100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 230
A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. Which observed result would most directly prove the design meets the intended goal?
- Approved intersite traffic carries the expected segmentation context without undesired leakage.
- Rogue DHCP offers from access ports are dropped while authorized client leases succeed.
- Each AP enables its intended radio features at full load without power denial or downshift.
- Gateway traffic survives a controlled supervisor transition within the approved outage budget.
Explanation
Correct Answer
B:Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It does not verify the present outcome.
C:This observation relates to a different topology: A wireless access-point refresh increases PoE needs above the available 802.3at class on older switches. It does not verify the present outcome.
D:This observation relates to a different topology: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not verify the present outcome.
Question 231
Headquarters supports IPv4 but users now require IPv6 applications without losing legacy IPv4 services. Which observed result would most directly prove the design meets the intended goal?
- Native IPv4 and IPv6 traffic reaches only approved services and each family has working operations telemetry.
- IPv6 connections to protected applications are blocked or allowed consistently with approved policy.
- The IPv6 client resolves and accesses the approved IPv4 service without adopting IPv4 on the client.
- Authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path.
Explanation
Correct Answer
A:Deploy tested dual stack where both address families, DNS, routing and access controls are supported end to end. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. It does not verify the present outcome.
C:This observation relates to a different topology: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It does not verify the present outcome.
D:This observation relates to a different topology: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It does not verify the present outcome.
Question 232
A NETCONF client edits a shared candidate configuration while another orchestrator is modifying the same device. Which observed result would most directly prove the design meets the intended goal?
- Each authorized transaction commits its intended changes without mixing concurrent candidates.
- Approved configuration changes use the negotiated datastore and produce attributable RPC replies.
- The receiver obtains the expected measurement updates for every required signal.
- Approved burst workloads operate across the private and public boundaries without unrestricted network trust.
Explanation
Correct Answer
A:Use supported NETCONF locks, edit-config validation and controlled commit workflow to serialize sensitive changes. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It does not verify the present outcome.
C:This observation relates to a different topology: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It does not verify the present outcome.
D:This observation relates to a different topology: An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. It does not verify the present outcome.
Question 233
Branches will be migrated from static internet VPNs to SD-WAN customer edges but the design omits transport isolation and overlay security. Which observed result would most directly prove the design meets the intended goal?
- Sites establish secure control sessions and authorized data-plane tunnels for their assigned service segments.
- Each branch exchanges only authorized VPN routes while the provider backbone transports traffic without L2 extension.
- Expected tagged traffic traverses the authorized EVC and unrelated tags are isolated.
- Protected traffic crosses an established security association and is unreadable on the public underlay.
Explanation
Correct Answer
A:Select supported WAN edge platforms and onboard them with correctly separated transport and service VPNs. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It does not verify the present outcome.
C:This observation relates to a different topology: Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. It does not verify the present outcome.
D:This observation relates to a different topology: A site-to-site tunnel must protect financial payload confidentiality and integrity across the public internet. It does not verify the present outcome.
Question 234
A team expects multicast traffic to traverse a shared tree forever even though its design requests shortest-path switching. Which observed result would most directly prove the design meets the intended goal?
- Intended receivers across the routed boundary receive the source stream.
- Telemetry remains within service capacity and operators can still reach consoles under load.
- Receiver forwarding follows the intended tree state after source discovery and any supported SPT transition.
- Multiple authorized sources reach receiver sets through the designed bidirectional shared tree.
Explanation
Correct Answer
C:Distinguish RP-rooted shared trees from source-specific shortest-path trees and design switch behavior accordingly. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It does not verify the present outcome.
B:This observation relates to a different topology: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It does not verify the present outcome.
D:This observation relates to a different topology: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It does not verify the present outcome.
Question 235
A merger requires two administrative BGP regions to appear as one external AS while reducing iBGP mesh size internally. Which observed result would most directly prove the design meets the intended goal?
- Route reflector clients learn authorized prefixes without maintaining a full mesh of all client sessions.
- External peers see the intended confederation identifier while internal sub-AS sessions provide approved reachability.
- All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
- Both eligible next hops appear in the forwarding table and share representative flows.
Explanation
Correct Answer
B:Evaluate an appropriately designed BGP confederation with documented member-AS and external peer behavior. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A network with 80 iBGP routers becomes difficult to operate because every router forms a full mesh of peer sessions. It does not verify the present outcome.
C:This observation would validate a different case: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It does not establish the target outcome for this topology.
D:This observation relates to a different topology: A campus border is configured with two equal-cost external BGP paths but only one is installed for traffic forwarding. It does not verify the present outcome.
Question 236
An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. Which observed result would most directly prove the design meets the intended goal?
- Only the approved number of endpoint identities can use the port while rogue downstream devices are blocked.
- The rogue bridge cannot become campus root and protected access interfaces enter their intended security state.
- A moved endpoint retains its intended policy and access to only approved destinations.
- All approved powered endpoints boot under full load and stay powered after one permitted PSU failure.
Explanation
Correct Answer
B:Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It does not verify the present outcome.
C:This observation relates to a different topology: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. It does not verify the present outcome.
D:This observation relates to a different topology: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It does not verify the present outcome.
Question 237
Two business units share one management VLAN with unrestricted access to each other's routers. Which observed result would most directly prove the design meets the intended goal?
- An emergency administrator maintains workable session latency while backup transfer runs.
- Unit administrators can reach authorized nodes but are denied management of unrelated infrastructure.
- Guest over-limit traffic is dropped or remarked as specified while protected applications maintain quality.
- Delay-sensitive traffic receives scheduled treatment at both campus and WAN congestion points.
Explanation
Correct Answer
B:Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. It does not verify the present outcome.
C:This observation relates to a different topology: A guest wireless SSID creates burst traffic exceeding its contracted share and disrupts campus applications. It does not verify the present outcome.
D:This observation relates to a different topology: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It does not verify the present outcome.
Question 238
A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. Which observed result would most directly prove the design meets the intended goal?
- Child SAs establish for the matching traffic selectors and permitted applications pass.
- Large application sessions succeed with correct effective packet sizing over each approved transport.
- Approved endpoints encrypt traffic while retaining the provider's intended any-to-any routing paths.
- Authorized overlay tunnels form between intended peers without manually maintained full-mesh IKE policy.
Explanation
Correct Answer
B:Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. It does not verify the present outcome.
C:This observation relates to a different topology: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It does not verify the present outcome.
D:This observation relates to a different topology: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. It does not verify the present outcome.
Question 239
Two acquired companies both use 172.16.0.0/12; an immediate core merge would expose identical destination prefixes. Which observed result would most directly prove the design meets the intended goal?
- Both tenants resolve overlapping addresses within their own routing tables while approved intercompany services remain reachable.
- Authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path.
- After repairing the link, LSP churn falls and traffic reconverges on stable intended paths.
- The neighbors reach FULL and application packets traverse without fragmentation problems.
Explanation
Correct Answer
A:Preserve separate VRFs and apply a scoped, documented translation or renumbering design at the interconnect boundary. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It does not verify the present outcome.
C:This observation relates to a different topology: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. It does not verify the present outcome.
D:This observation relates to a different topology: Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. It does not verify the present outcome.
Question 240
A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. Which observed result would most directly prove the design meets the intended goal?
- Both failure exercises satisfy the documented outage budget without skipping required policy checks.
- Changes to one tenant's routes do not leak or alter the other's forwarding state.
- A representative prefix crosses the boundary once and retains deterministic return routing.
- Gateway traffic survives a controlled supervisor transition within the approved outage budget.
Explanation
Correct Answer
A:Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It does not verify the present outcome.
C:This observation relates to a different topology: Two intercampus routers redistribute OSPF and EIGRP in both directions, making route origin hard to track. It does not verify the present outcome.
D:This observation relates to a different topology: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not verify the present outcome.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
