100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 280
An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. Which observed result would most directly prove the design meets the intended goal?
- Clients retain enough independent eligible paths to support the agreed failover policy.
- Branch routers no longer send packets for the retired /24 into a blackhole created by the former summary.
- Failed-route convergence completes without broad stuck-in-active propagation.
- Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible.
Explanation
Correct Answer
A:Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. It does not verify the present outcome.
C:This observation relates to a different topology: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It does not verify the present outcome.
D:This observation relates to a different topology: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not verify the present outcome.
Question 281
A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. Which observed result would most directly prove the design meets the intended goal?
- Approved site prefixes propagate across the interconnect while unrelated customer VPN routes remain isolated.
- Application flows survive permitted egress changes without stateful-firewall drops.
- Surviving key servers provide policies and secure data traffic remains operational through maintenance.
- A controlled failure of either carrier access route leaves required service operational on the independent path.
Explanation
Correct Answer
A:Design controlled interprovider VRF routing and CE route policy with explicit security and resiliency boundaries. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: Two WAN routers advertise the same prefix to separate providers, but the branch returns traffic through a firewall that tracks only one side of the asymmetric flow. It does not verify the present outcome.
C:This observation relates to a different topology: GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. It does not verify the present outcome.
D:This observation relates to a different topology: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. It does not verify the present outcome.
Question 282
Two tenants use 10.0.0.0/8 addressing and share the same campus core but require separate routing and firewall policies. Which observed result would most directly prove the design meets the intended goal?
- The unintended default is absent from production campus RIBs while valid branch summaries propagate.
- Duplicate prefixes coexist in isolated tables and cross-tenant routes appear only where authorized.
- A core-device failure leaves required services available through the alternate attachment.
- Loss of either PDU leaves the campus default gateway and upstream traffic operating.
Explanation
Correct Answer
B:Use VRF-based routing separation with explicitly controlled route leaking for shared services. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. It does not verify the present outcome.
C:This observation relates to a different topology: A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. It does not verify the present outcome.
D:This observation relates to a different topology: Two campus distribution routers each have a single power feed from the same rack PDU, yet the architecture counts them as separate fault domains. It does not verify the present outcome.
Question 283
A script writes `ietf-interfaces` fields to a platform supporting only a different module revision and receives an unknown-element error. Which observed result would most directly prove the design meets the intended goal?
- The receiver obtains the expected measurement updates for every required signal.
- The device accepts the schema-valid request and exposes the expected operational result.
- The controller successfully reads and writes only the supported wireless policy nodes on target devices.
- Schema registry entries identify the correct module namespace and revisions for each controller operation.
Explanation
Correct Answer
B:Negotiate supported YANG model names/revisions and update payload paths accordingly. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It does not verify the present outcome.
C:This observation relates to a different topology: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It does not verify the present outcome.
D:This observation relates to a different topology: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. It does not verify the present outcome.
Question 284
A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. Which observed result would most directly prove the design meets the intended goal?
- Branch routers no longer send packets for the retired /24 into a blackhole created by the former summary.
- Peer-received advertisements exclude the protected prefix while approved public routes remain.
- Clients retain enough independent eligible paths to support the agreed failover policy.
- Only intended branches learn the approved default source and backup behavior.
Explanation
Correct Answer
A:Remove or constrain the summary when it attracts traffic to networks not reachable through the campus boundary. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A partner BGP session accidentally advertises a sensitive 10.0.0.0/8 internal route to an external ASN. It does not verify the present outcome.
C:This observation relates to a different topology: An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. It does not verify the present outcome.
D:This observation relates to a different topology: A branch engineer redistributes a static default route into EIGRP and advertises it to every site, overriding the intended hub defaults. It does not verify the present outcome.
Question 285
A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. Which observed result would most directly prove the design meets the intended goal?
- Unit administrators can reach authorized nodes but are denied management of unrelated infrastructure.
- Delay-sensitive traffic receives scheduled treatment at both campus and WAN congestion points.
- Telemetry remains within service capacity and operators can still reach consoles under load.
- An emergency administrator maintains workable session latency while backup transfer runs.
Explanation
Correct Answer
D:Give critical management/control traffic an appropriate protected class and regulate bulk backup load. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: Two business units share one management VLAN with unrestricted access to each other's routers. It does not verify the present outcome.
B:This observation relates to a different topology: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It does not verify the present outcome.
C:This observation relates to a different topology: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It does not verify the present outcome.
Question 286
Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. Which observed result would most directly prove the design meets the intended goal?
- The hub forwards only to reachable site prefixes or intentionally documented summary ranges.
- The IPv6 client resolves and accesses the approved IPv4 service without adopting IPv4 on the client.
- The prefix exits through the intended ASBR and remains loop-free on failover.
- Branch routes remain reachable through the surviving aggregation router after failure.
Explanation
Correct Answer
A:Refine the summary to reflect reachable networks and provide appropriate handling for withdrawn components. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It does not verify the present outcome.
C:This observation relates to a different topology: An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. It does not verify the present outcome.
D:This observation relates to a different topology: An EIGRP deployment relies on a single aggregation router and an outage cuts off all downstream branches. It does not verify the present outcome.
Question 287
An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. Which observed result would most directly prove the design meets the intended goal?
- Neighbor relationships recover while supported forwarding state remains stable during the tested restart.
- A tested hardware or supervisor failure meets application recovery objectives without unexpected shared dependencies.
- Control-plane endpoint mappings resolve and separate packet captures show VXLAN data forwarding between fabric edges.
- Intersite overlay flows survive the engineered path and meet their measured size and latency limits.
Explanation
Correct Answer
C:Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. It does not verify the present outcome.
B:This observation relates to a different topology: A virtualized distribution pair uses one logical control plane and engineers assume it offers separate failure domains like two chassis in different buildings. It does not verify the present outcome.
D:This observation relates to a different topology: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It does not verify the present outcome.
Question 288
An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. Which observed result would most directly prove the design meets the intended goal?
- The branch switches to the secondary circuit within the required service recovery interval.
- Edges establish controller sessions and exchange authorized OMP reachability while the transport remains reachable.
- The site retains approved application reachability after losing one WAN edge or carrier path.
- Application sessions remain stable through short intermittent primary path disturbances.
Explanation
Correct Answer
A:Use supported failure detection/track or BFD mechanisms with explicit failover policy and reasonable timers. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: SD-WAN edges register to the validator but receive no OMP route updates from the controller, and the team claims the underlay is broken. It does not verify the present outcome.
C:This observation relates to a different topology: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It does not verify the present outcome.
D:This observation relates to a different topology: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. It does not verify the present outcome.
Question 289
A campus has out-of-band console servers but all consoles depend on the production AAA server reachable only over the failed production network. Which observed result would most directly prove the design meets the intended goal?
- A WAN outage still produces actionable diagnostics and authorized operator access.
- Operators can reach device management after production routing is intentionally removed.
- Packets arriving on incorrect RPF interfaces are rejected and legitimate receiver traffic passes.
- Authorized emergency operators can administer devices when primary campus routing and AAA are down.
Explanation
Correct Answer
D:Design OOB authentication and recovery with an approved bounded fallback independent of production paths. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It does not verify the present outcome.
B:This observation relates to a different topology: A core router's production data plane fails, leaving SSH reachable only through the same failed core path. It does not verify the present outcome.
C:This observation relates to a different topology: A multicast source is reachable through an interface other than the one receiving the packet, but the router still forwards it to all receivers. It does not verify the present outcome.
Question 290
An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. Which observed result would most directly prove the design meets the intended goal?
- The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.
- All approved powered endpoints boot under full load and stay powered after one permitted PSU failure.
- Target PCs wake under a controlled off-hours test without exposing unnecessary broadcast reachability.
- Rogue DHCP offers from access ports are dropped while authorized client leases succeed.
Explanation
Correct Answer
A:Reclassify the specific supported bridge-facing port and retain edge protection elsewhere. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It does not verify the present outcome.
C:This observation relates to a different topology: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. It does not verify the present outcome.
D:This observation relates to a different topology: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not verify the present outcome.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
