100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 210
IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. Which design change most directly addresses the stated requirement?
- Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.
- Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile.
- Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
- Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks.
Explanation
Correct Answer
C:The design is validated when all approved powered endpoints boot under full load and stay powered after one permitted PSU failure.
Incorrect Answers
A:That option concerns a separate design case: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. The relevant control here is: Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
B:That option concerns a separate design case: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. The relevant control here is: Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
D:That option concerns a separate design case: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. The relevant control here is: Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
Question 211
New routers have valid IP addresses but IS-IS peers in separate areas never form a level-1 adjacency. Which design change most directly addresses the stated requirement?
- Design an appropriate level-2 backbone with level-1/level-2 routers at area boundaries.
- Align IS-IS area addresses for L1 neighbor formation or use supported level-2 adjacency where the topology requires interarea routing.
- Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication.
- Set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths.
Explanation
Correct Answer
B:The design is validated when the intended adjacency comes up at the correct level and interarea destinations remain reachable.
Incorrect Answers
A:That option concerns a separate design case: A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. The relevant control here is: Align IS-IS area addresses for L1 neighbor formation or use supported level-2 adjacency where the topology requires interarea routing.
C:That option concerns a separate design case: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. The relevant control here is: Align IS-IS area addresses for L1 neighbor formation or use supported level-2 adjacency where the topology requires interarea routing.
D:That option concerns a separate design case: A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. The relevant control here is: Align IS-IS area addresses for L1 neighbor formation or use supported level-2 adjacency where the topology requires interarea routing.
Question 212
Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. Which design change most directly addresses the stated requirement?
- Use link-aware QoS policy to update shaping and class allocations for the reduced-capacity backup transport.
- Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
- Rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions.
- Align SSM membership to include the desired (S,G) source/group relationship.
Explanation
Correct Answer
B:The design is validated when a WAN outage still produces actionable diagnostics and authorized operator access.
Incorrect Answers
A:That option concerns a separate design case: A 20-Mbps backup link replaces a 200-Mbps primary WAN but the shaper keeps its 200-Mbps limit after failover. The relevant control here is: Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
C:That option concerns a separate design case: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. The relevant control here is: Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
D:That option concerns a separate design case: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. The relevant control here is: Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
Question 213
A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. Which design change most directly addresses the stated requirement?
- Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN.
- Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
- Apply topology or centralized control policy at the appropriate site/VPN scope.
- Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.
Explanation
Correct Answer
B:The design is validated when multicast protocol control and user traffic traverse the overlay while mandated encryption tests also pass where enabled.
Incorrect Answers
A:That option concerns a separate design case: A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. The relevant control here is: Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
C:That option concerns a separate design case: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. The relevant control here is: Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
D:That option concerns a separate design case: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. The relevant control here is: Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
Question 214
A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. Which design change most directly addresses the stated requirement?
- Use an appropriate Cisco native YANG model for supported platform-specific configuration.
- Use a periodic telemetry subscription at a measured cadence suitable for trending and capacity planning.
- Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
- Use supported on-change telemetry for the interface state leaf where device and model support it.
Explanation
Correct Answer
C:The design is validated when schema registry entries identify the correct module namespace and revisions for each controller operation.
Incorrect Answers
A:That option concerns a separate design case: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. The relevant control here is: Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
B:That option concerns a separate design case: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. The relevant control here is: Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
D:That option concerns a separate design case: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. The relevant control here is: Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
Question 215
Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. Which design change most directly addresses the stated requirement?
- Update summary ownership and ensure discarded or absent specifics cannot mask the retired destination.
- Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
- Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
- Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.
Explanation
Correct Answer
C:The design is validated when encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes.
Incorrect Answers
A:That option concerns a separate design case: A site cutover retains a withdrawn /24 under an unchanged /20 campus summary and traffic follows an obsolete transit path. The relevant control here is: Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
B:That option concerns a separate design case: In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. The relevant control here is: Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
D:That option concerns a separate design case: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. The relevant control here is: Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
Question 216
A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. Which design change most directly addresses the stated requirement?
- Use local preference or another AS-wide BGP policy rather than relying on locally significant weight.
- Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks.
- Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
- Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops.
Explanation
Correct Answer
A:The design is validated when the intended exit preference propagates across internal BGP speakers.
Incorrect Answers
B:That option concerns a separate design case: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. The relevant control here is: Use local preference or another AS-wide BGP policy rather than relying on locally significant weight.
C:That option concerns a separate design case: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. The relevant control here is: Use local preference or another AS-wide BGP policy rather than relying on locally significant weight.
D:That option concerns a separate design case: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. The relevant control here is: Use local preference or another AS-wide BGP policy rather than relying on locally significant weight.
Question 217
A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. Which design change most directly addresses the stated requirement?
- Use the SD-WAN control-plane and key distribution capabilities appropriate to the supported solution.
- Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
- Plan scalable overlay topology and path policy based on actual edge session, route and encryption resource limits.
- Include latency, jitter and loss thresholds appropriate to the application class.
Explanation
Correct Answer
A:The design is validated when authorized overlay tunnels form between intended peers without manually maintained full-mesh IKE policy.
Incorrect Answers
B:That option concerns a separate design case: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. The relevant control here is: Use the SD-WAN control-plane and key distribution capabilities appropriate to the supported solution.
C:That option concerns a separate design case: A WAN edge has hundreds of VPN prefixes and growing TLOC paths; an all-to-all overlay approaches its platform session capacity. The relevant control here is: Use the SD-WAN control-plane and key distribution capabilities appropriate to the supported solution.
D:That option concerns a separate design case: A video conference SD-WAN policy accepts tunnels with 1% packet loss but ignores sustained jitter above application tolerance. The relevant control here is: Use the SD-WAN control-plane and key distribution capabilities appropriate to the supported solution.
Question 218
A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. Which design change most directly addresses the stated requirement?
- Rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions.
- Standardize classification and remarking policy across all controlled network trust boundaries.
- Classify traffic by actual application need and reserve EF treatment for suitable expedited traffic.
- Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
Explanation
Correct Answer
D:The design is validated when backup operations continue at lower priority without violating interactive video quality.
Incorrect Answers
A:That option concerns a separate design case: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. The relevant control here is: Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
B:That option concerns a separate design case: Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. The relevant control here is: Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
C:That option concerns a separate design case: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. The relevant control here is: Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
Question 219
Two intercampus routers redistribute OSPF and EIGRP in both directions, making route origin hard to track. Which design change most directly addresses the stated requirement?
- Simplify path preference at domain boundaries and choose intended transit points based on actual traffic flows.
- Evaluate supported BFD-based fault detection and matching IGP convergence policy for the routed adjacency.
- Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions.
- Apply selective redistribution, tagging and route filtering at clearly defined protocol boundaries.
Explanation
Correct Answer
D:The design is validated when a representative prefix crosses the boundary once and retains deterministic return routing.
Incorrect Answers
A:That option concerns a separate design case: A branch aggregation point has both IS-IS and OSPF neighbors with multiple equal-cost exits; traffic unexpectedly hairpins through a data center. The relevant control here is: Apply selective redistribution, tagging and route filtering at clearly defined protocol boundaries.
B:That option concerns a separate design case: Campus routers detect a fiber break only after long OSPF dead timers, missing a strict voice recovery target. The relevant control here is: Apply selective redistribution, tagging and route filtering at clearly defined protocol boundaries.
C:That option concerns a separate design case: A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. The relevant control here is: Apply selective redistribution, tagging and route filtering at clearly defined protocol boundaries.
Question 220
A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. Which design change most directly addresses the stated requirement?
- Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
- Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards.
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
Explanation
Correct Answer
B:The design is validated when each site advertises unique prefixes and the regional summarization boundary routes traffic to the correct branch.
Incorrect Answers
A:That option concerns a separate design case: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. The relevant control here is: Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
C:That option concerns a separate design case: An edge router receives a full BGP table where the security policy allows only the provider's approved default. The relevant control here is: Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
D:This alternative is aimed at a different design constraint: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. The relevant control for this case is: Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests