100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 220
A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. Which design change most directly addresses the stated requirement?
- Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
- Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards.
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
Explanation
Correct Answer
B:The design is validated when each site advertises unique prefixes and the regional summarization boundary routes traffic to the correct branch.
Incorrect Answers
A:That option concerns a separate design case: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. The relevant control here is: Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
C:That option concerns a separate design case: An edge router receives a full BGP table where the security policy allows only the provider's approved default. The relevant control here is: Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
D:This alternative is aimed at a different design constraint: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. The relevant control for this case is: Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
Question 221
Two BGP route reflectors share a cluster ID incorrectly with another independent cluster and some legitimate reflected updates disappear. Which observed result would most directly prove the design meets the intended goal?
- All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
- All ABRs maintain backbone reachability and interarea routes converge through the intended topology.
- Both reflectors establish independent sessions and logs identify each peer without duplicate router IDs.
- Intended client routes propagate without being discarded by false cluster-loop detection.
Explanation
Correct Answer
D:Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation would validate a different case: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It does not establish the target outcome for this topology.
B:This observation relates to a different topology: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It does not verify the present outcome.
C:This observation relates to a different topology: A data-center team assigns the same loopback IPv4 address to two route reflectors for convenience but also uses it as unique BGP router identifiers. It does not verify the present outcome.
Question 222
A controller issues RESTCONF PATCH to many routers but treats HTTP 200 from a reverse proxy login page as proof that config was changed. Which observed result would most directly prove the design meets the intended goal?
- The responsibility matrix assigns OS patching and application security to the appropriate customer team.
- A readback of the exact resource confirms only the intended configuration changed.
- The controller successfully reads and writes only the supported wireless policy nodes on target devices.
- The client negotiates capabilities and receives model-based Get/Subscribe responses from the intended target.
Explanation
Correct Answer
B:Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A customer rents virtual machines from a provider and must patch their operating systems, but procurement classifies the service as SaaS. It does not verify the present outcome.
C:This observation relates to a different topology: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It does not verify the present outcome.
D:This observation relates to a different topology: A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. It does not verify the present outcome.
Question 223
A disaster-recovery branch depends on a 5G uplink as backup for wired MPLS, but cellular coverage varies by carrier and power failure. Which observed result would most directly prove the design meets the intended goal?
- Measured throughput and failover meet the contractual envelope across the metro sites.
- The required VPN tunnels and critical services establish over cellular during a failure exercise.
- During a controlled primary outage, the cellular path carries the approved critical application classes.
- Application sessions remain stable through short intermittent primary path disturbances.
Explanation
Correct Answer
C:Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A city campus needs a 10-Gbps local metro interconnect with SLA and carrier demarcation, but the proposed design assumes standard broadband internet guarantees. It does not verify the present outcome.
B:This observation relates to a different topology: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It does not verify the present outcome.
D:This observation relates to a different topology: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. It does not verify the present outcome.
Question 224
An enterprise stretches 200 VLANs end-to-end through many buildings and one STP event triggers campus-wide reconvergence. Which observed result would most directly prove the design meets the intended goal?
- An access-switch failure affects only its intended local domain rather than propagating broad STP churn.
- Clients discover approved printers across subnets without carrying all broadcasts between buildings.
- Both routers carry planned VLAN traffic in steady state and provide gateway redundancy during outages.
- Intersite overlay flows survive the engineered path and meet their measured size and latency limits.
Explanation
Correct Answer
A:Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A campus access layer spans large broadcast domains for print discovery despite an architecture target of small local VLANs. It does not verify the present outcome.
C:This observation relates to a different topology: A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. It does not verify the present outcome.
D:This observation relates to a different topology: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It does not verify the present outcome.
Question 225
Network automation can push config to all devices because its management subnet is allowed everywhere despite a read-only reporting requirement. Which observed result would most directly prove the design meets the intended goal?
- Multiple authorized sources reach receiver sets through the designed bidirectional shared tree.
- A WAN outage still produces actionable diagnostics and authorized operator access.
- Guest routing tables contain no unauthorized management loopback routes.
- Monitoring reads succeed but change commands from the reporting service are denied.
Explanation
Correct Answer
D:Give reporting and change tools separate scoped management identities, roles, and network paths. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It does not verify the present outcome.
B:This observation relates to a different topology: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It does not verify the present outcome.
C:This observation relates to a different topology: A campus firewall isolates management VRFs but its shared-services route leaking exports all loopbacks to the guest VRF. It does not verify the present outcome.
Question 226
An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. Which observed result would most directly prove the design meets the intended goal?
- All ABRs maintain backbone reachability and interarea routes converge through the intended topology.
- Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed.
- The prefix exits through the intended ASBR and remains loop-free on failover.
- The hub forwards only to reachable site prefixes or intentionally documented summary ranges.
Explanation
Correct Answer
C:Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It does not verify the present outcome.
B:This observation relates to a different topology: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It does not verify the present outcome.
D:This observation relates to a different topology: Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. It does not verify the present outcome.
Question 227
A new fabric edge is reachable over IP, yet Catalyst Center shows its inventory and provisioning state incomplete. Which observed result would most directly prove the design meets the intended goal?
- The fabric edge is inventoried, assigned its intended role, and passes overlay endpoint traffic tests.
- A moved endpoint retains its intended policy and access to only approved destinations.
- Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes.
- External routes and flows remain segmented by approved virtual network.
Explanation
Correct Answer
A:Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. It does not verify the present outcome.
C:This observation relates to a different topology: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It does not verify the present outcome.
D:This observation relates to a different topology: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It does not verify the present outcome.
Question 228
A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. Which observed result would most directly prove the design meets the intended goal?
- End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment.
- Backup operations continue at lower priority without violating interactive video quality.
- Only authorized operators can connect to device management while public services remain available.
- Each business traffic class receives the agreed provider class and treatment across the WAN.
Explanation
Correct Answer
A:Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It does not verify the present outcome.
C:This observation relates to a different topology: Remote branch routers are managed using the same public internet IP address that exposes a user web service. It does not verify the present outcome.
D:This observation relates to a different topology: A WAN provider accepts only three traffic classes but headquarters configures eight local DSCP queues and assumes all survive the handoff. It does not verify the present outcome.
Question 229
Two WAN routers advertise the same prefix to separate providers, but the branch returns traffic through a firewall that tracks only one side of the asymmetric flow. Which observed result would most directly prove the design meets the intended goal?
- Application flows survive permitted egress changes without stateful-firewall drops.
- Approved site prefixes propagate across the interconnect while unrelated customer VPN routes remain isolated.
- The required VPN tunnels and critical services establish over cellular during a failure exercise.
- A controlled failure of either carrier access route leaves required service operational on the independent path.
Explanation
Correct Answer
A:Design multihoming with explicit path symmetry or state-sharing controls and validate both directions. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. It does not verify the present outcome.
C:This observation relates to a different topology: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It does not verify the present outcome.
D:This observation relates to a different topology: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. It does not verify the present outcome.
Question 230
A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. Which observed result would most directly prove the design meets the intended goal?
- Approved intersite traffic carries the expected segmentation context without undesired leakage.
- Rogue DHCP offers from access ports are dropped while authorized client leases succeed.
- Each AP enables its intended radio features at full load without power denial or downshift.
- Gateway traffic survives a controlled supervisor transition within the approved outage budget.
Explanation
Correct Answer
B:Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It does not verify the present outcome.
C:This observation relates to a different topology: A wireless access-point refresh increases PoE needs above the available 802.3at class on older switches. It does not verify the present outcome.
D:This observation relates to a different topology: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not verify the present outcome.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
