100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 270
In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. Which observed result would most directly prove the design meets the intended goal?
- Control-plane endpoint mappings resolve and separate packet captures show VXLAN data forwarding between fabric edges.
- Underlay nodes reach fabric RLOCs while user endpoints are mapped and forwarded through the correct overlay VN.
- External routes and flows remain segmented by approved virtual network.
- Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes.
Explanation
Correct Answer
B:Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It does not verify the present outcome.
C:This observation relates to a different topology: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It does not verify the present outcome.
D:This observation relates to a different topology: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It does not verify the present outcome.
Question 271
An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. Which observed result would most directly prove the design meets the intended goal?
- Allowed external routes appear without reentering their origin routing domain on an alternate border.
- Local access failures generate bounded LSDB changes without disrupting unrelated branches.
- Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed.
- All ABRs maintain backbone reachability and interarea routes converge through the intended topology.
Explanation
Correct Answer
B:Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. It does not verify the present outcome.
C:This observation relates to a different topology: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It does not verify the present outcome.
D:This observation relates to a different topology: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It does not verify the present outcome.
Question 272
Video and voice both use one strict-priority queue, causing voice jitter when video surges. Which observed result would most directly prove the design meets the intended goal?
- Priority queuing protects genuine voice media while backup traffic no longer occupies the strict-priority class.
- Only the intended interactive application receives real-time class treatment during a test.
- Control-plane adjacencies and monitoring remain stable during representative congestion.
- Voice delay stays within SLA during video bursts while other classes retain scheduled service.
Explanation
Correct Answer
D:Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It does not verify the present outcome.
B:This observation relates to a different topology: A branch QoS policy matches all TCP 443 traffic as video, including large software downloads. It does not verify the present outcome.
C:This observation relates to a different topology: A campus QoS policy gives low priority to routing keepalives and network monitoring, and routing adjacencies flap during congestion. It does not verify the present outcome.
Question 273
A 5,000-user branch rollout wants direct SaaS breakout through local cloud on-ramp but all DNS still resolves clients to the distant headquarters proxy region. Which observed result would most directly prove the design meets the intended goal?
- Authorized cloud prefixes are reachable over intended private paths after one interconnect fails.
- SaaS sessions use an approved closer path while security controls and logging remain effective.
- The collector reads comparable interface fields from Cisco and non-Cisco devices using supported model paths.
- A readback of the exact resource confirms only the intended configuration changed.
Explanation
Correct Answer
B:Coordinate cloud on-ramp routing with DNS, security and application placement to reduce unnecessary tromboning. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. It does not verify the present outcome.
C:This observation relates to a different topology: A multivendor enterprise wants one consistent YANG representation for interface operational counters but each platform exposes vendor-specific native trees. It does not verify the present outcome.
D:This observation relates to a different topology: A controller issues RESTCONF PATCH to many routers but treats HTTP 200 from a reverse proxy login page as proof that config was changed. It does not verify the present outcome.
Question 274
A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. Which observed result would most directly prove the design meets the intended goal?
- Multicast protocol control and user traffic traverse the overlay while mandated encryption tests also pass where enabled.
- Routed adjacency and encapsulated application flows operate through the secure tunnel.
- Enterprise routers form intended routing neighbors over the circuit while provider internals remain hidden.
- The approved VLAN service operates end to end without leaking unrelated hospital segments.
Explanation
Correct Answer
C:Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. It does not verify the present outcome.
B:This observation relates to a different topology: An enterprise replaces a point-to-point GRE tunnel with raw IPsec ESP and expects dynamic multicast routing hellos to work unchanged. It does not verify the present outcome.
D:This offered choice, “The approved VLAN service operates end to end without leaking unrelated hospital segments”, addresses a separate concern. That option relates to this separate design case: Two hospitals need their existing Ethernet VLANs extended across a provider circuit but their engineers incorrectly request a routed L3VPN. It does not answer the current requirement.
Question 275
A design team treats NSR and NSF as synonyms and assumes route preservation when the only Routing Processor crashes. Which observed result would most directly prove the design meets the intended goal?
- Intersite overlay flows survive the engineered path and meet their measured size and latency limits.
- Representative flows distribute across eligible next hops while a single ordered flow remains stable.
- The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.
- A standby control plane takes over or forwarding is preserved according to the selected capability's documented scope.
Explanation
Correct Answer
D:Differentiate NSR control-plane state replication from NSF forwarding continuity and design according to supported platform roles. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It does not verify the present outcome.
B:This observation relates to a different topology: A multicampus network has two equal-cost paths but the design assumes packets always alternate evenly across every individual packet. It does not verify the present outcome.
C:This observation relates to a different topology: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. It does not verify the present outcome.
Question 276
A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. Which observed result would most directly prove the design meets the intended goal?
- The IPv6 client resolves and accesses the approved IPv4 service without adopting IPv4 on the client.
- IPv6 connections to protected applications are blocked or allowed consistently with approved policy.
- Local access failures generate bounded LSDB changes without disrupting unrelated branches.
- Native IPv4 and IPv6 traffic reaches only approved services and each family has working operations telemetry.
Explanation
Correct Answer
B:Coordinate IPv6 rollout with equivalent policy, logging, and path monitoring before publishing AAAA records. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It does not verify the present outcome.
C:This observation relates to a different topology: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It does not verify the present outcome.
D:This observation relates to a different topology: Headquarters supports IPv4 but users now require IPv6 applications without losing legacy IPv4 services. It does not verify the present outcome.
Question 277
An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. Which observed result would most directly prove the design meets the intended goal?
- Authorized receivers join named sources and receive streams without relying on RP registration.
- Packets arriving on incorrect RPF interfaces are rejected and legitimate receiver traffic passes.
- Intended receivers obtain the translated stream while unrelated multicast groups remain separate.
- The receiver sends a source-specific join and obtains only the authorized stream.
Explanation
Correct Answer
C:Evaluate controlled multicast service reflection or translation with explicit source/group mappings. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A 10,000-receiver IPTV deployment requires one-to-many traffic from known sources but still uses RP discovery for each stream. It does not verify the present outcome.
B:This observation relates to a different topology: A multicast source is reachable through an interface other than the one receiving the packet, but the router still forwards it to all receivers. It does not verify the present outcome.
D:This observation relates to a different topology: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It does not verify the present outcome.
Question 278
A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. Which observed result would most directly prove the design meets the intended goal?
- The branch establishes the required controlled overlay sessions without depending on unsupported unsolicited inbound access.
- The required VPN tunnels and critical services establish over cellular during a failure exercise.
- The chosen design meets the approved recovery target at a justified life-cycle cost.
- Application sessions remain stable through short intermittent primary path disturbances.
Explanation
Correct Answer
D:Introduce deliberate recovery policy or dampening to prevent repeated unstable failback. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. It does not verify the present outcome.
B:This observation relates to a different topology: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It does not verify the present outcome.
C:This observation relates to a different topology: A single-homed retail branch can tolerate a four-hour outage but the proposal adds expensive dual-carrier fiber without a business case. It does not verify the present outcome.
Question 279
Three campus sites peer with a shared WAN hub; every site transits through the hub even for cross-campus traffic and voice suffers latency. Which observed result would most directly prove the design meets the intended goal?
- Changes to one tenant's routes do not leak or alter the other's forwarding state.
- Site-to-site voice follows a lower-latency approved route while hub failure leaves planned alternate reachability.
- The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.
- Prefix changes within a campus no longer cause unnecessary global churn while remote packets use the proper border.
Explanation
Correct Answer
B:Design a routed intercampus topology with appropriate direct or regional paths and deterministic failover. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It does not verify the present outcome.
C:This observation relates to a different topology: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. It does not verify the present outcome.
D:This observation relates to a different topology: Branch-specific prefix updates flood every campus router; a proposed aggregate crosses two distinct WAN egress sites. It does not verify the present outcome.
Question 280
An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. Which observed result would most directly prove the design meets the intended goal?
- Clients retain enough independent eligible paths to support the agreed failover policy.
- Branch routers no longer send packets for the retired /24 into a blackhole created by the former summary.
- Failed-route convergence completes without broad stuck-in-active propagation.
- Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible.
Explanation
Correct Answer
A:Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. It does not verify the present outcome.
C:This observation relates to a different topology: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It does not verify the present outcome.
D:This observation relates to a different topology: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not verify the present outcome.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
