100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 240
A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. Which observed result would most directly prove the design meets the intended goal?
- Both failure exercises satisfy the documented outage budget without skipping required policy checks.
- Changes to one tenant's routes do not leak or alter the other's forwarding state.
- A representative prefix crosses the boundary once and retains deterministic return routing.
- Gateway traffic survives a controlled supervisor transition within the approved outage budget.
Explanation
Correct Answer
A:Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It does not verify the present outcome.
C:This observation relates to a different topology: Two intercampus routers redistribute OSPF and EIGRP in both directions, making route origin hard to track. It does not verify the present outcome.
D:This observation relates to a different topology: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not verify the present outcome.
Question 241
SD-WAN edges register to the validator but receive no OMP route updates from the controller, and the team claims the underlay is broken. Which observed result would most directly prove the design meets the intended goal?
- Services over the optical circuit remain isolated by the appropriate higher-layer controls.
- The branch switches to the secondary circuit within the required service recovery interval.
- The branch establishes the required controlled overlay sessions without depending on unsupported unsolicited inbound access.
- Edges establish controller sessions and exchange authorized OMP reachability while the transport remains reachable.
Explanation
Correct Answer
D:Distinguish orchestration, management, control-plane and data-plane roles and repair the controller/OMP relationship. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. It does not verify the present outcome.
B:This observation relates to a different topology: An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. It does not verify the present outcome.
C:This observation relates to a different topology: An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. It does not verify the present outcome.
Question 242
An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. Which observed result would most directly prove the design meets the intended goal?
- Authorized cloud prefixes are reachable over intended private paths after one interconnect fails.
- The controller successfully reads and writes only the supported wireless policy nodes on target devices.
- Approved burst workloads operate across the private and public boundaries without unrestricted network trust.
- Each authorized transaction commits its intended changes without mixing concurrent candidates.
Explanation
Correct Answer
C:Classify the combined arrangement as hybrid cloud and design controlled identity, routing, and data movement policies. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. It does not verify the present outcome.
B:This observation relates to a different topology: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It does not verify the present outcome.
D:This observation relates to a different topology: A NETCONF client edits a shared candidate configuration while another orchestrator is modifying the same device. It does not verify the present outcome.
Question 243
A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. Which observed result would most directly prove the design meets the intended goal?
- An emergency administrator maintains workable session latency while backup transfer runs.
- Burst traffic drains within a controlled rate envelope with fewer avoidable losses.
- Measured traffic conforms to the allowed profile and application packet loss decreases under load.
- Priority queuing protects genuine voice media while backup traffic no longer occupies the strict-priority class.
Explanation
Correct Answer
B:Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. It does not verify the present outcome.
C:This observation relates to a different topology: A 1-Gbps campus uplink feeds a 100-Mbps WAN access circuit and packets drop in unpredictable bursts at the provider policer. It does not verify the present outcome.
D:This observation relates to a different topology: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It does not verify the present outcome.
Question 244
A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. Which observed result would most directly prove the design meets the intended goal?
- A core-device failure leaves required services available through the alternate attachment.
- The rogue bridge cannot become campus root and protected access interfaces enter their intended security state.
- Only the approved number of endpoint identities can use the port while rogue downstream devices are blocked.
- Target PCs wake under a controlled off-hours test without exposing unnecessary broadcast reachability.
Explanation
Correct Answer
C:Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. It does not verify the present outcome.
B:This observation relates to a different topology: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It does not verify the present outcome.
D:This observation relates to a different topology: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. It does not verify the present outcome.
Question 245
IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. Which observed result would most directly prove the design meets the intended goal?
- Allowed external routes appear without reentering their origin routing domain on an alternate border.
- A genuine path failure is detected within the target interval while benign load does not flap sessions.
- Local access failures generate bounded LSDB changes without disrupting unrelated branches.
- All ABRs maintain backbone reachability and interarea routes converge through the intended topology.
Explanation
Correct Answer
A:Use controlled redistribution policy with route tags and a defined protocol boundary between OSPF and IS-IS. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A design team wants fast OSPF failure detection on long-running optical links without dropping stable adjacencies during occasional control-plane delay. It does not verify the present outcome.
C:This observation relates to a different topology: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It does not verify the present outcome.
D:This observation relates to a different topology: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It does not verify the present outcome.
Question 246
A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. Which observed result would most directly prove the design meets the intended goal?
- Both routers carry planned VLAN traffic in steady state and provide gateway redundancy during outages.
- Gateway traffic survives a controlled supervisor transition within the approved outage budget.
- Uplink failure triggers the intended gateway takeover and remote application sessions recover.
- Both paths carry approved traffic and a member failure has no broad STP reconvergence.
Explanation
Correct Answer
A:Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not verify the present outcome.
C:This observation relates to a different topology: HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. It does not verify the present outcome.
D:This observation relates to a different topology: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It does not verify the present outcome.
Question 247
Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. Which observed result would most directly prove the design meets the intended goal?
- The neighbors reach FULL and application packets traverse without fragmentation problems.
- OSPF adjacencies establish only between intended authenticated peers and survive planned key changes.
- After repairing the link, LSP churn falls and traffic reconverges on stable intended paths.
- Failed-route convergence completes without broad stuck-in-active propagation.
Explanation
Correct Answer
A:Align supported interface MTU and OSPF adjacency parameters rather than suppressing the mismatch blindly. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It does not verify the present outcome.
C:This observation relates to a different topology: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. It does not verify the present outcome.
D:This observation relates to a different topology: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It does not verify the present outcome.
Question 248
Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. Which observed result would most directly prove the design meets the intended goal?
- Voice delay stays within SLA during video bursts while other classes retain scheduled service.
- Packet captures across both sites show correct class markings before and after provider handoff.
- Backup operations continue at lower priority without violating interactive video quality.
- Guest traffic uses its approved classes without consuming the premium real-time queue.
Explanation
Correct Answer
B:Standardize classification and remarking policy across all controlled network trust boundaries. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: Video and voice both use one strict-priority queue, causing voice jitter when video surges. It does not verify the present outcome.
C:This observation relates to a different topology: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It does not verify the present outcome.
D:This observation relates to a different topology: An enterprise WAN receives DSCP values from untrusted guest clients and propagates them unchanged into privileged queues. It does not verify the present outcome.
Question 249
A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. Which observed result would most directly prove the design meets the intended goal?
- Child SAs establish for the matching traffic selectors and permitted applications pass.
- The site retains approved application reachability after losing one WAN edge or carrier path.
- Guest prefixes and traffic stay isolated from production routes and data tunnels.
- The device authenticates and forms approved control sessions with the SD-WAN fabric.
Explanation
Correct Answer
D:Align the signed device identity, organization name and controller trust requirements for supported secure onboarding. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. It does not verify the present outcome.
B:This observation relates to a different topology: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It does not verify the present outcome.
C:This observation relates to a different topology: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. It does not verify the present outcome.
Question 250
A campus configures very aggressive BFD intervals on thousands of routed links and then sees intermittent neighbor flaps at peak CPU. Which observed result would most directly prove the design meets the intended goal?
- Both routed uplinks forward to the rest of campus and a link failure reroutes traffic without a campus STP event.
- Approved intersite traffic carries the expected segmentation context without undesired leakage.
- Uplink failure triggers the intended gateway takeover and remote application sessions recover.
- True failures are found promptly while healthy links no longer reset under ordinary control-plane load.
Explanation
Correct Answer
D:Tune BFD intervals and session scale to supported hardware and realistic detection requirements. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. It does not verify the present outcome.
B:This observation relates to a different topology: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It does not verify the present outcome.
C:This observation relates to a different topology: HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. It does not verify the present outcome.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
