregation path with planned metrics and bounded query behavior.
B:That option concerns a separate design case: Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. The relevant control here is: Introduce an independently reachable redundant aggregation path with planned metrics and bounded query behavior.
C:That option concerns a separate design case: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. The relevant control here is: Introduce an independently reachable redundant aggregation path with planned metrics and bounded query behavior.
Question 206
A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. Which design change most directly addresses the stated requirement?
- Align IS-IS area addresses for L1 neighbor formation or use supported level-2 adjacency where the topology requires interarea routing.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
- Design an appropriate level-2 backbone with level-1/level-2 routers at area boundaries.
Explanation
Correct Answer
D:The design is validated when route reachability between distant IS-IS areas is present through level-2 adjacencies.
Incorrect Answers
A:That option concerns a separate design case: New routers have valid IP addresses but IS-IS peers in separate areas never form a level-1 adjacency. The relevant control here is: Design an appropriate level-2 backbone with level-1/level-2 routers at area boundaries.
B:That option concerns a separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. The relevant control here is: Design an appropriate level-2 backbone with level-1/level-2 routers at area boundaries.
C:This alternative is aimed at a different design constraint: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. The relevant control for this case is: Design an appropriate level-2 backbone with level-1/level-2 routers at area boundaries.
Question 207
A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. Which design change most directly addresses the stated requirement?
- Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints.
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
- Use a supported multi-chassis EtherChannel or routed-access design to make redundancy active without a spanning-tree loop.
- Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions.
Explanation
Correct Answer
A:The design is validated when changes to one tenant's routes do not leak or alter the other's forwarding state.
Incorrect Answers
B:That option concerns a separate design case: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. The relevant control here is: Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints.
C:That option concerns a separate design case: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. The relevant control here is: Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints.
D:That option concerns a separate design case: A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. The relevant control here is: Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints.
Question 208
A switch QoS scheduler guarantees 30% to backup traffic and 80% to voice under full congestion, exceeding possible link capacity. Which design change most directly addresses the stated requirement?
- Create feasible bandwidth allocations and an explicit priority bandwidth budget that sums within supported scheduler constraints.
- Use link-aware QoS policy to update shaping and class allocations for the reduced-capacity backup transport.
- Classify traffic by actual application need and reserve EF treatment for suitable expedited traffic.
- Combine trusted traffic classification and marking with a suitable egress priority queue and bandwidth admission design.
Explanation
Correct Answer
A:The design is validated when all essential classes receive their planned treatment without violating actual egress capacity.
Incorrect Answers
B:That option concerns a separate design case: A 20-Mbps backup link replaces a 200-Mbps primary WAN but the shaper keeps its 200-Mbps limit after failover. The relevant control here is: Create feasible bandwidth allocations and an explicit priority bandwidth budget that sums within supported scheduler constraints.
C:That option concerns a separate design case: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. The relevant control here is: Create feasible bandwidth allocations and an explicit priority bandwidth budget that sums within supported scheduler constraints.
D:That option concerns a separate design case: A regional WAN prioritizes voice using a DiffServ marking but provides no scheduler preference on its congested egress link. The relevant control here is: Create feasible bandwidth allocations and an explicit priority bandwidth budget that sums within supported scheduler constraints.
Question 209
GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. Which design change most directly addresses the stated requirement?
- Apply topology or centralized control policy at the appropriate site/VPN scope.
- Include latency, jitter and loss thresholds appropriate to the application class.
- Select supported WAN edge platforms and onboard them with correctly separated transport and service VPNs.
- Design redundant supported key servers and registration/rekey recovery for the group encryption domain.
Explanation
Correct Answer
D:The design is validated when surviving key servers provide policies and secure data traffic remains operational through maintenance.
Incorrect Answers
A:That option concerns a separate design case: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. The relevant control here is: Design redundant supported key servers and registration/rekey recovery for the group encryption domain.
B:That option concerns a separate design case: A video conference SD-WAN policy accepts tunnels with 1% packet loss but ignores sustained jitter above application tolerance. The relevant control here is: Design redundant supported key servers and registration/rekey recovery for the group encryption domain.
C:That option concerns a separate design case: Branches will be migrated from static internet VPNs to SD-WAN customer edges but the design omits transport isolation and overlay security. The relevant control here is: Design redundant supported key servers and registration/rekey recovery for the group encryption domain.
Question 210
IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. Which design change most directly addresses the stated requirement?
- Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.
- Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile.
- Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
- Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks.
Explanation
Correct Answer
C:The design is validated when all approved powered endpoints boot under full load and stay powered after one permitted PSU failure.
Incorrect Answers
A:That option concerns a separate design case: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. The relevant control here is: Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
B:That option concerns a separate design case: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. The relevant control here is: Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
D:That option concerns a separate design case: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. The relevant control here is: Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests