100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 400
A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. Which observed result would most directly prove the design meets the intended goal?
- Failed-route convergence completes without broad stuck-in-active propagation.
- Clients retain enough independent eligible paths to support the agreed failover policy.
- The optimal successor forwards normally and eligible backup takes over without a network-wide query where feasible.
- Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible.
Explanation
Correct Answer
D:Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It does not verify the present outcome.
B:This observation relates to a different topology: An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. It does not verify the present outcome.
C:This observation relates to a different topology: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It does not verify the present outcome.
Question 401
A distribution pair advertises the same summary at two locations, but one has a 100-Mbps backhaul and receives half of campus traffic. Which observed result would most directly prove the design meets the intended goal?
- Both access links forward as designed and a chassis failure retains authorized connectivity.
- Switches participate in the expected common region and root placement is consistent per instance.
- Normal flow distribution avoids congesting the slow backhaul and failover still reaches the destination.
- A tested hardware or supervisor failure meets application recovery objectives without unexpected shared dependencies.
Explanation
Correct Answer
C:Align advertised costs and path policy with available bandwidth and acceptable backup behavior. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It does not verify the present outcome.
B:This observation relates to a different topology: A new MST campus region accidentally has a different VLAN-to-instance mapping on one distribution switch. It does not verify the present outcome.
D:This observation relates to a different topology: A virtualized distribution pair uses one logical control plane and engineers assume it offers separate failure domains like two chassis in different buildings. It does not verify the present outcome.
Question 402
A design team wants fast OSPF failure detection on long-running optical links without dropping stable adjacencies during occasional control-plane delay. Which observed result would most directly prove the design meets the intended goal?
- A genuine path failure is detected within the target interval while benign load does not flap sessions.
- OSPF adjacencies establish only between intended authenticated peers and survive planned key changes.
- Allowed external routes appear without reentering their origin routing domain on an alternate border.
- The optimal successor forwards normally and eligible backup takes over without a network-wide query where feasible.
Explanation
Correct Answer
A:Evaluate BFD and appropriate OSPF timers with a realistic detection budget and hardware scale. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
B:This observation relates to a different topology: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It does not verify the present outcome.
C:This observation relates to a different topology: IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. It does not verify the present outcome.
D:This observation relates to a different topology: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It does not verify the present outcome.
Question 403
Remote branch routers are managed using the same public internet IP address that exposes a user web service. Which observed result would most directly prove the design meets the intended goal?
- Intended receivers obtain the translated stream while unrelated multicast groups remain separate.
- Sources registered in either domain become discoverable to intended remote receivers.
- End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment.
- Only authorized operators can connect to device management while public services remain available.
Explanation
Correct Answer
D:Separate management access into a restricted VRF, VPN, or protected OOB context with explicit source policy. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. It does not verify the present outcome.
B:This observation relates to a different topology: Two independent PIM-SM domains each use local rendezvous points but remote sources must be discovered across the domains. It does not verify the present outcome.
C:This observation relates to a different topology: A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. It does not verify the present outcome.
Question 404
A development team consumes a managed runtime that deploys application code without administering underlying servers and calls it raw IaaS. Which observed result would most directly prove the design meets the intended goal?
- Approved configuration changes use the negotiated datastore and produce attributable RPC replies.
- Schema registry entries identify the correct module namespace and revisions for each controller operation.
- Deployment responsibilities correctly assign code and app security to the customer while platform maintenance follows provider terms.
- The client negotiates capabilities and receives model-based Get/Subscribe responses from the intended target.
Explanation
Correct Answer
C:Classify the hosted runtime as PaaS and document the application versus platform operations boundary. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It does not verify the present outcome.
B:This observation relates to a different topology: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. It does not verify the present outcome.
D:This observation relates to a different topology: A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. It does not verify the present outcome.
Question 405
A site-to-site tunnel must protect financial payload confidentiality and integrity across the public internet. Which observed result would most directly prove the design meets the intended goal?
- Routed adjacency and encapsulated application flows operate through the secure tunnel.
- Enterprise routers form intended routing neighbors over the circuit while provider internals remain hidden.
- The edge establishes intended tunnels over both transports and applications use their approved paths.
- Protected traffic crosses an established security association and is unreadable on the public underlay.
Explanation
Correct Answer
D:Choose a supported IPsec design with appropriate IKE authentication, encryption proposals and key rotation. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An enterprise replaces a point-to-point GRE tunnel with raw IPsec ESP and expects dynamic multicast routing hellos to work unchanged. It does not verify the present outcome.
B:This observation relates to a different topology: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It does not verify the present outcome.
C:This observation relates to a different topology: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It does not verify the present outcome.
Question 406
A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. Which observed result would most directly prove the design meets the intended goal?
- Local access failures generate bounded LSDB changes without disrupting unrelated branches.
- The IPv6 client resolves and accesses the approved IPv4 service without adopting IPv4 on the client.
- The prefix exits through the intended ASBR and remains loop-free on failover.
- IPv6 connections to protected applications are blocked or allowed consistently with approved policy.
Explanation
Correct Answer
B:Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It does not verify the present outcome.
C:This observation relates to a different topology: An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. It does not verify the present outcome.
D:This observation relates to a different topology: A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. It does not verify the present outcome.
Question 407
Branch-specific prefix updates flood every campus router; a proposed aggregate crosses two distinct WAN egress sites. Which observed result would most directly prove the design meets the intended goal?
- Site-to-site voice follows a lower-latency approved route while hub failure leaves planned alternate reachability.
- Endpoint moves are learned through the surviving control-plane node and authorized traffic resumes.
- The corporate campus receives only the approved default from designated egress nodes.
- Prefix changes within a campus no longer cause unnecessary global churn while remote packets use the proper border.
Explanation
Correct Answer
D:Place route summarization at contiguous ownership boundaries and preserve specific exceptions needed for proper egress. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: Three campus sites peer with a shared WAN hub; every site transits through the hub even for cross-campus traffic and voice suffers latency. It does not verify the present outcome.
B:This observation relates to a different topology: A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. It does not verify the present outcome.
C:This observation relates to a different topology: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. It does not verify the present outcome.
Question 408
An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. Which observed result would most directly prove the design meets the intended goal?
- The device authenticates and forms approved control sessions with the SD-WAN fabric.
- Guest prefixes and traffic stay isolated from production routes and data tunnels.
- The site retains approved application reachability after losing one WAN edge or carrier path.
- Finance sites reach only designated hubs while approved other segments preserve their intended paths.
Explanation
Correct Answer
B:Separate service VPNs/segments and apply centralized policy matching approved guest and corporate destinations. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. It does not verify the present outcome.
C:This observation relates to a different topology: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It does not verify the present outcome.
D:This observation relates to a different topology: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. It does not verify the present outcome.
Question 409
A WAN provider accepts only three traffic classes but headquarters configures eight local DSCP queues and assumes all survive the handoff. Which observed result would most directly prove the design meets the intended goal?
- Guest traffic uses its approved classes without consuming the premium real-time queue.
- Backup operations continue at lower priority without violating interactive video quality.
- End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment.
- Each business traffic class receives the agreed provider class and treatment across the WAN.
Explanation
Correct Answer
D:Map internal DSCP classes onto the provider-supported service groups explicitly and consistently. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: An enterprise WAN receives DSCP values from untrusted guest clients and propagates them unchanged into privileged queues. It does not verify the present outcome.
B:This observation relates to a different topology: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It does not verify the present outcome.
C:This observation relates to a different topology: A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. It does not verify the present outcome.
Question 410
A dual-provider BGP edge must prefer ISP A for outbound traffic, but inbound updates from A have a lower MED than B and engineers assume MED dictates every decision. Which observed result would most directly prove the design meets the intended goal?
- The IPv6 client resolves and accesses the approved IPv4 service without adopting IPv4 on the client.
- The accepted RIB contains the permitted default and no unintended provider prefixes.
- All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
- Internal BGP best-path selection prefers ISP A where the intended routes are otherwise eligible.
Explanation
Correct Answer
D:Use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference. Verify the resulting network behavior rather than relying only on the saved configuration.
Incorrect Answers
A:This observation relates to a different topology: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It does not verify the present outcome.
B:This observation relates to a different topology: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It does not verify the present outcome.
C:This observation would validate a different case: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It does not establish the target outcome for this topology.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
