100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 290
An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. Which observed result would most directly prove the design meets the intended goal?
- The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.
- All approved powered endpoints boot under full load and stay powered after one permitted PSU failure.
- Target PCs wake under a controlled off-hours test without exposing unnecessary broadcast reachability.
- Rogue DHCP offers from access ports are dropped while authorized client leases succeed.
Explanation
Correct Answer
A:Reclassify the specific supported bridge-facing port and retain edge protection elsewhere. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It does not verify the present outcome.
C:This observation relates to a different topology: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. It does not verify the present outcome.
D:This observation relates to a different topology: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not verify the present outcome.
Question 291
A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. Which observed result would most directly prove the design meets the intended goal?
- Authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path.
- IPv6 NLRI appears only in the authorized address-family tables with validated next-hop reachability.
- Observed inbound paths trend toward ISP B from representative external monitors without assuming universal control.
- Normal forwarding prefers the main path while failover selects the backup when primary reachability disappears.
Explanation
Correct Answer
A:Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. It does not verify the present outcome.
C:This observation relates to a different topology: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It does not verify the present outcome.
D:This observation relates to a different topology: A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. It does not verify the present outcome.
Question 292
A Python network tool must update structured interface configuration through web-style requests but the engineer chooses CLI scraping instead of a supported API. Which observed result would most directly prove the design meets the intended goal?
- Data volumes fall while five-minute trend accuracy still meets planning requirements.
- Collector time series captures the brief spikes with timestamped relevant YANG measurements.
- A controlled status change reaches the collector promptly without waiting for the next periodic poll.
- An approved RESTCONF PATCH changes only the intended interface fields and a GET verifies effective state.
Explanation
Correct Answer
D:Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It does not verify the present outcome.
B:This observation relates to a different topology: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. It does not verify the present outcome.
C:This observation relates to a different topology: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. It does not verify the present outcome.
Question 293
Several PIM-SM sites use a single RP placed across a high-latency WAN and suffer slow source registration after provider reconvergence. Which observed result would most directly prove the design meets the intended goal?
- Backup operations continue at lower priority without violating interactive video quality.
- Packet captures across both sites show correct class markings before and after provider handoff.
- A WAN outage still produces actionable diagnostics and authorized operator access.
- Local receiver joins and new-source registrations recover within target SLA during WAN failure.
Explanation
Correct Answer
D:Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It does not verify the present outcome.
B:This observation relates to a different topology: Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. It does not verify the present outcome.
C:This observation relates to a different topology: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It does not verify the present outcome.
Question 294
A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. Which observed result would most directly prove the design meets the intended goal?
- Approved site prefixes propagate across the interconnect while unrelated customer VPN routes remain isolated.
- The edge establishes intended tunnels over both transports and applications use their approved paths.
- A controlled failure of either carrier access route leaves required service operational on the independent path.
- Application flows survive permitted egress changes without stateful-firewall drops.
Explanation
Correct Answer
C:Require physical route and carrier diversity, including demarcation and access-path audits. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. It does not verify the present outcome.
B:This observation relates to a different topology: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It does not verify the present outcome.
D:This observation relates to a different topology: Two WAN routers advertise the same prefix to separate providers, but the branch returns traffic through a firewall that tracks only one side of the asymmetric flow. It does not verify the present outcome.
Question 295
Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. Which observed result would most directly prove the design meets the intended goal?
- A moved endpoint retains its intended policy and access to only approved destinations.
- The rogue bridge cannot become campus root and protected access interfaces enter their intended security state.
- Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes.
- Clients retain gateway reachability after either distribution switch fails.
Explanation
Correct Answer
A:Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It does not verify the present outcome.
C:This observation relates to a different topology: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It does not verify the present outcome.
D:This observation relates to a different topology: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It does not verify the present outcome.
Question 296
An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. Which observed result would most directly prove the design meets the intended goal?
- The eBGP session establishes over the routed path and routes remain reachable during a single underlay link failure.
- Failure of the primary underlay forces traffic to a tested eligible secondary path within the service objective.
- All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
- IPv6 packets traverse the IPv4-only transit without unintended address-family policy leaks.
Explanation
Correct Answer
D:Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A network peers eBGP over a loopback with multiple routed hops and assumes a directly connected neighbor model. It does not verify the present outcome.
B:This observation relates to a different topology: A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. It does not verify the present outcome.
C:This observation would validate a different case: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It does not establish the target outcome for this topology.
Question 297
A campus carries multicast across dual uplinks and incorrectly assumes that equal-cost unicast routes guarantee both incoming multicast paths are valid. Which observed result would most directly prove the design meets the intended goal?
- The receiver sends a source-specific join and obtains only the authorized stream.
- Voice delay stays within SLA during video bursts while other classes retain scheduled service.
- Intended receivers across the routed boundary receive the source stream.
- Legitimate multicast traffic arrives on the expected upstream interface without duplicates.
Explanation
Correct Answer
D:Verify the designated RPF path used for each multicast source and align routed topology as needed. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It does not verify the present outcome.
B:This observation relates to a different topology: Video and voice both use one strict-priority queue, causing voice jitter when video surges. It does not verify the present outcome.
C:This observation relates to a different topology: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It does not verify the present outcome.
Question 298
Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. Which observed result would most directly prove the design meets the intended goal?
- Large application sessions succeed with correct effective packet sizing over each approved transport.
- The device authenticates and forms approved control sessions with the SD-WAN fabric.
- The branch switches to the secondary circuit within the required service recovery interval.
- Child SAs establish for the matching traffic selectors and permitted applications pass.
Explanation
Correct Answer
D:Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It does not verify the present outcome.
B:This observation relates to a different topology: A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. It does not verify the present outcome.
C:This observation relates to a different topology: An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. It does not verify the present outcome.
Question 299
A campus access layer spans large broadcast domains for print discovery despite an architecture target of small local VLANs. Which observed result would most directly prove the design meets the intended goal?
- Both access links forward as designed and a chassis failure retains authorized connectivity.
- Permitted uplinks forward under normal operation and converge cleanly on individual link loss.
- Clients discover approved printers across subnets without carrying all broadcasts between buildings.
- Loss of either PDU leaves the campus default gateway and upstream traffic operating.
Explanation
Correct Answer
C:Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It does not verify the present outcome.
B:This observation relates to a different topology: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. It does not verify the present outcome.
D:This observation relates to a different topology: Two campus distribution routers each have a single power feed from the same rack PDU, yet the architecture counts them as separate fault domains. It does not verify the present outcome.
Question 300
A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. Which observed result would most directly prove the design meets the intended goal?
- IPv6 packets traverse the IPv4-only transit without unintended address-family policy leaks.
- Each site advertises unique prefixes and the regional summarization boundary routes traffic to the correct branch.
- All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
- Route reachability between distant IS-IS areas is present through level-2 adjacencies.
Explanation
Correct Answer
C:Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. It does not verify the present outcome.
B:This observation relates to a different topology: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not verify the present outcome.
D:This observation relates to a different topology: A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. It does not verify the present outcome.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
