100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 20
A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. Which design change most directly addresses the stated requirement?
- Use a supported multi-chassis EtherChannel or routed-access design to make redundancy active without a spanning-tree loop.
- Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior.
- Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints.
- Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions.
Explanation
Correct Answer
D:The design is validated when both failure exercises satisfy the documented outage budget without skipping required policy checks.
Incorrect Answers
A:That option concerns a separate design case: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. The relevant control here is: Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions.
B:That option concerns a separate design case: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. The relevant control here is: Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions.
C:That option concerns a separate design case: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. The relevant control here is: Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions.
Question 21
SD-WAN edges register to the validator but receive no OMP route updates from the controller, and the team claims the underlay is broken. Which design change most directly addresses the stated requirement?
- Distinguish orchestration, management, control-plane and data-plane roles and repair the controller/OMP relationship.
- Separate optical multiplexing requirements from routing or Ethernet tenant segmentation carried over the wavelengths.
- Use supported failure detection/track or BFD mechanisms with explicit failover policy and reasonable timers.
- Select an appropriate private APN, outbound-initiated overlay, or routable-address service depending on carrier capabilities.
Explanation
Correct Answer
A:The design is validated when edges establish controller sessions and exchange authorized OMP reachability while the transport remains reachable.
Incorrect Answers
B:That option concerns a separate design case: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. The relevant control here is: Distinguish orchestration, management, control-plane and data-plane roles and repair the controller/OMP relationship.
C:That option concerns a separate design case: An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. The relevant control here is: Distinguish orchestration, management, control-plane and data-plane roles and repair the controller/OMP relationship.
D:That option concerns a separate design case: An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. The relevant control here is: Distinguish orchestration, management, control-plane and data-plane roles and repair the controller/OMP relationship.
Question 22
An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. Which design change most directly addresses the stated requirement?
- Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing.
- Classify the combined arrangement as hybrid cloud and design controlled identity, routing, and data movement policies.
- Use an appropriate Cisco native YANG model for supported platform-specific configuration.
- Use supported NETCONF locks, edit-config validation and controlled commit workflow to serialize sensitive changes.
Explanation
Correct Answer
B:The design is validated when approved burst workloads operate across the private and public boundaries without unrestricted network trust.
Incorrect Answers
A:That option concerns a separate design case: A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. The relevant control here is: Classify the combined arrangement as hybrid cloud and design controlled identity, routing, and data movement policies.
C:That option concerns a separate design case: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. The relevant control here is: Classify the combined arrangement as hybrid cloud and design controlled identity, routing, and data movement policies.
D:That option concerns a separate design case: A NETCONF client edits a shared candidate configuration while another orchestrator is modifying the same device. The relevant control here is: Classify the combined arrangement as hybrid cloud and design controlled identity, routing, and data movement policies.
Question 23
A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. Which design change most directly addresses the stated requirement?
- Classify traffic by actual application need and reserve EF treatment for suitable expedited traffic.
- Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior.
- Apply appropriate egress shaping near the WAN handoff to control offered rate and bursts within the contract.
- Give critical management/control traffic an appropriate protected class and regulate bulk backup load.
Explanation
Correct Answer
B:The design is validated when burst traffic drains within a controlled rate envelope with fewer avoidable losses.
Incorrect Answers
A:That option concerns a separate design case: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. The relevant control here is: Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior.
C:That option concerns a separate design case: A 1-Gbps campus uplink feeds a 100-Mbps WAN access circuit and packets drop in unpredictable bursts at the provider policer. The relevant control here is: Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior.
D:That option concerns a separate design case: A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. The relevant control here is: Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior.
Question 24
A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. Which design change most directly addresses the stated requirement?
- Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile.
- Separate service attachment across independent core fault domains and validate downstream convergence.
- Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
- Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks.
Explanation
Correct Answer
A:The design is validated when only the approved number of endpoint identities can use the port while rogue downstream devices are blocked.
Incorrect Answers
B:That option concerns a separate design case: A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. The relevant control here is: Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile.
C:That option concerns a separate design case: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. The relevant control here is: Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile.
D:That option concerns a separate design case: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. The relevant control here is: Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile.
Question 25
IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. Which design change most directly addresses the stated requirement?
- Use controlled redistribution policy with route tags and a defined protocol boundary between OSPF and IS-IS.
- Apply a scoped outbound prefix filter that blocks private/internal routes from the external BGP adjacency.
- Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
- Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.
Explanation
Correct Answer
A:The design is validated when allowed external routes appear without reentering their origin routing domain on an alternate border.
Incorrect Answers
B:That option concerns a separate design case: A partner BGP session accidentally advertises a sensitive 10.0.0.0/8 internal route to an external ASN. The relevant control here is: Use controlled redistribution policy with route tags and a defined protocol boundary between OSPF and IS-IS.
C:That option concerns a separate design case: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. The relevant control here is: Use controlled redistribution policy with route tags and a defined protocol boundary between OSPF and IS-IS.
D:That option concerns a separate design case: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. The relevant control here is: Use controlled redistribution policy with route tags and a defined protocol boundary between OSPF and IS-IS.
Question 26
A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. Which design change most directly addresses the stated requirement?
- Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior.
- Use a supported multi-chassis EtherChannel or routed-access design to make redundancy active without a spanning-tree loop.
- Add supported object or route tracking so upstream reachability can influence HSRP active gateway selection.
- Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy.
Explanation
Correct Answer
D:The design is validated when both routers carry planned VLAN traffic in steady state and provide gateway redundancy during outages.
Incorrect Answers
A:That option concerns a separate design case: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. The relevant control here is: Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy.
B:That option concerns a separate design case: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. The relevant control here is: Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy.
C:That option concerns a separate design case: HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. The relevant control here is: Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy.
Question 27
Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. Which design change most directly addresses the stated requirement?
- Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
- Use appropriate convergence design, link health remediation, and scoped metric or fast-failure detection without masking a physical fault.
- Align supported interface MTU and OSPF adjacency parameters rather than suppressing the mismatch blindly.
- Apply EIGRP summarization, stub boundaries, and reliable connectivity to limit query scope.
Explanation
Correct Answer
C:The design is validated when the neighbors reach FULL and application packets traverse without fragmentation problems.
Incorrect Answers
A:That option concerns a separate design case: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. The relevant control here is: Align supported interface MTU and OSPF adjacency parameters rather than suppressing the mismatch blindly.
B:That option concerns a separate design case: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. The relevant control here is: Align supported interface MTU and OSPF adjacency parameters rather than suppressing the mismatch blindly.
D:That option concerns a separate design case: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. The relevant control here is: Align supported interface MTU and OSPF adjacency parameters rather than suppressing the mismatch blindly.
Question 28
Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. Which design change most directly addresses the stated requirement?
- Classify traffic by actual application need and reserve EF treatment for suitable expedited traffic.
- Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees.
- Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
- Standardize classification and remarking policy across all controlled network trust boundaries.
Explanation
Correct Answer
D:The design is validated when packet captures across both sites show correct class markings before and after provider handoff.
Incorrect Answers
A:That option concerns a separate design case: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. The relevant control here is: Standardize classification and remarking policy across all controlled network trust boundaries.
B:That option concerns a separate design case: Video and voice both use one strict-priority queue, causing voice jitter when video surges. The relevant control here is: Standardize classification and remarking policy across all controlled network trust boundaries.
C:That option concerns a separate design case: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. The relevant control here is: Standardize classification and remarking policy across all controlled network trust boundaries.
Question 29
A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. Which design change most directly addresses the stated requirement?
- Align the signed device identity, organization name and controller trust requirements for supported secure onboarding.
- Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes.
- Provide independent edge and transport paths when required; treat controller redundancy as a separate failure domain.
- Separate service VPNs/segments and apply centralized policy matching approved guest and corporate destinations.
Explanation
Correct Answer
A:The design is validated when the device authenticates and forms approved control sessions with the SD-WAN fabric.
Incorrect Answers
B:That option concerns a separate design case: Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. The relevant control here is: Align the signed device identity, organization name and controller trust requirements for supported secure onboarding.
C:That option concerns a separate design case: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. The relevant control here is: Align the signed device identity, organization name and controller trust requirements for supported secure onboarding.
D:That option concerns a separate design case: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. The relevant control here is: Align the signed device identity, organization name and controller trust requirements for supported secure onboarding.
Question 30
A campus configures very aggressive BFD intervals on thousands of routed links and then sees intermittent neighbor flaps at peak CPU. Which design change most directly addresses the stated requirement?
- Tune BFD intervals and session scale to supported hardware and realistic detection requirements.
- Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer.
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
- Add supported object or route tracking so upstream reachability can influence HSRP active gateway selection.
Explanation
Correct Answer
A:The design is validated when true failures are found promptly while healthy links no longer reset under ordinary control-plane load.
Incorrect Answers
B:That option concerns a separate design case: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. The relevant control here is: Tune BFD intervals and session scale to supported hardware and realistic detection requirements.
C:That option concerns a separate design case: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. The relevant control here is: Tune BFD intervals and session scale to supported hardware and realistic detection requirements.
D:That option concerns a separate design case: HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. The relevant control here is: Tune BFD intervals and session scale to supported hardware and realistic detection requirements.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests