100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 30
A campus configures very aggressive BFD intervals on thousands of routed links and then sees intermittent neighbor flaps at peak CPU. Which design change most directly addresses the stated requirement?
- Tune BFD intervals and session scale to supported hardware and realistic detection requirements.
- Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer.
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
- Add supported object or route tracking so upstream reachability can influence HSRP active gateway selection.
Explanation
Correct Answer
A:The design is validated when true failures are found promptly while healthy links no longer reset under ordinary control-plane load.
Incorrect Answers
B:That option concerns a separate design case: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. The relevant control here is: Tune BFD intervals and session scale to supported hardware and realistic detection requirements.
C:That option concerns a separate design case: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. The relevant control here is: Tune BFD intervals and session scale to supported hardware and realistic detection requirements.
D:That option concerns a separate design case: HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. The relevant control here is: Tune BFD intervals and session scale to supported hardware and realistic detection requirements.
Question 31
A regional site uses EIGRP neighbors with mismatched autonomous system numbers despite matching IP subnet and authentication. Which design change most directly addresses the stated requirement?
- Activate and filter the correct IPv6 unicast MP-BGP address family on the intended peers.
- Align the intended EIGRP AS and verify the relevant interface network and authentication settings.
- Refine the summary to reflect reachable networks and provide appropriate handling for withdrawn components.
- Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions.
Explanation
Correct Answer
B:The design is validated when neighbors establish in the planned routing domain and exchange expected route prefixes.
Incorrect Answers
A:That option concerns a separate design case: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. The relevant control here is: Align the intended EIGRP AS and verify the relevant interface network and authentication settings.
C:That option concerns a separate design case: Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. The relevant control here is: Align the intended EIGRP AS and verify the relevant interface network and authentication settings.
D:That option concerns a separate design case: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. The relevant control here is: Align the intended EIGRP AS and verify the relevant interface network and authentication settings.
Question 32
Two independent PIM-SM domains each use local rendezvous points but remote sources must be discovered across the domains. Which design change most directly addresses the stated requirement?
- Give critical management/control traffic an appropriate protected class and regulate bulk backup load.
- Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries.
- Separate management access into a restricted VRF, VPN, or protected OOB context with explicit source policy.
- Evaluate supported MSDP-based source active exchange or a modern supported interdomain design.
Explanation
Correct Answer
D:The design is validated when sources registered in either domain become discoverable to intended remote receivers.
Incorrect Answers
A:That option concerns a separate design case: A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. The relevant control here is: Evaluate supported MSDP-based source active exchange or a modern supported interdomain design.
B:That option concerns a separate design case: Two business units share one management VLAN with unrestricted access to each other's routers. The relevant control here is: Evaluate supported MSDP-based source active exchange or a modern supported interdomain design.
C:That option concerns a separate design case: Remote branch routers are managed using the same public internet IP address that exposes a user web service. The relevant control here is: Evaluate supported MSDP-based source active exchange or a modern supported interdomain design.
Question 33
A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. Which design change most directly addresses the stated requirement?
- Choose a provider MPLS Layer 3 VPN with appropriate VRF route-target isolation and customer-to-provider routing.
- Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition.
- Evaluate an appropriately isolated L2VPN or pseudowire with defined loop, bandwidth and MTU constraints.
- Select supported WAN edge platforms and onboard them with correctly separated transport and service VPNs.
Explanation
Correct Answer
A:The design is validated when each branch exchanges only authorized VPN routes while the provider backbone transports traffic without L2 extension.
Incorrect Answers
B:That option concerns a separate design case: Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. The relevant control here is: Choose a provider MPLS Layer 3 VPN with appropriate VRF route-target isolation and customer-to-provider routing.
C:That option concerns a separate design case: Two industrial sites require transparent delivery of a small set of Ethernet services and reject routing between their private LANs. The relevant control here is: Choose a provider MPLS Layer 3 VPN with appropriate VRF route-target isolation and customer-to-provider routing.
D:That option concerns a separate design case: Branches will be migrated from static internet VPNs to SD-WAN customer edges but the design omits transport isolation and overlay security. The relevant control here is: Choose a provider MPLS Layer 3 VPN with appropriate VRF route-target isolation and customer-to-provider routing.
Question 34
A customer rents virtual machines from a provider and must patch their operating systems, but procurement classifies the service as SaaS. Which design change most directly addresses the stated requirement?
- Design timestamped telemetry with source identification and collector reconnection/backfill policy as supported.
- Classify the offering as IaaS and document customer responsibilities for guest OS, identities and workloads.
- Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations.
- Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success.
Explanation
Correct Answer
B:The design is validated when the responsibility matrix assigns OS patching and application security to the appropriate customer team.
Incorrect Answers
A:That option concerns a separate design case: A security operations service needs authoritative interface state changes, not a dashboard that replays stale telemetry after collector failure. The relevant control here is: Classify the offering as IaaS and document customer responsibilities for guest OS, identities and workloads.
C:That option concerns a separate design case: A Python network tool must update structured interface configuration through web-style requests but the engineer chooses CLI scraping instead of a supported API. The relevant control here is: Classify the offering as IaaS and document customer responsibilities for guest OS, identities and workloads.
D:That option concerns a separate design case: A controller issues RESTCONF PATCH to many routers but treats HTTP 200 from a reverse proxy login page as proof that config was changed. The relevant control here is: Classify the offering as IaaS and document customer responsibilities for guest OS, identities and workloads.
Question 35
A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. Which design change most directly addresses the stated requirement?
- Explicitly control default route origination and conditional advertisements at authorized borders.
- Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
- Place route summarization at contiguous ownership boundaries and preserve specific exceptions needed for proper egress.
Explanation
Correct Answer
A:The design is validated when the corporate campus receives only the approved default from designated egress nodes.
Incorrect Answers
B:That option concerns a separate design case: A campus wants deterministic STP roots but all switches retain default bridge priorities. The relevant control here is: Explicitly control default route origination and conditional advertisements at authorized borders.
C:That option concerns a separate design case: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. The relevant control here is: Explicitly control default route origination and conditional advertisements at authorized borders.
D:That option concerns a separate design case: Branch-specific prefix updates flood every campus router; a proposed aggregate crosses two distinct WAN egress sites. The relevant control here is: Explicitly control default route origination and conditional advertisements at authorized borders.
Question 36
An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. Which design change most directly addresses the stated requirement?
- Honor the IS-IS overload-bit signaling and restore normal transit eligibility only when routing readiness is confirmed.
- Apply EIGRP summarization, stub boundaries, and reliable connectivity to limit query scope.
- Align supported interface MTU and OSPF adjacency parameters rather than suppressing the mismatch blindly.
- Use appropriate convergence design, link health remediation, and scoped metric or fast-failure detection without masking a physical fault.
Explanation
Correct Answer
D:The design is validated when after repairing the link, LSP churn falls and traffic reconverges on stable intended paths.
Incorrect Answers
A:That option concerns a separate design case: The IS-IS backbone has a router in overload state after reboot and operators mistake it for an ordinary forwarding transit. The relevant control here is: Use appropriate convergence design, link health remediation, and scoped metric or fast-failure detection without masking a physical fault.
B:That option concerns a separate design case: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. The relevant control here is: Use appropriate convergence design, link health remediation, and scoped metric or fast-failure detection without masking a physical fault.
C:That option concerns a separate design case: Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. The relevant control here is: Use appropriate convergence design, link health remediation, and scoped metric or fast-failure detection without masking a physical fault.
Question 37
A multicast source is reachable through an interface other than the one receiving the packet, but the router still forwards it to all receivers. Which design change most directly addresses the stated requirement?
- Provide an independently reachable out-of-band management network and approved emergency access process.
- Verify correct Reverse Path Forwarding behavior and IGP unicast route alignment for multicast sources.
- Validate reconvergence of multicast RPF and join/prune state after unicast routing changes.
- Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling.
Explanation
Correct Answer
B:The design is validated when packets arriving on incorrect RPF interfaces are rejected and legitimate receiver traffic passes.
Incorrect Answers
A:That option concerns a separate design case: A core router's production data plane fails, leaving SSH reachable only through the same failed core path. The relevant control here is: Verify correct Reverse Path Forwarding behavior and IGP unicast route alignment for multicast sources.
C:That option concerns a separate design case: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. The relevant control here is: Verify correct Reverse Path Forwarding behavior and IGP unicast route alignment for multicast sources.
D:That option concerns a separate design case: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. The relevant control here is: Verify correct Reverse Path Forwarding behavior and IGP unicast route alignment for multicast sources.
Question 38
Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. Which design change most directly addresses the stated requirement?
- Introduce deliberate recovery policy or dampening to prevent repeated unstable failback.
- Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.
- Evaluate DWDM wavelength services with optics, reach, dispersion and protection appropriate to the fiber plant.
- Validate backup access, overlay establishment and route activation under simulated primary loss.
Explanation
Correct Answer
D:The design is validated when the required VPN tunnels and critical services establish over cellular during a failure exercise.
Incorrect Answers
A:That option concerns a separate design case: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. The relevant control here is: Validate backup access, overlay establishment and route activation under simulated primary loss.
B:That option concerns a separate design case: A disaster-recovery branch depends on a 5G uplink as backup for wired MPLS, but cellular coverage varies by carrier and power failure. The relevant control here is: Validate backup access, overlay establishment and route activation under simulated primary loss.
C:That option concerns a separate design case: Several data centers need high-capacity optical transport over metropolitan dark fiber without converting each tenant VLAN to an IP tunnel. The relevant control here is: Validate backup access, overlay establishment and route activation under simulated primary loss.
Question 39
A company assigns IPv6 /127 links between routers but a proposed monitoring tool treats each link as a /64 SLAAC user LAN. Which design change most directly addresses the stated requirement?
- Keep /127 point-to-point addressing for supported router links and use separate /64 allocations for conventional endpoint segments.
- Use appropriate convergence design, link health remediation, and scoped metric or fast-failure detection without masking a physical fault.
- Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication.
- Set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths.
Explanation
Correct Answer
A:The design is validated when router adjacencies form on the /127 links while end hosts receive appropriate /64 router advertisements on user LANs.
Incorrect Answers
B:That option concerns a separate design case: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. The relevant control here is: Keep /127 point-to-point addressing for supported router links and use separate /64 allocations for conventional endpoint segments.
C:That option concerns a separate design case: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. The relevant control here is: Keep /127 point-to-point addressing for supported router links and use separate /64 allocations for conventional endpoint segments.
D:That option concerns a separate design case: A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. The relevant control here is: Keep /127 point-to-point addressing for supported router links and use separate /64 allocations for conventional endpoint segments.
Question 40
A campus wants deterministic STP roots but all switches retain default bridge priorities. Which design change most directly addresses the stated requirement?
- Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
- Explicitly control default route origination and conditional advertisements at authorized borders.
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
- Apply route filtering at intercampus boundaries to accept only explicitly authorized prefixes.
Explanation
Correct Answer
A:The design is validated when root bridge elections and forwarding paths match the documented campus topology.
Incorrect Answers
B:That option concerns a separate design case: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. The relevant control here is: Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
C:That option concerns a separate design case: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. The relevant control here is: Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
D:That option concerns a separate design case: A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. The relevant control here is: Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests